Merge branch 'main' into mike/fix-expo-startup-requests

Author: wobsoriano

.changeset/drawer-select-escape.md

@@ -0,0 +1,5 @@
+---
+'@clerk/ui': patch
+---
+
+Fix pressing `Escape` while a `Select` is open inside a `Drawer` (for example the payment method picker in Checkout) dismissing the entire Drawer. `Escape` now closes only the open `Select` and leaves the Drawer open. The `Select` now wires up its floating interaction props so it handles `Escape` itself, and the `Drawer` roots a floating tree so nested floating elements are recognized as its children.

.changeset/fuzzy-lions-recompose.md

@@ -0,0 +1,5 @@
+---
+'@clerk/expo': patch
+---
+
+Fix Android native UI components crashing before window attachment or becoming unresponsive after navigation detaches and reattaches their views.

.changeset/m2m-token-timestamp-units.md

@@ -0,0 +1,7 @@
+---
+'@clerk/tanstack-react-start': patch
+'@clerk/shared': patch
+'@clerk/astro': patch
+---
+
+Escape `<`, `>`, and `/` when serializing the Clerk auth state into SSR `<script>` tags, preventing a `</script>` sequence inside user-controllable session claims from breaking out of the script element (stored XSS). The embedded JSON still parses to identical values on the client.

.changeset/mighty-jars-sell.md

@@ -0,0 +1,5 @@
+---
+'@clerk/ui': patch
+---
+
+Improve `Select` keyboard and screen reader support by routing navigation through floating-ui's interaction hooks. Pressing `ArrowUp`/`ArrowDown` on a focused, closed `Select` now opens the listbox, and the active option is announced via `aria-activedescendant`. The searchable variant (for example the `PhoneInput` country picker) now exposes a proper combobox: its input is marked `role="combobox"` with `aria-controls`, `aria-autocomplete="list"`, and `aria-activedescendant`, while the plain variant keeps its listbox semantics.

.changeset/mosaic-domains-section.md

@@ -0,0 +1,5 @@
+---
+'@clerk/backend': patch
+---
+
+Reject machine tokens (M2M and OAuth JWTs) presented in the `__session` cookie. Previously such a token could pass session verification and produce a signed-in state with the machine identity as `userId`, defeating `if (userId)` authorization checks. The cookie path now mirrors the existing header-path guard and returns a signed-out state for these tokens.

.changeset/open-buckets-bake.md

@@ -0,0 +1,5 @@
+---
+'@clerk/expo': patch
+---
+
+Prevent Expo apps from accumulating duplicate initialization requests while the Clerk API is unavailable or the app reloads.