Skip to content

fix: bump the all-npm group with 5 updates - #294

Open
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/all-npm-30a470a290
Open

fix: bump the all-npm group with 5 updates#294
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/all-npm-30a470a290

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the all-npm group with 5 updates:

Package From To
@better-auth/core 1.7.2 1.7.4
@better-auth/oauth-provider 1.7.2 1.7.4
better-auth 1.7.2 1.7.4
zod 4.5.1 4.6.2
@biomejs/biome 2.5.11 2.5.13

Updates @better-auth/core from 1.7.2 to 1.7.4

Release notes

Sourced from @​better-auth/core's releases.

v1.7.4

better-auth

Features

  • Added experimental.instrumentation.enabled to disable OpenTelemetry span creation per auth instance. (#11224)
  • Added support for additional session fields in testUtils auth helpers. (#11217)
  • Added Vitest 5 support to the testing utilities. (#11205)

For detailed changes, see CHANGELOG

@better-auth/core

Features

  • Added experimental.instrumentation.enabled to disable OpenTelemetry span creation per auth instance. (#11224)

Bug Fixes

  • Fixed Metro bundling when the optional OpenTelemetry API is not installed. (#11210)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

  • Fixed multibyte session data storage in Expo SecureStore. (#11238)
  • Fixed stale Expo secure-storage session data and corrupted cookies during concurrent updates. (#11200)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

  • Improved schema validation for the Drizzle Relations v2 adapter. (#11213)

For detailed changes, see CHANGELOG

@better-auth/test-utils

Features

  • Added Vitest 5 support to the testing utilities. (#11205)

For detailed changes, see CHANGELOG

Contributors

... (truncated)

Changelog

Sourced from @​better-auth/core's changelog.

1.7.4

Patch Changes

  • #11210 3ff842a Thanks @​bytaesu! - Prevent bundlers such as Metro from failing when the optional OpenTelemetry API is not installed.

  • #11224 c1756a2 Thanks @​bytaesu! - Add experimental.instrumentation.enabled to disable Better Auth OpenTelemetry span creation per auth instance. Instrumentation remains enabled by default and independent of usage reporting.

1.7.3

Patch Changes

  • #11179 352d012 Thanks @​bytaesu! - Validate Drizzle schema objects and generated Prisma client models during initialization, including in production, and report mismatches with guidance for fixing them. These checks do not query the database and cannot detect unapplied migrations.

    For Prisma clients whose model metadata omits nullability, auth generate reports required fields that Better Auth never writes by reading the existing Prisma schema. Set advanced.database.validateSchema: false to disable runtime validation.

  • #9908 76d311f Thanks @​harshil1712! - Add Cloudflare as a built-in social provider, with support for client-secret authentication and PKCE clients without a secret.

  • #11101 3e9e197 Thanks @​bytaesu! - Add a custom token endpoint authentication strategy for providers that require non-standard request parameters.

  • #11068 157ec8d Thanks @​bytaesu! - Improve request IP validation performance.

  • #11102 baa08f4 Thanks @​bytaesu! - Fix TikTok sign-in and token refresh failing when configured with the documented clientKey and clientSecret options.

  • #11129 9e36635 Thanks @​bytaesu! - Improve PayPal authorization code and refresh token requests, including PKCE parameter handling.

  • #11178 be0e007 Thanks @​bytaesu! - Report missing tables, missing columns, and required columns Better Auth never writes during initialization, with guidance for fixing them. Kysely checks the live database schema. Authentication requests await the same check and are rejected if the schema does not match.

    Validation is enabled by default, including in production. Set advanced.database.validateSchema: false to disable runtime validation. auth migrate refuses to apply changes when required unwritten columns need manual repair.

  • #11134 a2bae0c Thanks @​bytaesu! - Improve Reddit token requests with OAuth-compliant Basic authentication and redirect protection.

  • #11189 1a1b7d5 Thanks @​bytaesu! - Make consumeOne and incrementOne optional again for custom database adapters, using guarded fallbacks when native methods are absent. Fallbacks require atomic conditional writes and accurate affected-row counts. Fallback increments can fail when contention exhausts their retries.

  • #11153 2220ee7 Thanks @​bytaesu! - Restore sign-in compatibility with 1.6 databases by identifying accounts with (providerId, accountId) and removing the issuer requirement introduced in 1.7.0. Upgrading from 1.6 no longer requires an account schema migration. Ambiguous account keys are rejected instead of selecting an arbitrary account.

    If you applied the 1.7.0 through 1.7.2 account schema, remove its issuer unique index before upgrading. For SQL databases, also make issuer nullable or remove the column so sign-ups and account linking can succeed. auth migrate does not perform this cleanup. Follow the upgrade guide for database-specific steps.

Commits

Updates @better-auth/oauth-provider from 1.7.2 to 1.7.4

Release notes

Sourced from @​better-auth/oauth-provider's releases.

v1.7.4

better-auth

Features

  • Added experimental.instrumentation.enabled to disable OpenTelemetry span creation per auth instance. (#11224)
  • Added support for additional session fields in testUtils auth helpers. (#11217)
  • Added Vitest 5 support to the testing utilities. (#11205)

For detailed changes, see CHANGELOG

@better-auth/core

Features

  • Added experimental.instrumentation.enabled to disable OpenTelemetry span creation per auth instance. (#11224)

Bug Fixes

  • Fixed Metro bundling when the optional OpenTelemetry API is not installed. (#11210)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

  • Fixed multibyte session data storage in Expo SecureStore. (#11238)
  • Fixed stale Expo secure-storage session data and corrupted cookies during concurrent updates. (#11200)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

  • Improved schema validation for the Drizzle Relations v2 adapter. (#11213)

For detailed changes, see CHANGELOG

@better-auth/test-utils

Features

  • Added Vitest 5 support to the testing utilities. (#11205)

For detailed changes, see CHANGELOG

Contributors

... (truncated)

Changelog

Sourced from @​better-auth/oauth-provider's changelog.

1.7.4

1.7.3

Patch Changes

  • #11090 4d09d50 Thanks @​Salman-Arshad! - Allow native OAuth clients with localhost loopback redirect URIs to use ephemeral callback ports, and ensure loopback port variance changes only the port.
Commits

Updates better-auth from 1.7.2 to 1.7.4

Release notes

Sourced from better-auth's releases.

v1.7.4

better-auth

Features

  • Added experimental.instrumentation.enabled to disable OpenTelemetry span creation per auth instance. (#11224)
  • Added support for additional session fields in testUtils auth helpers. (#11217)
  • Added Vitest 5 support to the testing utilities. (#11205)

For detailed changes, see CHANGELOG

@better-auth/core

Features

  • Added experimental.instrumentation.enabled to disable OpenTelemetry span creation per auth instance. (#11224)

Bug Fixes

  • Fixed Metro bundling when the optional OpenTelemetry API is not installed. (#11210)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

  • Fixed multibyte session data storage in Expo SecureStore. (#11238)
  • Fixed stale Expo secure-storage session data and corrupted cookies during concurrent updates. (#11200)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

  • Improved schema validation for the Drizzle Relations v2 adapter. (#11213)

For detailed changes, see CHANGELOG

@better-auth/test-utils

Features

  • Added Vitest 5 support to the testing utilities. (#11205)

For detailed changes, see CHANGELOG

Contributors

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.4

Patch Changes

  • #11205 3f890eb Thanks @​bytaesu! - Support Vitest 5 in the testing utilities while retaining support for previously supported Vitest versions.

  • #11224 c1756a2 Thanks @​bytaesu! - Add experimental.instrumentation.enabled to disable Better Auth OpenTelemetry span creation per auth instance. Instrumentation remains enabled by default and independent of usage reporting.

  • #11217 9b9638e Thanks @​onmax! - Allow testUtils auth helpers to accept additional session fields through the session option, including required fields without defaults and per-session overrides of configured defaults.

  • Updated dependencies [3ff842a, b905bfe, c1756a2]:

    • @​better-auth/core@​1.7.4
    • @​better-auth/drizzle-adapter@​1.7.4
    • @​better-auth/kysely-adapter@​1.7.4
    • @​better-auth/memory-adapter@​1.7.4
    • @​better-auth/mongo-adapter@​1.7.4
    • @​better-auth/prisma-adapter@​1.7.4
    • @​better-auth/telemetry@​1.7.4

1.7.3

Patch Changes

  • #11060 3660f06 Thanks @​bytaesu! - Handle malformed custom-scheme callback URLs without excessive processing.

  • #11037 5bd7096 Thanks @​bytaesu! - Prevent repeated TOTP enrollment from replacing an active authenticator and its backup codes.

  • #11120 7ec7146 Thanks @​onmax! - Prevent getSession from failing when cookie caching is disabled while clients still have cached session cookies.

  • #9908 76d311f Thanks @​harshil1712! - Add Cloudflare as a built-in social provider, with support for client-secret authentication and PKCE clients without a secret.

  • #11188 c47b765 Thanks @​bytaesu! - Normalize Auth0 domains without a potentially slow trailing-slash regular expression.

  • #11084 2d5c63d Thanks @​bytaesu! - Prevent duplicate session requests and hydration mismatches when using the Vue client with Nuxt useFetch.

  • #11147 a9d8c12 Thanks @​bytaesu! - Add isPasswordCompromised for checking passwords against Have I Been Pwned in custom server-side flows, while ignoring padded response entries with zero occurrences.

  • #10988 9fc7498 Thanks @​bytaesu! - Run callback hooks after proxied OAuth sign-ins and preserve server state when callback cookies are unavailable. The legacy /oauth-proxy-callback endpoint is deprecated and will be removed in the next minor release.

  • #11178 be0e007 Thanks @​bytaesu! - Report missing tables, missing columns, and required columns Better Auth never writes during initialization, with guidance for fixing them. Kysely checks the live database schema. Authentication requests await the same check and are rejected if the schema does not match.

    Validation is enabled by default, including in production. Set advanced.database.validateSchema: false to disable runtime validation. auth migrate refuses to apply changes when required unwritten columns need manual repair.

  • #11069 0bb0dbf Thanks @​bytaesu! - Improve dynamic organization role permission check performance.

  • #11153 2220ee7 Thanks @​bytaesu! - Restore sign-in compatibility with 1.6 databases by identifying accounts with (providerId, accountId) and removing the issuer requirement introduced in 1.7.0. Upgrading from 1.6 no longer requires an account schema migration. Ambiguous account keys are rejected instead of selecting an arbitrary account.

    If you applied the 1.7.0 through 1.7.2 account schema, remove its issuer unique index before upgrading. For SQL databases, also make issuer nullable or remove the column so sign-ups and account linking can succeed. auth migrate does not perform this cleanup. Follow the upgrade guide for database-specific steps.

  • #10978 5fe5bc2 Thanks @​BetterAndBetterII! - Skip a generic OAuth provider when discovery fails instead of taking down the rest of the auth API.

... (truncated)

Commits

Updates zod from 4.5.1 to 4.6.2

Release notes

Sourced from zod's releases.

v4.6.2

A patch on top of 4.6.1.

v4.6.1

A patch on top of 4.6.0.

v4.6.0

Zod 4.6 is now available.

npm install zod@latest

At a glance:

  • .validate() — checks input validity without building a result (up to 35x faster than .safeParse().success on a compiled schema)
  • z.instanceof().properties() — validates properties of an instance
  • fromJSONSchema() — enforces six validation keywords it used to ignore
  • z.iban() — electronic-format IBAN plus mod-97 checksum
  • z.withParser() — installs a parser generated elsewhere, for environments without new Function
  • Faster CommonJS — drops the getter on every export (~3x faster z.validate() under require)
  • Memory retention in recursive schemas — releases the parsed input, fixing a 4.5 out-of-memory regression
  • @zod/mini — Zod Mini as a standalone package, versioned in lockstep with zod since 4.5

.validate()

Standalone boolean validation, in Zod, Zod Mini, and Zod Core. It answers "is this input valid?" without constructing a ZodError, which makes rejection cheap. The return type is a guard on the schema's input type.

z.validate(z.string(), "hi"); // true
z.validate(z.string(), 42);   // false

It is a method on Zod Classic schemas too. (#6547)

const Player = z.object({
  username: z.string(),
  xp: z.number(),
});
</tr></table>

... (truncated)

Commits
  • e359f73 4.6.2
  • 9446b5c fix: preserve undefined prefault outputs and object keys (#6587)
  • 0c483c5 docs: Zod 4.6 announcement post (#6546)
  • a00c3f3 docs: use Trigger.dev's brand-kit lockups for the platinum card
  • 62311eb 4.6.1
  • 2efa8b8 ci: give the npm wait a real budget and drop the back-publish path (#6583)
  • b12aa52 fix: preserve unique tags with defaulted discriminators (#6582)
  • dd9c36f fix(v4): defer recursive object index inference (#6580)
  • 574d480 fix(locales): clarify Tajik discriminator value message
  • c532d76 test(locales): cover Tajik error branches
  • Additional commits viewable in compare view

Updates @biomejs/biome from 2.5.11 to 2.5.13

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.13

2.5.13

Patch Changes

  • #11379 07a0073 Thanks @​Netail! - Added the nursery rule useLayeredStyles, which enforces that style rules are defined within a cascade layer and import rules to import its styles into a cascade layer.

    /* Invalid */
@import 'foo.css';
.my-style {
color: red;
}
/* Valid */
@​import 'foo.css' layer(base);
@​layer base {
.my-style {
color: red;
}
}

  • #11667 e997900 Thanks @​devtechedge! - Added the nursery rule useBetterDomTraversing, which prefers .firstChild, .firstElementChild, .closest(), and merged .querySelector() calls over positional DOM traversal.

    element.childNodes[0];
element.children[0];
element.parentElement.parentElement;
element.querySelector("a").querySelector("b");

  • #11620 20e513a Thanks @​jakeleventhal! - Fixed #11610, #11611, #11612, #11615, and #11616: Biome no longer fully infers an imported generic declaration just to apply its type arguments, restoring type-aware lint performance for large libraries such as Zod. This improves useRegexpExec, noFloatingPromises, noMisusedPromises, useNullishCoalescing, and noUnsafePlusOperands.

  • #11657 e322040 Thanks @​ematipico! - Fixed #7495: noUselessConstructor now ignores TypeScript constructors that forward at least one argument to super, preserving constructors that narrow the subclass's accepted parameter types. The exemption also applies when the parent and child signatures are identical; JavaScript and zero-argument forwarding behavior are unchanged.

  • #11670 4969ee1 Thanks @​ematipico! - Fixed #7076: useAriaPropsForRole and useFocusableInteractive no longer report non-focusable elements with role="separator". A separator with an explicit tabIndex or tabindex still requires aria-valuenow.

  • #11627 23aad6d Thanks @​ematipico! - Fixed #6571 so Grit plugins can capture and inspect multiple named import specifiers.

  • #11631 00dbd3a Thanks @​ematipico! - Reduced unnecessary type inference when type-aware lint rules inspect members of namespace imports from libraries such as Zod. Fixed type inference so blanket re-exports do not expose default exports.

  • #11628 a2f8ff7 Thanks @​dyc3! - Added the nursery rule noXorAsExponentiation, which reports the bitwise XOR operator ^ between two decimal integer literals, where the exponentiation operator ** was likely intended.

    const kibibyte = 2 ^ 10; // 8, not 1024

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.13

Patch Changes

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
fix: bump the all-npm group with 5 updates
dde4d48 
Bumps the all-npm group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [@better-auth/core](https://github.com/better-auth/better-auth/tree/HEAD/packages/core) | `1.7.2` | `1.7.4` |
| [@better-auth/oauth-provider](https://github.com/better-auth/better-auth/tree/HEAD/packages/oauth-provider) | `1.7.2` | `1.7.4` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.2` | `1.7.4` |
| [zod](https://github.com/colinhacks/zod) | `4.5.1` | `4.6.2` |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.11` | `2.5.13` |


Updates `@better-auth/core` from 1.7.2 to 1.7.4
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/core/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.4/packages/core)

Updates `@better-auth/oauth-provider` from 1.7.2 to 1.7.4
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/oauth-provider/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.4/packages/oauth-provider)

Updates `better-auth` from 1.7.2 to 1.7.4
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.4/packages/better-auth)

Updates `zod` from 4.5.1 to 4.6.2
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.5.1...v4.6.2)

Updates `@biomejs/biome` from 2.5.11 to 2.5.13
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.13/packages/@biomejs/biome)

---
updated-dependencies:
- dependency-name: "@better-auth/core"
  dependency-version: 1.7.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-npm
- dependency-name: "@better-auth/oauth-provider"
  dependency-version: 1.7.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-npm
- dependency-name: better-auth
  dependency-version: 1.7.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-npm
- dependency-name: zod
  dependency-version: 4.6.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-npm
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-npm
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 14, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 14, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@FrkAk FrkAk Awaiting requested review from FrkAk FrkAk is a code owner
@ulascanzorer ulascanzorer Awaiting requested review from ulascanzorer ulascanzorer is a code owner
@ZeyNor ZeyNor Awaiting requested review from ZeyNor ZeyNor is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants