Skip to content

pnpm-workspace.yaml scim advisory note undercounts the stable 1.7.1 model set (six → seven, plus a conditional managed-catalog trio) #11372

Description

@os-sam

Observation from the #3653 scoping round (measurement only, no fix attached).

The @better-auth/scim advisory note in the root pnpm-workspace.yaml (the GHSA-j8v8-g9cx-5qf4 block, ~lines 82-97) records a measurement of the published 1.7.1 tarball:

replaced by code-defined connections plus six new models (scimUser, scimGroup, scimGroupMember, scimSubject, scimConnectionBinding, scimIdentityTombstone — all six present)

Measured today (2026-08-23) against the published @better-auth/scim@1.7.1 tarball, by constructing the plugin and reading plugin.schema directly:

  • The core model set is seven, not six: the comment misses scimProjectionGrant (6 occurrences in dist/index.mjs; present in the constructed schema with grantKey/role/sourceKind columns). This matches the rc.2 list already recorded in SCIM: 停在 @better-auth/scim rc.1,等正式版再整体迁移 —— rc.2 换掉了整套模型 #3653's body.
  • With managedConnections configured, three more models join the schema: scimManagedConnection, scimManagedCredential, scimManagedConnectionEvent — a DB-backed connection catalog the note's "code-defined connections" phrasing does not anticipate.
  • The note's neighbouring claim "no generate-token endpoint (0 occurrences)" re-verified true.

Why it matters: this comment is load-bearing for the #3653 migration charter — anyone scoping platform objects from it would plan six objects where stable needs seven (or ten). Full measurement evidence lives in the #3653 scoping report comment.

One-line-class fix: correct the count and name scimProjectionGrant, optionally note the managed-catalog trio. No behavior change; comment only.

Refs #3653.


Generated by Claude Code

Metadata

Metadata

Assignees

Type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions