fix: prevent unnecessary user object updates causing infinite loops

This fixes an issue where getAccessTokenSilently would create a new user
object reference even when the user data hadn't changed, causing useEffect
hooks with user dependencies to re-run infinitely.

The reducer now uses deep equality comparison (lodash.isequal) instead of
reference equality when checking if the user object has changed. This prevents
unnecessary state updates and re-renders.

Changes:
- Added lodash.isequal dependency for deep equality comparison
- Updated GET_ACCESS_TOKEN_COMPLETE and HANDLE_REDIRECT_COMPLETE cases to use isEqual
- State is only updated when user content actually changes

Fixes #787

Author: yogeshchoudhary147

package-lock.json

@@ -58,6 +58,7 @@
     "@testing-library/jest-dom": "6.8.0",
     "@testing-library/react": "16.3.0",
     "@types/jest": "^29.5.14",
+    "@types/lodash.isequal": "^4.5.8",
     "@types/react": "19.1.8",
     "@types/react-dom": "19.1.6",
     "@typescript-eslint/eslint-plugin": "^8.36.0",
@@ -95,6 +96,7 @@
     "react-dom": "^16.11.0 || ^17 || ^18 || ~19.0.1 || ~19.1.2 || ^19.2.1"
   },
   "dependencies": {
-    "@auth0/auth0-spa-js": "^2.11.0"
+    "@auth0/auth0-spa-js": "^2.11.0",
+    "lodash.isequal": "^4.5.0"
   }
 }

package.json

@@ -1,5 +1,6 @@
 import { User } from '@auth0/auth0-spa-js';
 import { AuthState } from './auth-state';
+import isEqual from 'lodash.isequal';
 
 type Action =
   | { type: 'LOGIN_POPUP_STARTED' }
@@ -35,7 +36,7 @@ export const reducer = <TUser extends User = User>(state: AuthState<TUser>, acti
       };
     case 'HANDLE_REDIRECT_COMPLETE':
     case 'GET_ACCESS_TOKEN_COMPLETE':
-      if (state.user === action.user) {
+      if (isEqual(state.user, action.user)) {
         return state;
       }
       return {