Nested arrays in mixed type fields can be returned as JSON-encoded strings instead of objects

[timbostop]

We have identified a bug in Clerk SDK's MixedJSONHandler (line 40-48):

public function serializeMixedToJson(...): string
{
$serializer = JSON::createSerializer();
$s = $serializer->serialize($any, 'json');
$s = ltrim($s, '"');
$s = rtrim($s, '"');
return $s; // Returns STRING, not the actual array! - should return mixed?
}

When the SDK serializes publicMetadata (typed as array<string, mixed>), any nested arrays like ['sausage' => 4840] get passed to this handler because they're mixed. It serializes them to JSON strings instead of preserving the array structure.

The SDK sends:

  {"public_metadata": {"something": "{\"sausage\":4840}"}}

Instead of:

  {"public_metadata": {"something": {"sausage": 4840}}}