chore(deps)(deps): Bump the production-dependencies group with 21 updates - #13589

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-6f36c788ab
Closed

chore(deps)(deps): Bump the production-dependencies group with 21 updates#13589
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-6f36c788ab

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubAug 31, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 21 updates:

PackageFromTo
@oclif/core4.13.34.14.0
js-yaml5.2.35.4.1
sql.js1.14.11.14.2
mongodb7.5.07.6.0
@better-auth/core1.7.11.7.2
@better-auth/oauth-provider1.7.11.7.2
@better-auth/scim1.7.11.7.2
@better-auth/sso1.7.11.7.2
@noble/hashes2.3.02.4.0
better-auth1.7.11.7.2
jose6.2.86.2.10
hono4.13.24.13.5
nodemailer9.0.59.0.6
pinyin-pro3.29.13.29.3
@noble/ciphers2.3.02.4.0
fumadocs-core16.14.416.15.4
fumadocs-mdx15.2.315.4.0
fumadocs-ui16.14.416.15.4
lucide-react1.31.01.34.0
mermaid11.16.111.17.2
next16.3.116.3.3

Updates @oclif/core from 4.13.3 to 4.14.0

Release notes

Sourced from @​oclif/core's releases.

4.14.0

Features

  • bumping to eslint v10 (W-23473845) (248de04)

4.13.5

Bug Fixes

  • replaced require with dynamic import (W-23807278) (d35e325)

4.13.4

Bug Fixes

  • resolved security vulnerability in powershell path (W-23807278) (911e9d2)
Changelog

Sourced from @​oclif/core's changelog.

4.14.0 (2026-08-19)

Features

  • bumping to eslint v10 (W-23473845) (248de04)

4.13.5 (2026-08-14)

Bug Fixes

  • replaced require with dynamic import (W-23807278) (d35e325)

4.13.4 (2026-08-14)

Bug Fixes

  • resolved security vulnerability in powershell path (W-23807278) (911e9d2)
Commits
  • 1d2903e chore(release): 4.14.0 [skip ci]
  • 45c7f0a Merge pull request #1635 from oclif/d/W-23473845
  • 395c8bc chore: prune stale eslint suppressions after merge
  • 35ddd2e chore: merge main into d/W-23473845
  • 0d01467 chore(release): 4.13.5 [skip ci]
  • 06949eb Merge pull request #1638 from oclif/d/W-23807278-2
  • d35e325 fix: replaced require with dynamic import (W-23807278)
  • 85370b7 chore(release): 4.13.4 [skip ci]
  • 3318c6e Merge pull request #1636 from oclif/d/W-23807278
  • 911e9d2 fix: resolved security vulnerability in powershell path (W-23807278)
  • Additional commits viewable in compare view

Updates js-yaml from 5.2.3 to 5.4.1

Changelog

Sourced from js-yaml's changelog.

[5.4.1] - 2026-08-26

Changed

  • Hard-limit merge sequence size to 100.

Security

  • Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

[5.4.0] - 2026-08-25

Added

  • Added the scalarStyleRules dumper option to customize string formatting. See Scalar styling for details.

Changed

  • [breaking] Flattened the low-level AST node style representation. Scalar and collection nodes now use SCALAR_STYLE and COLLECTION_STYLE values; explicit tags use the separate tagged property. Alias nodes now contain only kind and anchor. This only affects code that directly constructs or edits AST nodes.
  • [breaking] The sortKeys option was rewritten using AST mutation to avoid side effects.
  • Reworked scalar style selection. This can change formatting without changing loaded values; in particular, whitespace-only strings are now double-quoted.

Fixed

  • Accept a byte order mark at the start of each document in a stream, #791.
  • Produce valid flow mappings with quoteFlowKeys and flowSkipColonSpace, including alias and property-only keys, #786.
  • Preserve empty scalar items when converting block sequences to flow style.
  • Do not apply the 1024-character simple-key limit to flow mapping keys.
  • Count Unicode code points, rather than UTF-16 code units, for the 1024-character simple-key limit.
  • Add an explicit document-end marker after keep-chomped block scalars when needed to preserve trailing newlines.

[5.3.0] - 2026-08-14

This release focuses on reworking the documentation and making small architectural improvements before moving forward.

Added

  • Added completely new documentation.
  • Exported DUMP_SCHEMA, the default schema used by the dumper.
  • Added YAMLException.throwAt() for throwing an error at a source position.

Changed

... (truncated)

Commits

Updates sql.js from 1.14.1 to 1.14.2

Commits
  • 9c4e167 ci: debug npm publish http log
  • 1d5db45 ci: use npm 11 for OIDC trusted publishing
  • c2c6909 debug: oidc env dump
  • 17159df debug: oidc
  • 7e943bd ci: publish to npm via OIDC trusted publishing
  • c11695f Bump version to 1.14.2
  • 5489808 fix: restore WASM stack in Database.exec to prevent stack leak (#631)
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for sql.js since your current version.


Updates mongodb from 7.5.0 to 7.6.0

Release notes

Sourced from mongodb's releases.

v7.6.0

7.6.0 (2026-08-21)

The MongoDB Node.js team is pleased to announce version 7.6.0 of the mongodb package!

Release Notes

Support for MongoDB 4.2 is removed

[!WARNING] When the driver connects to a MongoDB server of version 4.2 or less, it will now throw an error.

HTTP proxy support for KMS requests in CSFLE and Queryable Encryption

In-use encryption can now route KMS requests through an HTTP proxy. Set kmsConnectCallback on your ClientEncryption or auto-encryption options to control how the driver connects to a KMS host. The callback receives the target host and port and returns a connected socket (for example, a tunnel opened with HTTP CONNECT); the driver then performs the KMS TLS handshake over that socket using the provider's configured TLS options. This unblocks CSFLE and Queryable Encryption in environments that require an HTTP forward proxy for outbound KMS traffic, which the existing SOCKS5 proxyOptions does not cover.

constclientEncryption=newClientEncryption(keyVaultClient,{
keyVaultNamespace,
kmsProviders,// Establish the KMS connection through your HTTP proxy; the driver adds TLS.kmsConnectCallback: ({ host, port })=>connectThroughHttpProxy(host,port)});

Improved Intelligent Workload Management

Improved performance for MongoDB 9.0's Intelligent Workload Management (IWM) by only retrying overload errors when doing so is expected to not worsen server conditions

Bundling the driver into ESM no longer throws ReferenceError: require is not defined

v7.2.0 introduced the experimental runtimeAdapters option and, as part of it, replaced the driver’s static import of Node’s os module with a runtime require('os'). That works in a CommonJS build, but when the driver is bundled into ESM output (e.g. a Vite/esbuild/rollup server build with "type": "module"), there is no require in module scope, so constructing a client threw ReferenceError: require is not defined. The driver now loads the default os adapter through a dynamic import() that survives bundling, so new MongoClient() works in ESM bundles. CommonJS usage is unchanged, and supplying your own runtimeAdapters.os continues to work.

Bulk writes serialize each document only once

insertMany and bulkWrite previously processed each document twice - once to measure its size for batch splitting (a full recursive walk via calculateObjectSize) and again to serialize it into the command sent to the server. Documents are now serialized a single time and the resulting bytes are reused for both, decreasing the BSON-encoding CPU spent on bulk writes and reducing event-loop blocking during large batches. The improvement is most noticeable with high document counts and documents that have many fields.

Features

  • NODE-7546: add HTTP Proxy support for QE & CSFLE (#5007) (3366c21)
  • NODE-7547: bump minimum support server/wire versions to '4.4' & '9' respectively (#4994) (3d97028)
  • NODE-7624: support baseBackoffMS and update client backpressure backoff (#5020) (560837b)

Bug Fixes

  • NODE-7603: emit dynamic import('os') via tsconfig (#4992) (52f5e61)

Performance Improvements

... (truncated)

Changelog

Sourced from mongodb's changelog.

7.6.0 (2026-08-21)

Features

  • NODE-7546: add HTTP Proxy support for QE & CSFLE (#5007) (3366c21)
  • NODE-7547: bump minimum support server/wire versions to '4.4' & '9' respectively (#4994) (3d97028)
  • NODE-7624: support baseBackoffMS and update client backpressure backoff (#5020) (560837b)

Bug Fixes

  • NODE-7603: emit dynamic import('os') via tsconfig (#4992) (52f5e61)

Performance Improvements

  • NODE-7660: serialize bulk write documents a single time (#4999) (1217aa1)
Commits
  • 0fb2c13 chore(main): release 7.6.0 (#5001)
  • bb35ded docs: Add preliminary checks to release instructions (#5028)
  • 560837b feat(NODE-7624): support baseBackoffMS and update client backpressure backoff...
  • ce33c59 chore(NODE-7767): bson compat tests snappy fix (#5025)
  • 0f2ed29 chore(NODE-7770): add server 9.0 to the test matrix (#5024)
  • bc92c29 chore(NODE-7767): snappy 7.4 is incompatible in CI (#5021)
  • dce7939 chore(NODE-7759): pin bson-compat server (#5018)
  • 7f8edf3 chore: run bson compat tests against latest server (#5017)
  • 30c31e5 ci(deps): bump drivers-evergreen-tools from 3741fa9 to e86753e (#5016)
  • 3366c21 feat(NODE-7546): add HTTP Proxy support for QE & CSFLE (#5007)
  • Additional commits viewable in compare view

Updates @better-auth/core from 1.7.1 to 1.7.2

Release notes

Sourced from @​better-auth/core's releases.

v1.7.2

better-auth

Bug Fixes

  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

... (truncated)

Changelog

Sourced from @​better-auth/core's changelog.

1.7.2

Patch Changes

  • #10938557e19b Thanks @​bytaesu! - Added synchronous auth endpoint context access with getCurrentAuthEndpointContext and optional access with tryGetCurrentAuthEndpointContext. The existing getCurrentAuthContext and getCurrentAuthContextAsyncLocalStorage functions remain available as deprecated compatibility APIs.

  • #1085564da15b Thanks @​bytaesu! - Prevent async context loss in Cloudflare Workers bundles that enable multiple runtime conditions.

  • #10982b4ad5a1 Thanks @​bytaesu! - Built-in placeholder emails now consistently use the namespaced {identifier}@{namespace}.placeholder.invalid format.

  • #10979fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.

  • #10939e1d4011 Thanks @​bytaesu! - Logs emitted while handling auth requests now respect the configured custom logger, log level, and disabled setting.

Commits

Updates @better-auth/oauth-provider from 1.7.1 to 1.7.2

Release notes

Sourced from @​better-auth/oauth-provider's releases.

v1.7.2

better-auth

Bug Fixes

  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

... (truncated)

Changelog

Sourced from @​better-auth/oauth-provider's changelog.

1.7.2

Patch Changes

  • #11010bb8d7c4 Thanks @​bytaesu! - Client ID Metadata Document clients that declare a grant the server does not offer (such as Claude's enterprise jwt-bearer grant) can now register. Only documents sharing no grant with the server are refused.

  • #10979fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.

Commits

Updates @better-auth/scim from 1.7.1 to 1.7.2

Release notes

Sourced from @​better-auth/scim's releases.

v1.7.2

better-auth

Bug Fixes

  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

... (truncated)

Changelog

Sourced from @​better-auth/scim's changelog.

1.7.2

Commits

Updates @better-auth/sso from 1.7.1 to 1.7.2

Release notes

Sourced from @​better-auth/sso's releases.

v1.7.2

better-auth

Bug Fixes

  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

... (truncated)

Changelog

Sourced from @​better-auth/sso's changelog.

1.7.2

Patch Changes

  • #10979fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.
Commits

Updates @noble/hashes from 2.3.0 to 2.4.0

Release notes

Sourced from @​noble/hashes's releases.

2.4.0

Security and correctness

  • Protect passed options against mutation / pollution
  • keccakprg: fail until entropy is added
  • webcrypto: reject output sizes which crashed engine
  • blake3: fix tree merging for multi-terabyte streams
  • Improve zeroization

Misc

  • Speed-up Argon2 by 20%
  • Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
  • Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
  • nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.

Full Changelog: paulmillr/noble-hashes@2.3.0...2.4.0

Changelog

Sourced from @​noble/hashes's changelog.

2.4.0 (2026-08-27)

Security and correctness

  • Protect passed options against mutation / pollution
  • keccakprg: fail until entropy is added
  • webcrypto: reject output sizes which crashed engine
  • blake3: fix tree merging for multi-terabyte streams
  • Improve zeroization

Misc

  • Speed-up Argon2 by 20%
  • Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
  • Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
  • nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.
Commits

Updates better-auth from 1.7.1 to 1.7.2

Release notes

Sourced from better-auth's releases.

v1.7.2

better-auth

Bug Fixes

  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.2

Patch Changes

  • #10875d5d889b Thanks @​bytaesu! - Fix programmatic migrations failing on Cloudflare D1 while preserving existing-index validation across supported databases.

  • #10982b4ad5a1 Thanks @​bytaesu! - Built-in placeholder emails now consistently use the namespaced {identifier}@{namespace}.placeholder.invalid format.

  • #10934c7a5c1a Thanks @​bytaesu! - Cookie-cache reads now warn when signed session data is invalid instead of silently appearing as a signed-out session.

  • #1087978f0c39 Thanks @​starslingdev! - Test suites using getTestInstance now run faster because the shared fixture avoids production password-hashing costs by default. Custom emailAndPassword.password implementations continue to take precedence.

  • #10823ce8a3ab Thanks @​sosyz! - Ensure permanently banning a user clears any expiration from a previous temporary ban.

  • #10907a021eaf Thanks @​heliohm! - A client created with more plugins is again assignable to a client type declaring fewer plugins, as in 1.6.

  • #10959c8dcfa5 Thanks @​bytaesu! - Allow same-origin form submissions from pages using Referrer-Policy: no-referrer while continuing to reject untrusted request origins.

  • #10979fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.

  • #10041f6891a2 Thanks @​GautamBytes! - Allow ~...

    Description has been truncated

@dependabot
chore(deps)(deps): Bump the production-dependencies group with 21 upd…
8daf8c1
…ates
Bumps the production-dependencies group with 21 updates:
| Package | From | To |
| --- | --- | --- |
| [@oclif/core](https://github.com/oclif/core) | `4.13.3` | `4.14.0` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `5.2.3` | `5.4.1` |
| [sql.js](https://github.com/sql-js/sql.js) | `1.14.1` | `1.14.2` |
| [mongodb](https://github.com/mongodb/node-mongodb-native) | `7.5.0` | `7.6.0` |
| [@better-auth/core](https://github.com/better-auth/better-auth/tree/HEAD/packages/core) | `1.7.1` | `1.7.2` |
| [@better-auth/oauth-provider](https://github.com/better-auth/better-auth/tree/HEAD/packages/oauth-provider) | `1.7.1` | `1.7.2` |
| [@better-auth/scim](https://github.com/better-auth/better-auth/tree/HEAD/packages/scim) | `1.7.1` | `1.7.2` |
| [@better-auth/sso](https://github.com/better-auth/better-auth/tree/HEAD/packages/sso) | `1.7.1` | `1.7.2` |
| [@noble/hashes](https://github.com/paulmillr/noble-hashes) | `2.3.0` | `2.4.0` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.1` | `1.7.2` |
| [jose](https://github.com/panva/jose) | `6.2.8` | `6.2.10` |
| [hono](https://github.com/honojs/hono) | `4.13.2` | `4.13.5` |
| [nodemailer](https://github.com/nodemailer/nodemailer) | `9.0.5` | `9.0.6` |
| [pinyin-pro](https://github.com/zh-lx/pinyin-pro/tree/HEAD/packages/pinyin-pro) | `3.29.1` | `3.29.3` |
| [@noble/ciphers](https://github.com/paulmillr/noble-ciphers) | `2.3.0` | `2.4.0` |
| [fumadocs-core](https://github.com/fuma-nama/fumadocs) | `16.14.4` | `16.15.4` |
| [fumadocs-mdx](https://github.com/fuma-nama/fumadocs) | `15.2.3` | `15.4.0` |
| [fumadocs-ui](https://github.com/fuma-nama/fumadocs) | `16.14.4` | `16.15.4` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.31.0` | `1.34.0` |
| [mermaid](https://github.com/mermaid-js/mermaid) | `11.16.1` | `11.17.2` |
| [next](https://github.com/vercel/next.js) | `16.3.1` | `16.3.3` |
Updates `@oclif/core` from 4.13.3 to 4.14.0
- [Release notes](https://github.com/oclif/core/releases)
- [Changelog](https://github.com/oclif/core/blob/main/CHANGELOG.md)
- [Commits](oclif/core@4.13.3...4.14.0)
Updates `js-yaml` from 5.2.3 to 5.4.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@5.2.3...5.4.1)
Updates `sql.js` from 1.14.1 to 1.14.2
- [Release notes](https://github.com/sql-js/sql.js/releases)
- [Commits](sql-js/sql.js@v1.14.1...v1.14.2)
Updates `mongodb` from 7.5.0 to 7.6.0
- [Release notes](https://github.com/mongodb/node-mongodb-native/releases)
- [Changelog](https://github.com/mongodb/node-mongodb-native/blob/main/HISTORY.md)
- [Commits](mongodb/node-mongodb-native@v7.5.0...v7.6.0)
Updates `@better-auth/core` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/core/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/core)
Updates `@better-auth/oauth-provider` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/oauth-provider/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/oauth-provider)
Updates `@better-auth/scim` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/scim/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/scim)
Updates `@better-auth/sso` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/sso/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/sso)
Updates `@noble/hashes` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/paulmillr/noble-hashes/releases)
- [Changelog](https://github.com/paulmillr/noble-hashes/blob/main/CHANGELOG.md)
- [Commits](paulmillr/noble-hashes@2.3.0...2.4.0)
Updates `better-auth` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/better-auth)
Updates `jose` from 6.2.8 to 6.2.10
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.8...v6.2.10)
Updates `hono` from 4.13.2 to 4.13.5
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.2...v4.13.5)
Updates `nodemailer` from 9.0.5 to 9.0.6
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v9.0.5...v9.0.6)
Updates `pinyin-pro` from 3.29.1 to 3.29.3
- [Release notes](https://github.com/zh-lx/pinyin-pro/releases)
- [Changelog](https://github.com/zh-lx/pinyin-pro/blob/main/CHANGELOG.md)
- [Commits](https://github.com/zh-lx/pinyin-pro/commits/3.29.3/packages/pinyin-pro)
Updates `@noble/ciphers` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/paulmillr/noble-ciphers/releases)
- [Changelog](https://github.com/paulmillr/noble-ciphers/blob/main/CHANGELOG.md)
- [Commits](paulmillr/noble-ciphers@2.3.0...2.4.0)
Updates `fumadocs-core` from 16.14.4 to 16.15.4
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs@16.14.4...fumadocs@16.15.4)
Updates `fumadocs-mdx` from 15.2.3 to 15.4.0
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs-mdx@15.2.3...fumadocs-mdx@15.4.0)
Updates `fumadocs-ui` from 16.14.4 to 16.15.4
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs@16.14.4...fumadocs@16.15.4)
Updates `lucide-react` from 1.31.0 to 1.34.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.34.0/packages/lucide-react)
Updates `mermaid` from 11.16.1 to 11.17.2
- [Release notes](https://github.com/mermaid-js/mermaid/releases)
- [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.16.1...mermaid@11.17.2)
Updates `next` from 16.3.1 to 16.3.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.3.1...v16.3.3)
---
updated-dependencies:
- dependency-name: "@oclif/core"
dependency-version: 4.14.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: js-yaml
dependency-version: 5.4.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: sql.js
dependency-version: 1.14.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: mongodb
dependency-version: 7.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: "@better-auth/core"
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@better-auth/oauth-provider"
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@better-auth/scim"
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@better-auth/sso"
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@noble/hashes"
dependency-version: 2.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: better-auth
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: jose
dependency-version: 6.2.10
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: hono
dependency-version: 4.13.5
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: nodemailer
dependency-version: 9.0.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: pinyin-pro
dependency-version: 3.29.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@noble/ciphers"
dependency-version: 2.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: fumadocs-core
dependency-version: 16.15.4
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: fumadocs-mdx
dependency-version: 15.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: fumadocs-ui
dependency-version: 16.15.4
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: lucide-react
dependency-version: 1.34.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: mermaid
dependency-version: 11.17.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: next
dependency-version: 16.3.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 31, 2026
@github-actions

github-actionsBot commented Aug 31, 2026

Copy link
Copy Markdown
Contributor

📓 Docs Drift Check

⚠️9 changed file(s) yielded no anchor (packages/cli/package.json, packages/drivers/driver-mongodb/package.json, packages/drivers/driver-sqlite-wasm/package.json, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 9 changed package(s)).

What this run could not see
  • 9 changed file(s) yielded no anchor (packages/cli/package.json, packages/drivers/driver-mongodb/package.json, packages/drivers/driver-sqlite-wasm/package.json, …) — pages documenting those are invisible to this run
  • a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 46 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 9c120f0308d5aed3c26f53c406054a95a631d156 → packageMentionDocs.

@github-actionsgithub-actionsBot added the documentation Improvements or additions to documentation label Aug 31, 2026
@huangyiirenehuangyiirene mentioned this pull request Aug 31, 2026
Closed
@os-samos-sam closed this Aug 31, 2026
@dependabot@github

dependabotBot commented on behalf of githubAug 31, 2026

Copy link
Copy Markdown
ContributorAuthor

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabotBot deleted the dependabot/npm_and_yarn/production-dependencies-6f36c788ab branch August 31, 2026 14:47
@os-samos-sam mentioned this pull request Aug 31, 2026
Closed
@claudeclaudeBot mentioned this pull request Aug 31, 2026
Merged
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependenciesPull requests that update a dependency filedocumentationImprovements or additions to documentationjavascriptPull requests that update javascript codesize/s

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@os-sam
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
chore(deps)(deps): Bump the production-dependencies group with 21 updates - #13589
Closed
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/npm_and_yarn/production-dependencies-6f36c788ab
Closed
chore(deps)(deps): Bump the production-dependencies group with 21 updates#13589
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/npm_and_yarn/production-dependencies-6f36c788ab
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubAug 31, 2026

Copy link


Copy Markdown

Contributor
Bumps the production-dependencies group with 21 updates:
PackageFromTo
@oclif/core4.13.34.14.0
js-yaml5.2.35.4.1
sql.js1.14.11.14.2
mongodb7.5.07.6.0
@better-auth/core1.7.11.7.2
@better-auth/oauth-provider1.7.11.7.2
@better-auth/scim1.7.11.7.2
@better-auth/sso1.7.11.7.2
@noble/hashes2.3.02.4.0
better-auth1.7.11.7.2
jose6.2.86.2.10
hono4.13.24.13.5
nodemailer9.0.59.0.6
pinyin-pro3.29.13.29.3
@noble/ciphers2.3.02.4.0
fumadocs-core16.14.416.15.4
fumadocs-mdx15.2.315.4.0
fumadocs-ui16.14.416.15.4
lucide-react1.31.01.34.0
mermaid11.16.111.17.2
next16.3.116.3.3
Updates @oclif/core from 4.13.3 to 4.14.0
Release notes
Sourced from @​oclif/core's releases.
4.14.0
Features
  • bumping to eslint v10 (W-23473845) (248de04)
4.13.5
Bug Fixes
  • replaced require with dynamic import (W-23807278) (d35e325)
4.13.4
Bug Fixes
  • resolved security vulnerability in powershell path (W-23807278) (911e9d2)
Changelog
Sourced from @​oclif/core's changelog.
4.14.0 (2026-08-19)
Features
  • bumping to eslint v10 (W-23473845) (248de04)
4.13.5 (2026-08-14)
Bug Fixes
  • replaced require with dynamic import (W-23807278) (d35e325)
4.13.4 (2026-08-14)
Bug Fixes
  • resolved security vulnerability in powershell path (W-23807278) (911e9d2)
Commits
  • 1d2903e chore(release): 4.14.0 [skip ci]
  • 45c7f0a Merge pull request #1635 from oclif/d/W-23473845
  • 395c8bc chore: prune stale eslint suppressions after merge
  • 35ddd2e chore: merge main into d/W-23473845
  • 0d01467 chore(release): 4.13.5 [skip ci]
  • 06949eb Merge pull request #1638 from oclif/d/W-23807278-2
  • d35e325 fix: replaced require with dynamic import (W-23807278)
  • 85370b7 chore(release): 4.13.4 [skip ci]
  • 3318c6e Merge pull request #1636 from oclif/d/W-23807278
  • 911e9d2 fix: resolved security vulnerability in powershell path (W-23807278)
  • Additional commits viewable in compare view

Updates js-yaml from 5.2.3 to 5.4.1
Changelog
Sourced from js-yaml's changelog.
[5.4.1] - 2026-08-26
Changed
  • Hard-limit merge sequence size to 100.
Security
  • Count empty mappings in merge sequences toward maxTotalMergeKeys to limit
CPU usage, #797.
[5.4.0] - 2026-08-25
Added
  • Added the scalarStyleRules dumper option to customize string formatting.
See Scalar styling for details.
Changed
  • [breaking] Flattened the low-level AST node style representation. Scalar
and collection nodes now use SCALAR_STYLE and COLLECTION_STYLE values;
explicit tags use the separate tagged property. Alias nodes now contain
only kind and anchor. This only affects code that directly constructs or
edits AST nodes.
  • [breaking] The sortKeys option was rewritten using AST mutation to avoid
side effects.
  • Reworked scalar style selection. This can change formatting without changing
loaded values; in particular, whitespace-only strings are now double-quoted.
Fixed
  • Accept a byte order mark at the start of each document in a stream, #791.
  • Produce valid flow mappings with quoteFlowKeys and flowSkipColonSpace,
including alias and property-only keys, #786.
  • Preserve empty scalar items when converting block sequences to flow style.
  • Do not apply the 1024-character simple-key limit to flow mapping keys.
  • Count Unicode code points, rather than UTF-16 code units, for the
1024-character simple-key limit.
  • Add an explicit document-end marker after keep-chomped block scalars when
needed to preserve trailing newlines.
[5.3.0] - 2026-08-14
This release focuses on reworking the documentation and making small
architectural improvements before moving forward.
Added
  • Added completely new documentation.
  • Exported DUMP_SCHEMA, the default schema used by the dumper.
  • Added YAMLException.throwAt() for throwing an error at a source position.
Changed
... (truncated)
Commits

Updates sql.js from 1.14.1 to 1.14.2
Commits
  • 9c4e167 ci: debug npm publish http log
  • 1d5db45 ci: use npm 11 for OIDC trusted publishing
  • c2c6909 debug: oidc env dump
  • 17159df debug: oidc
  • 7e943bd ci: publish to npm via OIDC trusted publishing
  • c11695f Bump version to 1.14.2
  • 5489808 fix: restore WASM stack in Database.exec to prevent stack leak (#631)
  • See full diff in compare view
Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for sql.js since your current version.

Updates mongodb from 7.5.0 to 7.6.0
Release notes
Sourced from mongodb's releases.
v7.6.0
7.6.0 (2026-08-21)
The MongoDB Node.js team is pleased to announce version 7.6.0 of the mongodb package!
Release Notes
Support for MongoDB 4.2 is removed
[!WARNING]
When the driver connects to a MongoDB server of version 4.2 or less, it will now throw an error.
HTTP proxy support for KMS requests in CSFLE and Queryable Encryption
In-use encryption can now route KMS requests through an HTTP proxy. Set kmsConnectCallback on your ClientEncryption or auto-encryption options to control how the driver connects to a KMS host. The callback receives the target host and port and returns a connected socket (for example, a tunnel
opened with HTTP CONNECT); the driver then performs the KMS TLS handshake over that socket using the provider's configured TLS options. This unblocks CSFLE and Queryable Encryption in environments that require an HTTP forward proxy for outbound KMS traffic, which the existing SOCKS5 proxyOptions does not cover.
constclientEncryption=newClientEncryption(keyVaultClient,{
keyVaultNamespace,
kmsProviders,// Establish the KMS connection through your HTTP proxy; the driver adds TLS.kmsConnectCallback: ({ host, port })=>connectThroughHttpProxy(host,port)});
Improved Intelligent Workload Management
Improved performance for MongoDB 9.0's Intelligent Workload Management (IWM) by only retrying overload errors when doing so is expected to not worsen server conditions
Bundling the driver into ESM no longer throws ReferenceError: require is not defined
v7.2.0 introduced the experimental runtimeAdapters option and, as part of it, replaced the driver’s static import of Node’s os module with a runtime require('os'). That works in a CommonJS build, but when the driver is bundled into ESM output (e.g. a Vite/esbuild/rollup server build with "type": "module"), there is no require in module scope, so constructing a client threw ReferenceError: require is not defined. The driver now loads the default os adapter through a dynamic import() that survives bundling, so new MongoClient() works in ESM bundles. CommonJS usage is unchanged, and supplying your own runtimeAdapters.os continues to work.
Bulk writes serialize each document only once
insertMany and bulkWrite previously processed each document twice - once to measure its size for batch splitting (a full recursive walk via calculateObjectSize) and again to serialize it into the command sent to the server. Documents are now serialized a single time and the resulting bytes are reused for both, decreasing the BSON-encoding CPU spent on bulk writes and reducing event-loop blocking during large batches. The improvement is most noticeable with high document counts and documents that have many fields.
Features
  • NODE-7546: add HTTP Proxy support for QE & CSFLE (#5007) (3366c21)
  • NODE-7547: bump minimum support server/wire versions to '4.4' & '9' respectively (#4994) (3d97028)
  • NODE-7624: support baseBackoffMS and update client backpressure backoff (#5020) (560837b)
Bug Fixes
  • NODE-7603: emit dynamic import('os') via tsconfig (#4992) (52f5e61)
Performance Improvements
... (truncated)
Changelog
Sourced from mongodb's changelog.
7.6.0 (2026-08-21)
Features
  • NODE-7546: add HTTP Proxy support for QE & CSFLE (#5007) (3366c21)
  • NODE-7547: bump minimum support server/wire versions to '4.4' & '9' respectively (#4994) (3d97028)
  • NODE-7624: support baseBackoffMS and update client backpressure backoff (#5020) (560837b)
Bug Fixes
  • NODE-7603: emit dynamic import('os') via tsconfig (#4992) (52f5e61)
Performance Improvements
  • NODE-7660: serialize bulk write documents a single time (#4999) (1217aa1)
Commits
  • 0fb2c13 chore(main): release 7.6.0 (#5001)
  • bb35ded docs: Add preliminary checks to release instructions (#5028)
  • 560837b feat(NODE-7624): support baseBackoffMS and update client backpressure backoff...
  • ce33c59 chore(NODE-7767): bson compat tests snappy fix (#5025)
  • 0f2ed29 chore(NODE-7770): add server 9.0 to the test matrix (#5024)
  • bc92c29 chore(NODE-7767): snappy 7.4 is incompatible in CI (#5021)
  • dce7939 chore(NODE-7759): pin bson-compat server (#5018)
  • 7f8edf3 chore: run bson compat tests against latest server (#5017)
  • 30c31e5 ci(deps): bump drivers-evergreen-tools from 3741fa9 to e86753e (#5016)
  • 3366c21 feat(NODE-7546): add HTTP Proxy support for QE & CSFLE (#5007)
  • Additional commits viewable in compare view

Updates @better-auth/core from 1.7.1 to 1.7.2
Release notes
Sourced from @​better-auth/core's releases.
v1.7.2
better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
For detailed changes, see CHANGELOG
@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)
For detailed changes, see CHANGELOG
@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)
For detailed changes, see CHANGELOG
@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
... (truncated)
Changelog
Sourced from @​better-auth/core's changelog.
1.7.2
Patch Changes
  • #10938557e19b Thanks @​bytaesu! - Added synchronous auth endpoint context access with getCurrentAuthEndpointContext and optional access with tryGetCurrentAuthEndpointContext. The existing getCurrentAuthContext and getCurrentAuthContextAsyncLocalStorage functions remain available as deprecated compatibility APIs.
  • #1085564da15b Thanks @​bytaesu! - Prevent async context loss in Cloudflare Workers bundles that enable multiple runtime conditions.
  • #10982b4ad5a1 Thanks @​bytaesu! - Built-in placeholder emails now consistently use the namespaced {identifier}@{namespace}.placeholder.invalid format.
  • #10979fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.
  • #10939e1d4011 Thanks @​bytaesu! - Logs emitted while handling auth requests now respect the configured custom logger, log level, and disabled setting.
Commits

Updates @better-auth/oauth-provider from 1.7.1 to 1.7.2
Release notes
Sourced from @​better-auth/oauth-provider's releases.
v1.7.2
better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
For detailed changes, see CHANGELOG
@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)
For detailed changes, see CHANGELOG
@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)
For detailed changes, see CHANGELOG
@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
... (truncated)
Changelog
Sourced from @​better-auth/oauth-provider's changelog.
1.7.2
Patch Changes
  • #11010bb8d7c4 Thanks @​bytaesu! - Client ID Metadata Document clients that declare a grant the server does not offer (such as Claude's enterprise jwt-bearer grant) can now register. Only documents sharing no grant with the server are refused.
  • #10979fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.
Commits

Updates @better-auth/scim from 1.7.1 to 1.7.2
Release notes
Sourced from @​better-auth/scim's releases.
v1.7.2
better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
For detailed changes, see CHANGELOG
@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)
For detailed changes, see CHANGELOG
@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)
For detailed changes, see CHANGELOG
@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
... (truncated)
Changelog
Sourced from @​better-auth/scim's changelog.
1.7.2
Commits

Updates @better-auth/sso from 1.7.1 to 1.7.2
Release notes
Sourced from @​better-auth/sso's releases.
v1.7.2
better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
For detailed changes, see CHANGELOG
@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)
For detailed changes, see CHANGELOG
@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)
For detailed changes, see CHANGELOG
@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
... (truncated)
Changelog
Sourced from @​better-auth/sso's changelog.
1.7.2
Patch Changes
  • #10979fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.
Commits

Updates @noble/hashes from 2.3.0 to 2.4.0
Release notes
Sourced from @​noble/hashes's releases.
2.4.0
Security and correctness
  • Protect passed options against mutation / pollution
  • keccakprg: fail until entropy is added
  • webcrypto: reject output sizes which crashed engine
  • blake3: fix tree merging for multi-terabyte streams
  • Improve zeroization
Misc
  • Speed-up Argon2 by 20%
  • Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
  • Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
  • nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.
Full Changelog: paulmillr/noble-hashes@2.3.0...2.4.0
Changelog
Sourced from @​noble/hashes's changelog.
2.4.0 (2026-08-27)
Security and correctness
  • Protect passed options against mutation / pollution
  • keccakprg: fail until entropy is added
  • webcrypto: reject output sizes which crashed engine
  • blake3: fix tree merging for multi-terabyte streams
  • Improve zeroization
Misc
  • Speed-up Argon2 by 20%
  • Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
  • Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
  • nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.
Commits

Updates better-auth from 1.7.1 to 1.7.2
Release notes
Sourced from better-auth's releases.
v1.7.2
better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
For detailed changes, see CHANGELOG
@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)
For detailed changes, see CHANGELOG
@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)
For detailed changes, see CHANGELOG
@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
... (truncated)
Changelog
Sourced from better-auth's changelog.
1.7.2
Patch Changes
  • #10875d5d889b Thanks @​bytaesu! - Fix programmatic migrations failing on Cloudflare D1 while preserving existing-index validation across supported databases.
  • #10982b4ad5a1 Thanks @​bytaesu! - Built-in placeholder emails now consistently use the namespaced {identifier}@{namespace}.placeholder.invalid format.
  • #10934c7a5c1a Thanks @​bytaesu! - Cookie-cache reads now warn when signed session data is invalid instead of silently appearing as a signed-out session.
  • #1087978f0c39 Thanks @​starslingdev! - Test suites using getTestInstance now run faster because the shared fixture avoids production password-hashing costs by default. Custom emailAndPassword.password implementations continue to take precedence.
  • #10823ce8a3ab Thanks @​sosyz! - Ensure permanently banning a user clears any expiration from a previous temporary ban.
  • #10907a021eaf Thanks @​heliohm! - A client created with more plugins is again assignable to a client type declaring fewer plugins, as in 1.6.
  • #10959c8dcfa5 Thanks @​bytaesu! - Allow same-origin form submissions from pages using Referrer-Policy: no-referrer while continuing to reject untrusted request origins.
  • #10979fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.
  • #10041f6891a2 Thanks @​GautamBytes! - Allow ~...

    Description has been truncated
@dependabot
chore(deps)(deps): Bump the production-dependencies group with 21 upd…
8daf8c1
…ates
Bumps the production-dependencies group with 21 updates:
| Package | From | To |
| --- | --- | --- |
| [@oclif/core](https://github.com/oclif/core) | `4.13.3` | `4.14.0` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `5.2.3` | `5.4.1` |
| [sql.js](https://github.com/sql-js/sql.js) | `1.14.1` | `1.14.2` |
| [mongodb](https://github.com/mongodb/node-mongodb-native) | `7.5.0` | `7.6.0` |
| [@better-auth/core](https://github.com/better-auth/better-auth/tree/HEAD/packages/core) | `1.7.1` | `1.7.2` |
| [@better-auth/oauth-provider](https://github.com/better-auth/better-auth/tree/HEAD/packages/oauth-provider) | `1.7.1` | `1.7.2` |
| [@better-auth/scim](https://github.com/better-auth/better-auth/tree/HEAD/packages/scim) | `1.7.1` | `1.7.2` |
| [@better-auth/sso](https://github.com/better-auth/better-auth/tree/HEAD/packages/sso) | `1.7.1` | `1.7.2` |
| [@noble/hashes](https://github.com/paulmillr/noble-hashes) | `2.3.0` | `2.4.0` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.1` | `1.7.2` |
| [jose](https://github.com/panva/jose) | `6.2.8` | `6.2.10` |
| [hono](https://github.com/honojs/hono) | `4.13.2` | `4.13.5` |
| [nodemailer](https://github.com/nodemailer/nodemailer) | `9.0.5` | `9.0.6` |
| [pinyin-pro](https://github.com/zh-lx/pinyin-pro/tree/HEAD/packages/pinyin-pro) | `3.29.1` | `3.29.3` |
| [@noble/ciphers](https://github.com/paulmillr/noble-ciphers) | `2.3.0` | `2.4.0` |
| [fumadocs-core](https://github.com/fuma-nama/fumadocs) | `16.14.4` | `16.15.4` |
| [fumadocs-mdx](https://github.com/fuma-nama/fumadocs) | `15.2.3` | `15.4.0` |
| [fumadocs-ui](https://github.com/fuma-nama/fumadocs) | `16.14.4` | `16.15.4` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.31.0` | `1.34.0` |
| [mermaid](https://github.com/mermaid-js/mermaid) | `11.16.1` | `11.17.2` |
| [next](https://github.com/vercel/next.js) | `16.3.1` | `16.3.3` |
Updates `@oclif/core` from 4.13.3 to 4.14.0
- [Release notes](https://github.com/oclif/core/releases)
- [Changelog](https://github.com/oclif/core/blob/main/CHANGELOG.md)
- [Commits](oclif/core@4.13.3...4.14.0)
Updates `js-yaml` from 5.2.3 to 5.4.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@5.2.3...5.4.1)
Updates `sql.js` from 1.14.1 to 1.14.2
- [Release notes](https://github.com/sql-js/sql.js/releases)
- [Commits](sql-js/sql.js@v1.14.1...v1.14.2)
Updates `mongodb` from 7.5.0 to 7.6.0
- [Release notes](https://github.com/mongodb/node-mongodb-native/releases)
- [Changelog](https://github.com/mongodb/node-mongodb-native/blob/main/HISTORY.md)
- [Commits](mongodb/node-mongodb-native@v7.5.0...v7.6.0)
Updates `@better-auth/core` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/core/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/core)
Updates `@better-auth/oauth-provider` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/oauth-provider/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/oauth-provider)
Updates `@better-auth/scim` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/scim/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/scim)
Updates `@better-auth/sso` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/sso/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/sso)
Updates `@noble/hashes` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/paulmillr/noble-hashes/releases)
- [Changelog](https://github.com/paulmillr/noble-hashes/blob/main/CHANGELOG.md)
- [Commits](paulmillr/noble-hashes@2.3.0...2.4.0)
Updates `better-auth` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/better-auth)
Updates `jose` from 6.2.8 to 6.2.10
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.8...v6.2.10)
Updates `hono` from 4.13.2 to 4.13.5
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.2...v4.13.5)
Updates `nodemailer` from 9.0.5 to 9.0.6
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v9.0.5...v9.0.6)
Updates `pinyin-pro` from 3.29.1 to 3.29.3
- [Release notes](https://github.com/zh-lx/pinyin-pro/releases)
- [Changelog](https://github.com/zh-lx/pinyin-pro/blob/main/CHANGELOG.md)
- [Commits](https://github.com/zh-lx/pinyin-pro/commits/3.29.3/packages/pinyin-pro)
Updates `@noble/ciphers` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/paulmillr/noble-ciphers/releases)
- [Changelog](https://github.com/paulmillr/noble-ciphers/blob/main/CHANGELOG.md)
- [Commits](paulmillr/noble-ciphers@2.3.0...2.4.0)
Updates `fumadocs-core` from 16.14.4 to 16.15.4
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs@16.14.4...fumadocs@16.15.4)
Updates `fumadocs-mdx` from 15.2.3 to 15.4.0
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs-mdx@15.2.3...fumadocs-mdx@15.4.0)
Updates `fumadocs-ui` from 16.14.4 to 16.15.4
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs@16.14.4...fumadocs@16.15.4)
Updates `lucide-react` from 1.31.0 to 1.34.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.34.0/packages/lucide-react)
Updates `mermaid` from 11.16.1 to 11.17.2
- [Release notes](https://github.com/mermaid-js/mermaid/releases)
- [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.16.1...mermaid@11.17.2)
Updates `next` from 16.3.1 to 16.3.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.3.1...v16.3.3)
---
updated-dependencies:
- dependency-name: "@oclif/core"
dependency-version: 4.14.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: js-yaml
dependency-version: 5.4.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: sql.js
dependency-version: 1.14.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: mongodb
dependency-version: 7.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: "@better-auth/core"
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@better-auth/oauth-provider"
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@better-auth/scim"
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@better-auth/sso"
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@noble/hashes"
dependency-version: 2.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: better-auth
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: jose
dependency-version: 6.2.10
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: hono
dependency-version: 4.13.5
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: nodemailer
dependency-version: 9.0.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: pinyin-pro
dependency-version: 3.29.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@noble/ciphers"
dependency-version: 2.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: fumadocs-core
dependency-version: 16.15.4
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: fumadocs-mdx
dependency-version: 15.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: fumadocs-ui
dependency-version: 16.15.4
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: lucide-react
dependency-version: 1.34.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: mermaid
dependency-version: 11.17.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: next
dependency-version: 16.3.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot
added

dependencies
Pull requests that update a dependency file
javascript
Pull requests that update javascript code
labels
Aug 31, 2026
@github-actions
github-actionsBot
commented
Aug 31, 2026

Copy link


Copy Markdown

Contributor
📓 Docs Drift Check
⚠️9 changed file(s) yielded no anchor (packages/cli/package.json, packages/drivers/driver-mongodb/package.json, packages/drivers/driver-sqlite-wasm/package.json, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 9 changed package(s)).
What this run could not see
  • 9 changed file(s) yielded no anchor (packages/cli/package.json, packages/drivers/driver-mongodb/package.json, packages/drivers/driver-sqlite-wasm/package.json, …) — pages documenting those are invisible to this run
  • a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
Coarse fallback — 46 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 9c120f0308d5aed3c26f53c406054a95a631d156 → packageMentionDocs.
@github-actionsgithub-actionsBot
added
the 
documentation
Improvements or additions to documentation
label
Aug 31, 2026
@huangyiirenehuangyiirene
mentioned this pull request
Aug 31, 2026

Closed

@os-samos-sam
closed this
Aug 31, 2026
@dependabot@github
dependabotBot
commented
on behalf of githubAug 31, 2026

Copy link


Copy Markdown

ContributorAuthor
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.
To ignore these dependencies, configure ignore rules in dependabot.yml
@dependabot
dependabotBot
deleted the

dependabot/npm_and_yarn/production-dependencies-6f36c788ab

branch
August 31, 2026 14:47
@os-samos-sam
mentioned this pull request
Aug 31, 2026

Closed

@claudeclaudeBot
mentioned this pull request
Aug 31, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency filedocumentationImprovements or additions to documentationjavascriptPull requests that update javascript codesize/s

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@os-sam

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(deps)(deps): Bump the production-dependencies group with 21 updates - #13589
Closed
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/npm_and_yarn/production-dependencies-6f36c788ab
Closed
chore(deps)(deps): Bump the production-dependencies group with 21 updates#13589
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/npm_and_yarn/production-dependencies-6f36c788ab
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubAug 31, 2026

Copy link


Copy Markdown

Contributor
Bumps the production-dependencies group with 21 updates:
PackageFromTo
@oclif/core4.13.34.14.0
js-yaml5.2.35.4.1
sql.js1.14.11.14.2
mongodb7.5.07.6.0
@better-auth/core1.7.11.7.2
@better-auth/oauth-provider1.7.11.7.2
@better-auth/scim1.7.11.7.2
@better-auth/sso1.7.11.7.2
@noble/hashes2.3.02.4.0
better-auth1.7.11.7.2
jose6.2.86.2.10
hono4.13.24.13.5
nodemailer9.0.59.0.6
pinyin-pro3.29.13.29.3
@noble/ciphers2.3.02.4.0
fumadocs-core16.14.416.15.4
fumadocs-mdx15.2.315.4.0
fumadocs-ui16.14.416.15.4
lucide-react1.31.01.34.0
mermaid11.16.111.17.2
next16.3.116.3.3
Updates @oclif/core from 4.13.3 to 4.14.0
Release notes
Sourced from @​oclif/core's releases.
4.14.0
Features
  • bumping to eslint v10 (W-23473845) (248de04)
4.13.5
Bug Fixes
  • replaced require with dynamic import (W-23807278) (d35e325)
4.13.4
Bug Fixes
  • resolved security vulnerability in powershell path (W-23807278) (911e9d2)
Changelog
Sourced from @​oclif/core's changelog.
4.14.0 (2026-08-19)
Features
  • bumping to eslint v10 (W-23473845) (248de04)
4.13.5 (2026-08-14)
Bug Fixes
  • replaced require with dynamic import (W-23807278) (d35e325)
4.13.4 (2026-08-14)
Bug Fixes
  • resolved security vulnerability in powershell path (W-23807278) (911e9d2)
Commits
  • 1d2903e chore(release): 4.14.0 [skip ci]
  • 45c7f0a Merge pull request #1635 from oclif/d/W-23473845
  • 395c8bc chore: prune stale eslint suppressions after merge
  • 35ddd2e chore: merge main into d/W-23473845
  • 0d01467 chore(release): 4.13.5 [skip ci]
  • 06949eb Merge pull request #1638 from oclif/d/W-23807278-2
  • d35e325 fix: replaced require with dynamic import (W-23807278)
  • 85370b7 chore(release): 4.13.4 [skip ci]
  • 3318c6e Merge pull request #1636 from oclif/d/W-23807278
  • 911e9d2 fix: resolved security vulnerability in powershell path (W-23807278)
  • Additional commits viewable in compare view

Updates js-yaml from 5.2.3 to 5.4.1
Changelog
Sourced from js-yaml's changelog.
[5.4.1] - 2026-08-26
Changed
  • Hard-limit merge sequence size to 100.
Security
  • Count empty mappings in merge sequences toward maxTotalMergeKeys to limit
CPU usage, #797.
[5.4.0] - 2026-08-25
Added
  • Added the scalarStyleRules dumper option to customize string formatting.
See Scalar styling for details.
Changed
  • [breaking] Flattened the low-level AST node style representation. Scalar
and collection nodes now use SCALAR_STYLE and COLLECTION_STYLE values;
explicit tags use the separate tagged property. Alias nodes now contain
only kind and anchor. This only affects code that directly constructs or
edits AST nodes.
  • [breaking] The sortKeys option was rewritten using AST mutation to avoid
side effects.
  • Reworked scalar style selection. This can change formatting without changing
loaded values; in particular, whitespace-only strings are now double-quoted.
Fixed
  • Accept a byte order mark at the start of each document in a stream, #791.
  • Produce valid flow mappings with quoteFlowKeys and flowSkipColonSpace,
including alias and property-only keys, #786.
  • Preserve empty scalar items when converting block sequences to flow style.
  • Do not apply the 1024-character simple-key limit to flow mapping keys.
  • Count Unicode code points, rather than UTF-16 code units, for the
1024-character simple-key limit.
  • Add an explicit document-end marker after keep-chomped block scalars when
needed to preserve trailing newlines.
[5.3.0] - 2026-08-14
This release focuses on reworking the documentation and making small
architectural improvements before moving forward.
Added
  • Added completely new documentation.
  • Exported DUMP_SCHEMA, the default schema used by the dumper.
  • Added YAMLException.throwAt() for throwing an error at a source position.
Changed
... (truncated)
Commits

Updates sql.js from 1.14.1 to 1.14.2
Commits
  • 9c4e167 ci: debug npm publish http log
  • 1d5db45 ci: use npm 11 for OIDC trusted publishing
  • c2c6909 debug: oidc env dump
  • 17159df debug: oidc
  • 7e943bd ci: publish to npm via OIDC trusted publishing
  • c11695f Bump version to 1.14.2
  • 5489808 fix: restore WASM stack in Database.exec to prevent stack leak (#631)
  • See full diff in compare view
Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for sql.js since your current version.

Updates mongodb from 7.5.0 to 7.6.0
Release notes
Sourced from mongodb's releases.
v7.6.0
7.6.0 (2026-08-21)
The MongoDB Node.js team is pleased to announce version 7.6.0 of the mongodb package!
Release Notes
Support for MongoDB 4.2 is removed
[!WARNING]
When the driver connects to a MongoDB server of version 4.2 or less, it will now throw an error.
HTTP proxy support for KMS requests in CSFLE and Queryable Encryption
In-use encryption can now route KMS requests through an HTTP proxy. Set kmsConnectCallback on your ClientEncryption or auto-encryption options to control how the driver connects to a KMS host. The callback receives the target host and port and returns a connected socket (for example, a tunnel
opened with HTTP CONNECT); the driver then performs the KMS TLS handshake over that socket using the provider's configured TLS options. This unblocks CSFLE and Queryable Encryption in environments that require an HTTP forward proxy for outbound KMS traffic, which the existing SOCKS5 proxyOptions does not cover.
constclientEncryption=newClientEncryption(keyVaultClient,{
keyVaultNamespace,
kmsProviders,// Establish the KMS connection through your HTTP proxy; the driver adds TLS.kmsConnectCallback: ({ host, port })=>connectThroughHttpProxy(host,port)});
Improved Intelligent Workload Management
Improved performance for MongoDB 9.0's Intelligent Workload Management (IWM) by only retrying overload errors when doing so is expected to not worsen server conditions
Bundling the driver into ESM no longer throws ReferenceError: require is not defined
v7.2.0 introduced the experimental runtimeAdapters option and, as part of it, replaced the driver’s static import of Node’s os module with a runtime require('os'). That works in a CommonJS build, but when the driver is bundled into ESM output (e.g. a Vite/esbuild/rollup server build with "type": "module"), there is no require in module scope, so constructing a client threw ReferenceError: require is not defined. The driver now loads the default os adapter through a dynamic import() that survives bundling, so new MongoClient() works in ESM bundles. CommonJS usage is unchanged, and supplying your own runtimeAdapters.os continues to work.
Bulk writes serialize each document only once
insertMany and bulkWrite previously processed each document twice - once to measure its size for batch splitting (a full recursive walk via calculateObjectSize) and again to serialize it into the command sent to the server. Documents are now serialized a single time and the resulting bytes are reused for both, decreasing the BSON-encoding CPU spent on bulk writes and reducing event-loop blocking during large batches. The improvement is most noticeable with high document counts and documents that have many fields.
Features
  • NODE-7546: add HTTP Proxy support for QE & CSFLE (#5007) (3366c21)
  • NODE-7547: bump minimum support server/wire versions to '4.4' & '9' respectively (#4994) (3d97028)
  • NODE-7624: support baseBackoffMS and update client backpressure backoff (#5020) (560837b)
Bug Fixes
  • NODE-7603: emit dynamic import('os') via tsconfig (#4992) (52f5e61)
Performance Improvements
... (truncated)
Changelog
Sourced from mongodb's changelog.
7.6.0 (2026-08-21)
Features
  • NODE-7546: add HTTP Proxy support for QE & CSFLE (#5007) (3366c21)
  • NODE-7547: bump minimum support server/wire versions to '4.4' & '9' respectively (#4994) (3d97028)
  • NODE-7624: support baseBackoffMS and update client backpressure backoff (#5020) (560837b)
Bug Fixes
  • NODE-7603: emit dynamic import('os') via tsconfig (#4992) (52f5e61)
Performance Improvements
  • NODE-7660: serialize bulk write documents a single time (#4999) (1217aa1)
Commits
  • 0fb2c13 chore(main): release 7.6.0 (#5001)
  • bb35ded docs: Add preliminary checks to release instructions (#5028)
  • 560837b feat(NODE-7624): support baseBackoffMS and update client backpressure backoff...
  • ce33c59 chore(NODE-7767): bson compat tests snappy fix (#5025)
  • 0f2ed29 chore(NODE-7770): add server 9.0 to the test matrix (#5024)
  • bc92c29 chore(NODE-7767): snappy 7.4 is incompatible in CI (#5021)
  • dce7939 chore(NODE-7759): pin bson-compat server (#5018)
  • 7f8edf3 chore: run bson compat tests against latest server (#5017)
  • 30c31e5 ci(deps): bump drivers-evergreen-tools from 3741fa9 to e86753e (#5016)
  • 3366c21 feat(NODE-7546): add HTTP Proxy support for QE & CSFLE (#5007)
  • Additional commits viewable in compare view

Updates @better-auth/core from 1.7.1 to 1.7.2
Release notes
Sourced from @​better-auth/core's releases.
v1.7.2
better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
For detailed changes, see CHANGELOG
@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)
For detailed changes, see CHANGELOG
@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)
For detailed changes, see CHANGELOG
@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
... (truncated)
Changelog
Sourced from @​better-auth/core's changelog.
1.7.2
Patch Changes
  • #10938557e19b Thanks @​bytaesu! - Added synchronous auth endpoint context access with getCurrentAuthEndpointContext and optional access with tryGetCurrentAuthEndpointContext. The existing getCurrentAuthContext and getCurrentAuthContextAsyncLocalStorage functions remain available as deprecated compatibility APIs.
  • #1085564da15b Thanks @​bytaesu! - Prevent async context loss in Cloudflare Workers bundles that enable multiple runtime conditions.
  • #10982b4ad5a1 Thanks @​bytaesu! - Built-in placeholder emails now consistently use the namespaced {identifier}@{namespace}.placeholder.invalid format.
  • #10979fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.
  • #10939e1d4011 Thanks @​bytaesu! - Logs emitted while handling auth requests now respect the configured custom logger, log level, and disabled setting.
Commits

Updates @better-auth/oauth-provider from 1.7.1 to 1.7.2
Release notes
Sourced from @​better-auth/oauth-provider's releases.
v1.7.2
better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
For detailed changes, see CHANGELOG
@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)
For detailed changes, see CHANGELOG
@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)
For detailed changes, see CHANGELOG
@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
... (truncated)
Changelog
Sourced from @​better-auth/oauth-provider's changelog.
1.7.2
Patch Changes
  • #11010bb8d7c4 Thanks @​bytaesu! - Client ID Metadata Document clients that declare a grant the server does not offer (such as Claude's enterprise jwt-bearer grant) can now register. Only documents sharing no grant with the server are refused.
  • #10979fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.
Commits

Updates @better-auth/scim from 1.7.1 to 1.7.2
Release notes
Sourced from @​better-auth/scim's releases.
v1.7.2
better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
For detailed changes, see CHANGELOG
@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)
For detailed changes, see CHANGELOG
@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)
For detailed changes, see CHANGELOG
@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
... (truncated)
Changelog
Sourced from @​better-auth/scim's changelog.
1.7.2
Commits

Updates @better-auth/sso from 1.7.1 to 1.7.2
Release notes
Sourced from @​better-auth/sso's releases.
v1.7.2
better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
For detailed changes, see CHANGELOG
@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)
For detailed changes, see CHANGELOG
@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)
For detailed changes, see CHANGELOG
@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
... (truncated)
Changelog
Sourced from @​better-auth/sso's changelog.
1.7.2
Patch Changes
  • #10979fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.
Commits

Updates @noble/hashes from 2.3.0 to 2.4.0
Release notes
Sourced from @​noble/hashes's releases.
2.4.0
Security and correctness
  • Protect passed options against mutation / pollution
  • keccakprg: fail until entropy is added
  • webcrypto: reject output sizes which crashed engine
  • blake3: fix tree merging for multi-terabyte streams
  • Improve zeroization
Misc
  • Speed-up Argon2 by 20%
  • Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
  • Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
  • nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.
Full Changelog: paulmillr/noble-hashes@2.3.0...2.4.0
Changelog
Sourced from @​noble/hashes's changelog.
2.4.0 (2026-08-27)
Security and correctness
  • Protect passed options against mutation / pollution
  • keccakprg: fail until entropy is added
  • webcrypto: reject output sizes which crashed engine
  • blake3: fix tree merging for multi-terabyte streams
  • Improve zeroization
Misc
  • Speed-up Argon2 by 20%
  • Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
  • Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
  • nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.
Commits

Updates better-auth from 1.7.1 to 1.7.2
Release notes
Sourced from better-auth's releases.
v1.7.2
better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
For detailed changes, see CHANGELOG
@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)
For detailed changes, see CHANGELOG
@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)
For detailed changes, see CHANGELOG
@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
... (truncated)
Changelog
Sourced from better-auth's changelog.
1.7.2
Patch Changes
  • #10875d5d889b Thanks @​bytaesu! - Fix programmatic migrations failing on Cloudflare D1 while preserving existing-index validation across supported databases.
  • #10982b4ad5a1 Thanks @​bytaesu! - Built-in placeholder emails now consistently use the namespaced {identifier}@{namespace}.placeholder.invalid format.
  • #10934c7a5c1a Thanks @​bytaesu! - Cookie-cache reads now warn when signed session data is invalid instead of silently appearing as a signed-out session.
  • #1087978f0c39 Thanks @​starslingdev! - Test suites using getTestInstance now run faster because the shared fixture avoids production password-hashing costs by default. Custom emailAndPassword.password implementations continue to take precedence.
  • #10823ce8a3ab Thanks @​sosyz! - Ensure permanently banning a user clears any expiration from a previous temporary ban.
  • #10907a021eaf Thanks @​heliohm! - A client created with more plugins is again assignable to a client type declaring fewer plugins, as in 1.6.
  • #10959c8dcfa5 Thanks @​bytaesu! - Allow same-origin form submissions from pages using Referrer-Policy: no-referrer while continuing to reject untrusted request origins.
  • #10979fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.
  • #10041f6891a2 Thanks @​GautamBytes! - Allow ~...

    Description has been truncated
@dependabot
chore(deps)(deps): Bump the production-dependencies group with 21 upd…
8daf8c1
…ates
Bumps the production-dependencies group with 21 updates:
| Package | From | To |
| --- | --- | --- |
| [@oclif/core](https://github.com/oclif/core) | `4.13.3` | `4.14.0` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `5.2.3` | `5.4.1` |
| [sql.js](https://github.com/sql-js/sql.js) | `1.14.1` | `1.14.2` |
| [mongodb](https://github.com/mongodb/node-mongodb-native) | `7.5.0` | `7.6.0` |
| [@better-auth/core](https://github.com/better-auth/better-auth/tree/HEAD/packages/core) | `1.7.1` | `1.7.2` |
| [@better-auth/oauth-provider](https://github.com/better-auth/better-auth/tree/HEAD/packages/oauth-provider) | `1.7.1` | `1.7.2` |
| [@better-auth/scim](https://github.com/better-auth/better-auth/tree/HEAD/packages/scim) | `1.7.1` | `1.7.2` |
| [@better-auth/sso](https://github.com/better-auth/better-auth/tree/HEAD/packages/sso) | `1.7.1` | `1.7.2` |
| [@noble/hashes](https://github.com/paulmillr/noble-hashes) | `2.3.0` | `2.4.0` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.1` | `1.7.2` |
| [jose](https://github.com/panva/jose) | `6.2.8` | `6.2.10` |
| [hono](https://github.com/honojs/hono) | `4.13.2` | `4.13.5` |
| [nodemailer](https://github.com/nodemailer/nodemailer) | `9.0.5` | `9.0.6` |
| [pinyin-pro](https://github.com/zh-lx/pinyin-pro/tree/HEAD/packages/pinyin-pro) | `3.29.1` | `3.29.3` |
| [@noble/ciphers](https://github.com/paulmillr/noble-ciphers) | `2.3.0` | `2.4.0` |
| [fumadocs-core](https://github.com/fuma-nama/fumadocs) | `16.14.4` | `16.15.4` |
| [fumadocs-mdx](https://github.com/fuma-nama/fumadocs) | `15.2.3` | `15.4.0` |
| [fumadocs-ui](https://github.com/fuma-nama/fumadocs) | `16.14.4` | `16.15.4` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.31.0` | `1.34.0` |
| [mermaid](https://github.com/mermaid-js/mermaid) | `11.16.1` | `11.17.2` |
| [next](https://github.com/vercel/next.js) | `16.3.1` | `16.3.3` |
Updates `@oclif/core` from 4.13.3 to 4.14.0
- [Release notes](https://github.com/oclif/core/releases)
- [Changelog](https://github.com/oclif/core/blob/main/CHANGELOG.md)
- [Commits](oclif/core@4.13.3...4.14.0)
Updates `js-yaml` from 5.2.3 to 5.4.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@5.2.3...5.4.1)
Updates `sql.js` from 1.14.1 to 1.14.2
- [Release notes](https://github.com/sql-js/sql.js/releases)
- [Commits](sql-js/sql.js@v1.14.1...v1.14.2)
Updates `mongodb` from 7.5.0 to 7.6.0
- [Release notes](https://github.com/mongodb/node-mongodb-native/releases)
- [Changelog](https://github.com/mongodb/node-mongodb-native/blob/main/HISTORY.md)
- [Commits](mongodb/node-mongodb-native@v7.5.0...v7.6.0)
Updates `@better-auth/core` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/core/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/core)
Updates `@better-auth/oauth-provider` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/oauth-provider/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/oauth-provider)
Updates `@better-auth/scim` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/scim/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/scim)
Updates `@better-auth/sso` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/sso/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/sso)
Updates `@noble/hashes` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/paulmillr/noble-hashes/releases)
- [Changelog](https://github.com/paulmillr/noble-hashes/blob/main/CHANGELOG.md)
- [Commits](paulmillr/noble-hashes@2.3.0...2.4.0)
Updates `better-auth` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/better-auth)
Updates `jose` from 6.2.8 to 6.2.10
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.8...v6.2.10)
Updates `hono` from 4.13.2 to 4.13.5
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.2...v4.13.5)
Updates `nodemailer` from 9.0.5 to 9.0.6
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v9.0.5...v9.0.6)
Updates `pinyin-pro` from 3.29.1 to 3.29.3
- [Release notes](https://github.com/zh-lx/pinyin-pro/releases)
- [Changelog](https://github.com/zh-lx/pinyin-pro/blob/main/CHANGELOG.md)
- [Commits](https://github.com/zh-lx/pinyin-pro/commits/3.29.3/packages/pinyin-pro)
Updates `@noble/ciphers` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/paulmillr/noble-ciphers/releases)
- [Changelog](https://github.com/paulmillr/noble-ciphers/blob/main/CHANGELOG.md)
- [Commits](paulmillr/noble-ciphers@2.3.0...2.4.0)
Updates `fumadocs-core` from 16.14.4 to 16.15.4
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs@16.14.4...fumadocs@16.15.4)
Updates `fumadocs-mdx` from 15.2.3 to 15.4.0
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs-mdx@15.2.3...fumadocs-mdx@15.4.0)
Updates `fumadocs-ui` from 16.14.4 to 16.15.4
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs@16.14.4...fumadocs@16.15.4)
Updates `lucide-react` from 1.31.0 to 1.34.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.34.0/packages/lucide-react)
Updates `mermaid` from 11.16.1 to 11.17.2
- [Release notes](https://github.com/mermaid-js/mermaid/releases)
- [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.16.1...mermaid@11.17.2)
Updates `next` from 16.3.1 to 16.3.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.3.1...v16.3.3)
---
updated-dependencies:
- dependency-name: "@oclif/core"
dependency-version: 4.14.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: js-yaml
dependency-version: 5.4.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: sql.js
dependency-version: 1.14.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: mongodb
dependency-version: 7.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: "@better-auth/core"
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@better-auth/oauth-provider"
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@better-auth/scim"
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@better-auth/sso"
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@noble/hashes"
dependency-version: 2.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: better-auth
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: jose
dependency-version: 6.2.10
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: hono
dependency-version: 4.13.5
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: nodemailer
dependency-version: 9.0.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: pinyin-pro
dependency-version: 3.29.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@noble/ciphers"
dependency-version: 2.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: fumadocs-core
dependency-version: 16.15.4
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: fumadocs-mdx
dependency-version: 15.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: fumadocs-ui
dependency-version: 16.15.4
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: lucide-react
dependency-version: 1.34.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: mermaid
dependency-version: 11.17.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: next
dependency-version: 16.3.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot
added

dependencies
Pull requests that update a dependency file
javascript
Pull requests that update javascript code
labels
Aug 31, 2026
@github-actions
github-actionsBot
commented
Aug 31, 2026

Copy link


Copy Markdown

Contributor
📓 Docs Drift Check
⚠️9 changed file(s) yielded no anchor (packages/cli/package.json, packages/drivers/driver-mongodb/package.json, packages/drivers/driver-sqlite-wasm/package.json, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 9 changed package(s)).
What this run could not see
  • 9 changed file(s) yielded no anchor (packages/cli/package.json, packages/drivers/driver-mongodb/package.json, packages/drivers/driver-sqlite-wasm/package.json, …) — pages documenting those are invisible to this run
  • a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
Coarse fallback — 46 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 9c120f0308d5aed3c26f53c406054a95a631d156 → packageMentionDocs.
@github-actionsgithub-actionsBot
added
the 
documentation
Improvements or additions to documentation
label
Aug 31, 2026
@huangyiirenehuangyiirene
mentioned this pull request
Aug 31, 2026

Closed

@os-samos-sam
closed this
Aug 31, 2026
@dependabot@github
dependabotBot
commented
on behalf of githubAug 31, 2026

Copy link


Copy Markdown

ContributorAuthor
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.
To ignore these dependencies, configure ignore rules in dependabot.yml
@dependabot
dependabotBot
deleted the

dependabot/npm_and_yarn/production-dependencies-6f36c788ab

branch
August 31, 2026 14:47
@os-samos-sam
mentioned this pull request
Aug 31, 2026

Closed

@claudeclaudeBot
mentioned this pull request
Aug 31, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency filedocumentationImprovements or additions to documentationjavascriptPull requests that update javascript codesize/s

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@os-sam

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(deps)(deps): Bump the production-dependencies group with 21 updates - #13589
Closed
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/npm_and_yarn/production-dependencies-6f36c788ab
Closed
chore(deps)(deps): Bump the production-dependencies group with 21 updates#13589
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/npm_and_yarn/production-dependencies-6f36c788ab
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubAug 31, 2026

Copy link


Copy Markdown

Contributor
Bumps the production-dependencies group with 21 updates:
PackageFromTo
@oclif/core4.13.34.14.0
js-yaml5.2.35.4.1
sql.js1.14.11.14.2
mongodb7.5.07.6.0
@better-auth/core1.7.11.7.2
@better-auth/oauth-provider1.7.11.7.2
@better-auth/scim1.7.11.7.2
@better-auth/sso1.7.11.7.2
@noble/hashes2.3.02.4.0
better-auth1.7.11.7.2
jose6.2.86.2.10
hono4.13.24.13.5
nodemailer9.0.59.0.6
pinyin-pro3.29.13.29.3
@noble/ciphers2.3.02.4.0
fumadocs-core16.14.416.15.4
fumadocs-mdx15.2.315.4.0
fumadocs-ui16.14.416.15.4
lucide-react1.31.01.34.0
mermaid11.16.111.17.2
next16.3.116.3.3
Updates @oclif/core from 4.13.3 to 4.14.0
Release notes
Sourced from @​oclif/core's releases.
4.14.0
Features
  • bumping to eslint v10 (W-23473845) (248de04)
4.13.5
Bug Fixes
  • replaced require with dynamic import (W-23807278) (d35e325)
4.13.4
Bug Fixes
  • resolved security vulnerability in powershell path (W-23807278) (911e9d2)
Changelog
Sourced from @​oclif/core's changelog.
4.14.0 (2026-08-19)
Features
  • bumping to eslint v10 (W-23473845) (248de04)
4.13.5 (2026-08-14)
Bug Fixes
  • replaced require with dynamic import (W-23807278) (d35e325)
4.13.4 (2026-08-14)
Bug Fixes
  • resolved security vulnerability in powershell path (W-23807278) (911e9d2)
Commits
  • 1d2903e chore(release): 4.14.0 [skip ci]
  • 45c7f0a Merge pull request #1635 from oclif/d/W-23473845
  • 395c8bc chore: prune stale eslint suppressions after merge
  • 35ddd2e chore: merge main into d/W-23473845
  • 0d01467 chore(release): 4.13.5 [skip ci]
  • 06949eb Merge pull request #1638 from oclif/d/W-23807278-2
  • d35e325 fix: replaced require with dynamic import (W-23807278)
  • 85370b7 chore(release): 4.13.4 [skip ci]
  • 3318c6e Merge pull request #1636 from oclif/d/W-23807278
  • 911e9d2 fix: resolved security vulnerability in powershell path (W-23807278)
  • Additional commits viewable in compare view

Updates js-yaml from 5.2.3 to 5.4.1
Changelog
Sourced from js-yaml's changelog.
[5.4.1] - 2026-08-26
Changed
  • Hard-limit merge sequence size to 100.
Security
  • Count empty mappings in merge sequences toward maxTotalMergeKeys to limit
CPU usage, #797.
[5.4.0] - 2026-08-25
Added
  • Added the scalarStyleRules dumper option to customize string formatting.
See Scalar styling for details.
Changed
  • [breaking] Flattened the low-level AST node style representation. Scalar
and collection nodes now use SCALAR_STYLE and COLLECTION_STYLE values;
explicit tags use the separate tagged property. Alias nodes now contain
only kind and anchor. This only affects code that directly constructs or
edits AST nodes.
  • [breaking] The sortKeys option was rewritten using AST mutation to avoid
side effects.
  • Reworked scalar style selection. This can change formatting without changing
loaded values; in particular, whitespace-only strings are now double-quoted.
Fixed
  • Accept a byte order mark at the start of each document in a stream, #791.
  • Produce valid flow mappings with quoteFlowKeys and flowSkipColonSpace,
including alias and property-only keys, #786.
  • Preserve empty scalar items when converting block sequences to flow style.
  • Do not apply the 1024-character simple-key limit to flow mapping keys.
  • Count Unicode code points, rather than UTF-16 code units, for the
1024-character simple-key limit.
  • Add an explicit document-end marker after keep-chomped block scalars when
needed to preserve trailing newlines.
[5.3.0] - 2026-08-14
This release focuses on reworking the documentation and making small
architectural improvements before moving forward.
Added
  • Added completely new documentation.
  • Exported DUMP_SCHEMA, the default schema used by the dumper.
  • Added YAMLException.throwAt() for throwing an error at a source position.
Changed
... (truncated)
Commits

Updates sql.js from 1.14.1 to 1.14.2
Commits
  • 9c4e167 ci: debug npm publish http log
  • 1d5db45 ci: use npm 11 for OIDC trusted publishing
  • c2c6909 debug: oidc env dump
  • 17159df debug: oidc
  • 7e943bd ci: publish to npm via OIDC trusted publishing
  • c11695f Bump version to 1.14.2
  • 5489808 fix: restore WASM stack in Database.exec to prevent stack leak (#631)
  • See full diff in compare view
Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for sql.js since your current version.

Updates mongodb from 7.5.0 to 7.6.0
Release notes
Sourced from mongodb's releases.
v7.6.0
7.6.0 (2026-08-21)
The MongoDB Node.js team is pleased to announce version 7.6.0 of the mongodb package!
Release Notes
Support for MongoDB 4.2 is removed
[!WARNING]
When the driver connects to a MongoDB server of version 4.2 or less, it will now throw an error.
HTTP proxy support for KMS requests in CSFLE and Queryable Encryption
In-use encryption can now route KMS requests through an HTTP proxy. Set kmsConnectCallback on your ClientEncryption or auto-encryption options to control how the driver connects to a KMS host. The callback receives the target host and port and returns a connected socket (for example, a tunnel
opened with HTTP CONNECT); the driver then performs the KMS TLS handshake over that socket using the provider's configured TLS options. This unblocks CSFLE and Queryable Encryption in environments that require an HTTP forward proxy for outbound KMS traffic, which the existing SOCKS5 proxyOptions does not cover.
constclientEncryption=newClientEncryption(keyVaultClient,{
keyVaultNamespace,
kmsProviders,// Establish the KMS connection through your HTTP proxy; the driver adds TLS.kmsConnectCallback: ({ host, port })=>connectThroughHttpProxy(host,port)});
Improved Intelligent Workload Management
Improved performance for MongoDB 9.0's Intelligent Workload Management (IWM) by only retrying overload errors when doing so is expected to not worsen server conditions
Bundling the driver into ESM no longer throws ReferenceError: require is not defined
v7.2.0 introduced the experimental runtimeAdapters option and, as part of it, replaced the driver’s static import of Node’s os module with a runtime require('os'). That works in a CommonJS build, but when the driver is bundled into ESM output (e.g. a Vite/esbuild/rollup server build with "type": "module"), there is no require in module scope, so constructing a client threw ReferenceError: require is not defined. The driver now loads the default os adapter through a dynamic import() that survives bundling, so new MongoClient() works in ESM bundles. CommonJS usage is unchanged, and supplying your own runtimeAdapters.os continues to work.
Bulk writes serialize each document only once
insertMany and bulkWrite previously processed each document twice - once to measure its size for batch splitting (a full recursive walk via calculateObjectSize) and again to serialize it into the command sent to the server. Documents are now serialized a single time and the resulting bytes are reused for both, decreasing the BSON-encoding CPU spent on bulk writes and reducing event-loop blocking during large batches. The improvement is most noticeable with high document counts and documents that have many fields.
Features
  • NODE-7546: add HTTP Proxy support for QE & CSFLE (#5007) (3366c21)
  • NODE-7547: bump minimum support server/wire versions to '4.4' & '9' respectively (#4994) (3d97028)
  • NODE-7624: support baseBackoffMS and update client backpressure backoff (#5020) (560837b)
Bug Fixes
  • NODE-7603: emit dynamic import('os') via tsconfig (#4992) (52f5e61)
Performance Improvements
... (truncated)
Changelog
Sourced from mongodb's changelog.
7.6.0 (2026-08-21)
Features
  • NODE-7546: add HTTP Proxy support for QE & CSFLE (#5007) (3366c21)
  • NODE-7547: bump minimum support server/wire versions to '4.4' & '9' respectively (#4994) (3d97028)
  • NODE-7624: support baseBackoffMS and update client backpressure backoff (#5020) (560837b)
Bug Fixes
  • NODE-7603: emit dynamic import('os') via tsconfig (#4992) (52f5e61)
Performance Improvements
  • NODE-7660: serialize bulk write documents a single time (#4999) (1217aa1)
Commits
  • 0fb2c13 chore(main): release 7.6.0 (#5001)
  • bb35ded docs: Add preliminary checks to release instructions (#5028)
  • 560837b feat(NODE-7624): support baseBackoffMS and update client backpressure backoff...
  • ce33c59 chore(NODE-7767): bson compat tests snappy fix (#5025)
  • 0f2ed29 chore(NODE-7770): add server 9.0 to the test matrix (#5024)
  • bc92c29 chore(NODE-7767): snappy 7.4 is incompatible in CI (#5021)
  • dce7939 chore(NODE-7759): pin bson-compat server (#5018)
  • 7f8edf3 chore: run bson compat tests against latest server (#5017)
  • 30c31e5 ci(deps): bump drivers-evergreen-tools from 3741fa9 to e86753e (#5016)
  • 3366c21 feat(NODE-7546): add HTTP Proxy support for QE & CSFLE (#5007)
  • Additional commits viewable in compare view

Updates @better-auth/core from 1.7.1 to 1.7.2
Release notes
Sourced from @​better-auth/core's releases.
v1.7.2
better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
For detailed changes, see CHANGELOG
@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)
For detailed changes, see CHANGELOG
@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)
For detailed changes, see CHANGELOG
@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
... (truncated)
Changelog
Sourced from @​better-auth/core's changelog.
1.7.2
Patch Changes
  • #10938557e19b Thanks @​bytaesu! - Added synchronous auth endpoint context access with getCurrentAuthEndpointContext and optional access with tryGetCurrentAuthEndpointContext. The existing getCurrentAuthContext and getCurrentAuthContextAsyncLocalStorage functions remain available as deprecated compatibility APIs.
  • #1085564da15b Thanks @​bytaesu! - Prevent async context loss in Cloudflare Workers bundles that enable multiple runtime conditions.
  • #10982b4ad5a1 Thanks @​bytaesu! - Built-in placeholder emails now consistently use the namespaced {identifier}@{namespace}.placeholder.invalid format.
  • #10979fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.
  • #10939e1d4011 Thanks @​bytaesu! - Logs emitted while handling auth requests now respect the configured custom logger, log level, and disabled setting.
Commits

Updates @better-auth/oauth-provider from 1.7.1 to 1.7.2
Release notes
Sourced from @​better-auth/oauth-provider's releases.
v1.7.2
better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
For detailed changes, see CHANGELOG
@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)
For detailed changes, see CHANGELOG
@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)
For detailed changes, see CHANGELOG
@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
... (truncated)
Changelog
Sourced from @​better-auth/oauth-provider's changelog.
1.7.2
Patch Changes
  • #11010bb8d7c4 Thanks @​bytaesu! - Client ID Metadata Document clients that declare a grant the server does not offer (such as Claude's enterprise jwt-bearer grant) can now register. Only documents sharing no grant with the server are refused.
  • #10979fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.
Commits

Updates @better-auth/scim from 1.7.1 to 1.7.2
Release notes
Sourced from @​better-auth/scim's releases.
v1.7.2
better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
For detailed changes, see CHANGELOG
@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)
For detailed changes, see CHANGELOG
@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)
For detailed changes, see CHANGELOG
@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
... (truncated)
Changelog
Sourced from @​better-auth/scim's changelog.
1.7.2
Commits

Updates @better-auth/sso from 1.7.1 to 1.7.2
Release notes
Sourced from @​better-auth/sso's releases.
v1.7.2
better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
For detailed changes, see CHANGELOG
@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)
For detailed changes, see CHANGELOG
@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)
For detailed changes, see CHANGELOG
@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
... (truncated)
Changelog
Sourced from @​better-auth/sso's changelog.
1.7.2
Patch Changes
  • #10979fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.
Commits

Updates @noble/hashes from 2.3.0 to 2.4.0
Release notes
Sourced from @​noble/hashes's releases.
2.4.0
Security and correctness
  • Protect passed options against mutation / pollution
  • keccakprg: fail until entropy is added
  • webcrypto: reject output sizes which crashed engine
  • blake3: fix tree merging for multi-terabyte streams
  • Improve zeroization
Misc
  • Speed-up Argon2 by 20%
  • Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
  • Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
  • nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.
Full Changelog: paulmillr/noble-hashes@2.3.0...2.4.0
Changelog
Sourced from @​noble/hashes's changelog.
2.4.0 (2026-08-27)
Security and correctness
  • Protect passed options against mutation / pollution
  • keccakprg: fail until entropy is added
  • webcrypto: reject output sizes which crashed engine
  • blake3: fix tree merging for multi-terabyte streams
  • Improve zeroization
Misc
  • Speed-up Argon2 by 20%
  • Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
  • Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
  • nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.
Commits

Updates better-auth from 1.7.1 to 1.7.2
Release notes
Sourced from better-auth's releases.
v1.7.2
better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
For detailed changes, see CHANGELOG
@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)
For detailed changes, see CHANGELOG
@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)
For detailed changes, see CHANGELOG
@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
... (truncated)
Changelog
Sourced from better-auth's changelog.
1.7.2
Patch Changes
  • #10875d5d889b Thanks @​bytaesu! - Fix programmatic migrations failing on Cloudflare D1 while preserving existing-index validation across supported databases.
  • #10982b4ad5a1 Thanks @​bytaesu! - Built-in placeholder emails now consistently use the namespaced {identifier}@{namespace}.placeholder.invalid format.
  • #10934c7a5c1a Thanks @​bytaesu! - Cookie-cache reads now warn when signed session data is invalid instead of silently appearing as a signed-out session.
  • #1087978f0c39 Thanks @​starslingdev! - Test suites using getTestInstance now run faster because the shared fixture avoids production password-hashing costs by default. Custom emailAndPassword.password implementations continue to take precedence.
  • #10823ce8a3ab Thanks @​sosyz! - Ensure permanently banning a user clears any expiration from a previous temporary ban.
  • #10907a021eaf Thanks @​heliohm! - A client created with more plugins is again assignable to a client type declaring fewer plugins, as in 1.6.
  • #10959c8dcfa5 Thanks @​bytaesu! - Allow same-origin form submissions from pages using Referrer-Policy: no-referrer while continuing to reject untrusted request origins.
  • #10979fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.
  • #10041f6891a2 Thanks @​GautamBytes! - Allow ~...

    Description has been truncated
@dependabot
chore(deps)(deps): Bump the production-dependencies group with 21 upd…
8daf8c1
…ates
Bumps the production-dependencies group with 21 updates:
| Package | From | To |
| --- | --- | --- |
| [@oclif/core](https://github.com/oclif/core) | `4.13.3` | `4.14.0` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `5.2.3` | `5.4.1` |
| [sql.js](https://github.com/sql-js/sql.js) | `1.14.1` | `1.14.2` |
| [mongodb](https://github.com/mongodb/node-mongodb-native) | `7.5.0` | `7.6.0` |
| [@better-auth/core](https://github.com/better-auth/better-auth/tree/HEAD/packages/core) | `1.7.1` | `1.7.2` |
| [@better-auth/oauth-provider](https://github.com/better-auth/better-auth/tree/HEAD/packages/oauth-provider) | `1.7.1` | `1.7.2` |
| [@better-auth/scim](https://github.com/better-auth/better-auth/tree/HEAD/packages/scim) | `1.7.1` | `1.7.2` |
| [@better-auth/sso](https://github.com/better-auth/better-auth/tree/HEAD/packages/sso) | `1.7.1` | `1.7.2` |
| [@noble/hashes](https://github.com/paulmillr/noble-hashes) | `2.3.0` | `2.4.0` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.1` | `1.7.2` |
| [jose](https://github.com/panva/jose) | `6.2.8` | `6.2.10` |
| [hono](https://github.com/honojs/hono) | `4.13.2` | `4.13.5` |
| [nodemailer](https://github.com/nodemailer/nodemailer) | `9.0.5` | `9.0.6` |
| [pinyin-pro](https://github.com/zh-lx/pinyin-pro/tree/HEAD/packages/pinyin-pro) | `3.29.1` | `3.29.3` |
| [@noble/ciphers](https://github.com/paulmillr/noble-ciphers) | `2.3.0` | `2.4.0` |
| [fumadocs-core](https://github.com/fuma-nama/fumadocs) | `16.14.4` | `16.15.4` |
| [fumadocs-mdx](https://github.com/fuma-nama/fumadocs) | `15.2.3` | `15.4.0` |
| [fumadocs-ui](https://github.com/fuma-nama/fumadocs) | `16.14.4` | `16.15.4` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.31.0` | `1.34.0` |
| [mermaid](https://github.com/mermaid-js/mermaid) | `11.16.1` | `11.17.2` |
| [next](https://github.com/vercel/next.js) | `16.3.1` | `16.3.3` |
Updates `@oclif/core` from 4.13.3 to 4.14.0
- [Release notes](https://github.com/oclif/core/releases)
- [Changelog](https://github.com/oclif/core/blob/main/CHANGELOG.md)
- [Commits](oclif/core@4.13.3...4.14.0)
Updates `js-yaml` from 5.2.3 to 5.4.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@5.2.3...5.4.1)
Updates `sql.js` from 1.14.1 to 1.14.2
- [Release notes](https://github.com/sql-js/sql.js/releases)
- [Commits](sql-js/sql.js@v1.14.1...v1.14.2)
Updates `mongodb` from 7.5.0 to 7.6.0
- [Release notes](https://github.com/mongodb/node-mongodb-native/releases)
- [Changelog](https://github.com/mongodb/node-mongodb-native/blob/main/HISTORY.md)
- [Commits](mongodb/node-mongodb-native@v7.5.0...v7.6.0)
Updates `@better-auth/core` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/core/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/core)
Updates `@better-auth/oauth-provider` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/oauth-provider/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/oauth-provider)
Updates `@better-auth/scim` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/scim/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/scim)
Updates `@better-auth/sso` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/sso/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/sso)
Updates `@noble/hashes` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/paulmillr/noble-hashes/releases)
- [Changelog](https://github.com/paulmillr/noble-hashes/blob/main/CHANGELOG.md)
- [Commits](paulmillr/noble-hashes@2.3.0...2.4.0)
Updates `better-auth` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/better-auth)
Updates `jose` from 6.2.8 to 6.2.10
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.8...v6.2.10)
Updates `hono` from 4.13.2 to 4.13.5
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.2...v4.13.5)
Updates `nodemailer` from 9.0.5 to 9.0.6
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v9.0.5...v9.0.6)
Updates `pinyin-pro` from 3.29.1 to 3.29.3
- [Release notes](https://github.com/zh-lx/pinyin-pro/releases)
- [Changelog](https://github.com/zh-lx/pinyin-pro/blob/main/CHANGELOG.md)
- [Commits](https://github.com/zh-lx/pinyin-pro/commits/3.29.3/packages/pinyin-pro)
Updates `@noble/ciphers` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/paulmillr/noble-ciphers/releases)
- [Changelog](https://github.com/paulmillr/noble-ciphers/blob/main/CHANGELOG.md)
- [Commits](paulmillr/noble-ciphers@2.3.0...2.4.0)
Updates `fumadocs-core` from 16.14.4 to 16.15.4
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs@16.14.4...fumadocs@16.15.4)
Updates `fumadocs-mdx` from 15.2.3 to 15.4.0
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs-mdx@15.2.3...fumadocs-mdx@15.4.0)
Updates `fumadocs-ui` from 16.14.4 to 16.15.4
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs@16.14.4...fumadocs@16.15.4)
Updates `lucide-react` from 1.31.0 to 1.34.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.34.0/packages/lucide-react)
Updates `mermaid` from 11.16.1 to 11.17.2
- [Release notes](https://github.com/mermaid-js/mermaid/releases)
- [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.16.1...mermaid@11.17.2)
Updates `next` from 16.3.1 to 16.3.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.3.1...v16.3.3)
---
updated-dependencies:
- dependency-name: "@oclif/core"
dependency-version: 4.14.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: js-yaml
dependency-version: 5.4.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: sql.js
dependency-version: 1.14.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: mongodb
dependency-version: 7.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: "@better-auth/core"
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@better-auth/oauth-provider"
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@better-auth/scim"
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@better-auth/sso"
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@noble/hashes"
dependency-version: 2.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: better-auth
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: jose
dependency-version: 6.2.10
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: hono
dependency-version: 4.13.5
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: nodemailer
dependency-version: 9.0.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: pinyin-pro
dependency-version: 3.29.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@noble/ciphers"
dependency-version: 2.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: fumadocs-core
dependency-version: 16.15.4
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: fumadocs-mdx
dependency-version: 15.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: fumadocs-ui
dependency-version: 16.15.4
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: lucide-react
dependency-version: 1.34.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: mermaid
dependency-version: 11.17.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: next
dependency-version: 16.3.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot
added

dependencies
Pull requests that update a dependency file
javascript
Pull requests that update javascript code
labels
Aug 31, 2026
@github-actions
github-actionsBot
commented
Aug 31, 2026

Copy link


Copy Markdown

Contributor
📓 Docs Drift Check
⚠️9 changed file(s) yielded no anchor (packages/cli/package.json, packages/drivers/driver-mongodb/package.json, packages/drivers/driver-sqlite-wasm/package.json, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 9 changed package(s)).
What this run could not see
  • 9 changed file(s) yielded no anchor (packages/cli/package.json, packages/drivers/driver-mongodb/package.json, packages/drivers/driver-sqlite-wasm/package.json, …) — pages documenting those are invisible to this run
  • a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
Coarse fallback — 46 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 9c120f0308d5aed3c26f53c406054a95a631d156 → packageMentionDocs.
@github-actionsgithub-actionsBot
added
the 
documentation
Improvements or additions to documentation
label
Aug 31, 2026
@huangyiirenehuangyiirene
mentioned this pull request
Aug 31, 2026

Closed

@os-samos-sam
closed this
Aug 31, 2026
@dependabot@github
dependabotBot
commented
on behalf of githubAug 31, 2026

Copy link


Copy Markdown

ContributorAuthor
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.
To ignore these dependencies, configure ignore rules in dependabot.yml
@dependabot
dependabotBot
deleted the

dependabot/npm_and_yarn/production-dependencies-6f36c788ab

branch
August 31, 2026 14:47
@os-samos-sam
mentioned this pull request
Aug 31, 2026

Closed

@claudeclaudeBot
mentioned this pull request
Aug 31, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency filedocumentationImprovements or additions to documentationjavascriptPull requests that update javascript codesize/s

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@os-sam

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
chore(deps)(deps): Bump the production-dependencies group with 21 updates - #13589
Closed
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/npm_and_yarn/production-dependencies-6f36c788ab
Closed
chore(deps)(deps): Bump the production-dependencies group with 21 updates#13589
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/npm_and_yarn/production-dependencies-6f36c788ab
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubAug 31, 2026

Copy link


Copy Markdown

Contributor
Bumps the production-dependencies group with 21 updates:
PackageFromTo
@oclif/core4.13.34.14.0
js-yaml5.2.35.4.1
sql.js1.14.11.14.2
mongodb7.5.07.6.0
@better-auth/core1.7.11.7.2
@better-auth/oauth-provider1.7.11.7.2
@better-auth/scim1.7.11.7.2
@better-auth/sso1.7.11.7.2
@noble/hashes2.3.02.4.0
better-auth1.7.11.7.2
jose6.2.86.2.10
hono4.13.24.13.5
nodemailer9.0.59.0.6
pinyin-pro3.29.13.29.3
@noble/ciphers2.3.02.4.0
fumadocs-core16.14.416.15.4
fumadocs-mdx15.2.315.4.0
fumadocs-ui16.14.416.15.4
lucide-react1.31.01.34.0
mermaid11.16.111.17.2
next16.3.116.3.3
Updates @oclif/core from 4.13.3 to 4.14.0
Release notes
Sourced from @​oclif/core's releases.
4.14.0
Features
  • bumping to eslint v10 (W-23473845) (248de04)
4.13.5
Bug Fixes
  • replaced require with dynamic import (W-23807278) (d35e325)
4.13.4
Bug Fixes
  • resolved security vulnerability in powershell path (W-23807278) (911e9d2)
Changelog
Sourced from @​oclif/core's changelog.
4.14.0 (2026-08-19)
Features
  • bumping to eslint v10 (W-23473845) (248de04)
4.13.5 (2026-08-14)
Bug Fixes
  • replaced require with dynamic import (W-23807278) (d35e325)
4.13.4 (2026-08-14)
Bug Fixes
  • resolved security vulnerability in powershell path (W-23807278) (911e9d2)
Commits
  • 1d2903e chore(release): 4.14.0 [skip ci]
  • 45c7f0a Merge pull request #1635 from oclif/d/W-23473845
  • 395c8bc chore: prune stale eslint suppressions after merge
  • 35ddd2e chore: merge main into d/W-23473845
  • 0d01467 chore(release): 4.13.5 [skip ci]
  • 06949eb Merge pull request #1638 from oclif/d/W-23807278-2
  • d35e325 fix: replaced require with dynamic import (W-23807278)
  • 85370b7 chore(release): 4.13.4 [skip ci]
  • 3318c6e Merge pull request #1636 from oclif/d/W-23807278
  • 911e9d2 fix: resolved security vulnerability in powershell path (W-23807278)
  • Additional commits viewable in compare view

Updates js-yaml from 5.2.3 to 5.4.1
Changelog
Sourced from js-yaml's changelog.
[5.4.1] - 2026-08-26
Changed
  • Hard-limit merge sequence size to 100.
Security
  • Count empty mappings in merge sequences toward maxTotalMergeKeys to limit
CPU usage, #797.
[5.4.0] - 2026-08-25
Added
  • Added the scalarStyleRules dumper option to customize string formatting.
See Scalar styling for details.
Changed
  • [breaking] Flattened the low-level AST node style representation. Scalar
and collection nodes now use SCALAR_STYLE and COLLECTION_STYLE values;
explicit tags use the separate tagged property. Alias nodes now contain
only kind and anchor. This only affects code that directly constructs or
edits AST nodes.
  • [breaking] The sortKeys option was rewritten using AST mutation to avoid
side effects.
  • Reworked scalar style selection. This can change formatting without changing
loaded values; in particular, whitespace-only strings are now double-quoted.
Fixed
  • Accept a byte order mark at the start of each document in a stream, #791.
  • Produce valid flow mappings with quoteFlowKeys and flowSkipColonSpace,
including alias and property-only keys, #786.
  • Preserve empty scalar items when converting block sequences to flow style.
  • Do not apply the 1024-character simple-key limit to flow mapping keys.
  • Count Unicode code points, rather than UTF-16 code units, for the
1024-character simple-key limit.
  • Add an explicit document-end marker after keep-chomped block scalars when
needed to preserve trailing newlines.
[5.3.0] - 2026-08-14
This release focuses on reworking the documentation and making small
architectural improvements before moving forward.
Added
  • Added completely new documentation.
  • Exported DUMP_SCHEMA, the default schema used by the dumper.
  • Added YAMLException.throwAt() for throwing an error at a source position.
Changed
... (truncated)
Commits

Updates sql.js from 1.14.1 to 1.14.2
Commits
  • 9c4e167 ci: debug npm publish http log
  • 1d5db45 ci: use npm 11 for OIDC trusted publishing
  • c2c6909 debug: oidc env dump
  • 17159df debug: oidc
  • 7e943bd ci: publish to npm via OIDC trusted publishing
  • c11695f Bump version to 1.14.2
  • 5489808 fix: restore WASM stack in Database.exec to prevent stack leak (#631)
  • See full diff in compare view
Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for sql.js since your current version.

Updates mongodb from 7.5.0 to 7.6.0
Release notes
Sourced from mongodb's releases.
v7.6.0
7.6.0 (2026-08-21)
The MongoDB Node.js team is pleased to announce version 7.6.0 of the mongodb package!
Release Notes
Support for MongoDB 4.2 is removed
[!WARNING]
When the driver connects to a MongoDB server of version 4.2 or less, it will now throw an error.
HTTP proxy support for KMS requests in CSFLE and Queryable Encryption
In-use encryption can now route KMS requests through an HTTP proxy. Set kmsConnectCallback on your ClientEncryption or auto-encryption options to control how the driver connects to a KMS host. The callback receives the target host and port and returns a connected socket (for example, a tunnel
opened with HTTP CONNECT); the driver then performs the KMS TLS handshake over that socket using the provider's configured TLS options. This unblocks CSFLE and Queryable Encryption in environments that require an HTTP forward proxy for outbound KMS traffic, which the existing SOCKS5 proxyOptions does not cover.
constclientEncryption=newClientEncryption(keyVaultClient,{
keyVaultNamespace,
kmsProviders,// Establish the KMS connection through your HTTP proxy; the driver adds TLS.kmsConnectCallback: ({ host, port })=>connectThroughHttpProxy(host,port)});
Improved Intelligent Workload Management
Improved performance for MongoDB 9.0's Intelligent Workload Management (IWM) by only retrying overload errors when doing so is expected to not worsen server conditions
Bundling the driver into ESM no longer throws ReferenceError: require is not defined
v7.2.0 introduced the experimental runtimeAdapters option and, as part of it, replaced the driver’s static import of Node’s os module with a runtime require('os'). That works in a CommonJS build, but when the driver is bundled into ESM output (e.g. a Vite/esbuild/rollup server build with "type": "module"), there is no require in module scope, so constructing a client threw ReferenceError: require is not defined. The driver now loads the default os adapter through a dynamic import() that survives bundling, so new MongoClient() works in ESM bundles. CommonJS usage is unchanged, and supplying your own runtimeAdapters.os continues to work.
Bulk writes serialize each document only once
insertMany and bulkWrite previously processed each document twice - once to measure its size for batch splitting (a full recursive walk via calculateObjectSize) and again to serialize it into the command sent to the server. Documents are now serialized a single time and the resulting bytes are reused for both, decreasing the BSON-encoding CPU spent on bulk writes and reducing event-loop blocking during large batches. The improvement is most noticeable with high document counts and documents that have many fields.
Features
  • NODE-7546: add HTTP Proxy support for QE & CSFLE (#5007) (3366c21)
  • NODE-7547: bump minimum support server/wire versions to '4.4' & '9' respectively (#4994) (3d97028)
  • NODE-7624: support baseBackoffMS and update client backpressure backoff (#5020) (560837b)
Bug Fixes
  • NODE-7603: emit dynamic import('os') via tsconfig (#4992) (52f5e61)
Performance Improvements
... (truncated)
Changelog
Sourced from mongodb's changelog.
7.6.0 (2026-08-21)
Features
  • NODE-7546: add HTTP Proxy support for QE & CSFLE (#5007) (3366c21)
  • NODE-7547: bump minimum support server/wire versions to '4.4' & '9' respectively (#4994) (3d97028)
  • NODE-7624: support baseBackoffMS and update client backpressure backoff (#5020) (560837b)
Bug Fixes
  • NODE-7603: emit dynamic import('os') via tsconfig (#4992) (52f5e61)
Performance Improvements
  • NODE-7660: serialize bulk write documents a single time (#4999) (1217aa1)
Commits
  • 0fb2c13 chore(main): release 7.6.0 (#5001)
  • bb35ded docs: Add preliminary checks to release instructions (#5028)
  • 560837b feat(NODE-7624): support baseBackoffMS and update client backpressure backoff...
  • ce33c59 chore(NODE-7767): bson compat tests snappy fix (#5025)
  • 0f2ed29 chore(NODE-7770): add server 9.0 to the test matrix (#5024)
  • bc92c29 chore(NODE-7767): snappy 7.4 is incompatible in CI (#5021)
  • dce7939 chore(NODE-7759): pin bson-compat server (#5018)
  • 7f8edf3 chore: run bson compat tests against latest server (#5017)
  • 30c31e5 ci(deps): bump drivers-evergreen-tools from 3741fa9 to e86753e (#5016)
  • 3366c21 feat(NODE-7546): add HTTP Proxy support for QE & CSFLE (#5007)
  • Additional commits viewable in compare view

Updates @better-auth/core from 1.7.1 to 1.7.2
Release notes
Sourced from @​better-auth/core's releases.
v1.7.2
better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
For detailed changes, see CHANGELOG
@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)
For detailed changes, see CHANGELOG
@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)
For detailed changes, see CHANGELOG
@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
... (truncated)
Changelog
Sourced from @​better-auth/core's changelog.
1.7.2
Patch Changes
  • #10938557e19b Thanks @​bytaesu! - Added synchronous auth endpoint context access with getCurrentAuthEndpointContext and optional access with tryGetCurrentAuthEndpointContext. The existing getCurrentAuthContext and getCurrentAuthContextAsyncLocalStorage functions remain available as deprecated compatibility APIs.
  • #1085564da15b Thanks @​bytaesu! - Prevent async context loss in Cloudflare Workers bundles that enable multiple runtime conditions.
  • #10982b4ad5a1 Thanks @​bytaesu! - Built-in placeholder emails now consistently use the namespaced {identifier}@{namespace}.placeholder.invalid format.
  • #10979fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.
  • #10939e1d4011 Thanks @​bytaesu! - Logs emitted while handling auth requests now respect the configured custom logger, log level, and disabled setting.
Commits

Updates @better-auth/oauth-provider from 1.7.1 to 1.7.2
Release notes
Sourced from @​better-auth/oauth-provider's releases.
v1.7.2
better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
For detailed changes, see CHANGELOG
@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)
For detailed changes, see CHANGELOG
@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)
For detailed changes, see CHANGELOG
@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
... (truncated)
Changelog
Sourced from @​better-auth/oauth-provider's changelog.
1.7.2
Patch Changes
  • #11010bb8d7c4 Thanks @​bytaesu! - Client ID Metadata Document clients that declare a grant the server does not offer (such as Claude's enterprise jwt-bearer grant) can now register. Only documents sharing no grant with the server are refused.
  • #10979fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.
Commits

Updates @better-auth/scim from 1.7.1 to 1.7.2
Release notes
Sourced from @​better-auth/scim's releases.
v1.7.2
better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
For detailed changes, see CHANGELOG
@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)
For detailed changes, see CHANGELOG
@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)
For detailed changes, see CHANGELOG
@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
... (truncated)
Changelog
Sourced from @​better-auth/scim's changelog.
1.7.2
Commits

Updates @better-auth/sso from 1.7.1 to 1.7.2
Release notes
Sourced from @​better-auth/sso's releases.
v1.7.2
better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
For detailed changes, see CHANGELOG
@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)
For detailed changes, see CHANGELOG
@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)
For detailed changes, see CHANGELOG
@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
... (truncated)
Changelog
Sourced from @​better-auth/sso's changelog.
1.7.2
Patch Changes
  • #10979fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.
Commits

Updates @noble/hashes from 2.3.0 to 2.4.0
Release notes
Sourced from @​noble/hashes's releases.
2.4.0
Security and correctness
  • Protect passed options against mutation / pollution
  • keccakprg: fail until entropy is added
  • webcrypto: reject output sizes which crashed engine
  • blake3: fix tree merging for multi-terabyte streams
  • Improve zeroization
Misc
  • Speed-up Argon2 by 20%
  • Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
  • Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
  • nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.
Full Changelog: paulmillr/noble-hashes@2.3.0...2.4.0
Changelog
Sourced from @​noble/hashes's changelog.
2.4.0 (2026-08-27)
Security and correctness
  • Protect passed options against mutation / pollution
  • keccakprg: fail until entropy is added
  • webcrypto: reject output sizes which crashed engine
  • blake3: fix tree merging for multi-terabyte streams
  • Improve zeroization
Misc
  • Speed-up Argon2 by 20%
  • Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
  • Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
  • nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.
Commits

Updates better-auth from 1.7.1 to 1.7.2
Release notes
Sourced from better-auth's releases.
v1.7.2
better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
For detailed changes, see CHANGELOG
@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)
For detailed changes, see CHANGELOG
@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)
For detailed changes, see CHANGELOG
@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
... (truncated)
Changelog
Sourced from better-auth's changelog.
1.7.2
Patch Changes
  • #10875d5d889b Thanks @​bytaesu! - Fix programmatic migrations failing on Cloudflare D1 while preserving existing-index validation across supported databases.
  • #10982b4ad5a1 Thanks @​bytaesu! - Built-in placeholder emails now consistently use the namespaced {identifier}@{namespace}.placeholder.invalid format.
  • #10934c7a5c1a Thanks @​bytaesu! - Cookie-cache reads now warn when signed session data is invalid instead of silently appearing as a signed-out session.
  • #1087978f0c39 Thanks @​starslingdev! - Test suites using getTestInstance now run faster because the shared fixture avoids production password-hashing costs by default. Custom emailAndPassword.password implementations continue to take precedence.
  • #10823ce8a3ab Thanks @​sosyz! - Ensure permanently banning a user clears any expiration from a previous temporary ban.
  • #10907a021eaf Thanks @​heliohm! - A client created with more plugins is again assignable to a client type declaring fewer plugins, as in 1.6.
  • #10959c8dcfa5 Thanks @​bytaesu! - Allow same-origin form submissions from pages using Referrer-Policy: no-referrer while continuing to reject untrusted request origins.
  • #10979fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.
  • #10041f6891a2 Thanks @​GautamBytes! - Allow ~...

    Description has been truncated
@dependabot
chore(deps)(deps): Bump the production-dependencies group with 21 upd…
8daf8c1
…ates
Bumps the production-dependencies group with 21 updates:
| Package | From | To |
| --- | --- | --- |
| [@oclif/core](https://github.com/oclif/core) | `4.13.3` | `4.14.0` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `5.2.3` | `5.4.1` |
| [sql.js](https://github.com/sql-js/sql.js) | `1.14.1` | `1.14.2` |
| [mongodb](https://github.com/mongodb/node-mongodb-native) | `7.5.0` | `7.6.0` |
| [@better-auth/core](https://github.com/better-auth/better-auth/tree/HEAD/packages/core) | `1.7.1` | `1.7.2` |
| [@better-auth/oauth-provider](https://github.com/better-auth/better-auth/tree/HEAD/packages/oauth-provider) | `1.7.1` | `1.7.2` |
| [@better-auth/scim](https://github.com/better-auth/better-auth/tree/HEAD/packages/scim) | `1.7.1` | `1.7.2` |
| [@better-auth/sso](https://github.com/better-auth/better-auth/tree/HEAD/packages/sso) | `1.7.1` | `1.7.2` |
| [@noble/hashes](https://github.com/paulmillr/noble-hashes) | `2.3.0` | `2.4.0` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.1` | `1.7.2` |
| [jose](https://github.com/panva/jose) | `6.2.8` | `6.2.10` |
| [hono](https://github.com/honojs/hono) | `4.13.2` | `4.13.5` |
| [nodemailer](https://github.com/nodemailer/nodemailer) | `9.0.5` | `9.0.6` |
| [pinyin-pro](https://github.com/zh-lx/pinyin-pro/tree/HEAD/packages/pinyin-pro) | `3.29.1` | `3.29.3` |
| [@noble/ciphers](https://github.com/paulmillr/noble-ciphers) | `2.3.0` | `2.4.0` |
| [fumadocs-core](https://github.com/fuma-nama/fumadocs) | `16.14.4` | `16.15.4` |
| [fumadocs-mdx](https://github.com/fuma-nama/fumadocs) | `15.2.3` | `15.4.0` |
| [fumadocs-ui](https://github.com/fuma-nama/fumadocs) | `16.14.4` | `16.15.4` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.31.0` | `1.34.0` |
| [mermaid](https://github.com/mermaid-js/mermaid) | `11.16.1` | `11.17.2` |
| [next](https://github.com/vercel/next.js) | `16.3.1` | `16.3.3` |
Updates `@oclif/core` from 4.13.3 to 4.14.0
- [Release notes](https://github.com/oclif/core/releases)
- [Changelog](https://github.com/oclif/core/blob/main/CHANGELOG.md)
- [Commits](oclif/core@4.13.3...4.14.0)
Updates `js-yaml` from 5.2.3 to 5.4.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@5.2.3...5.4.1)
Updates `sql.js` from 1.14.1 to 1.14.2
- [Release notes](https://github.com/sql-js/sql.js/releases)
- [Commits](sql-js/sql.js@v1.14.1...v1.14.2)
Updates `mongodb` from 7.5.0 to 7.6.0
- [Release notes](https://github.com/mongodb/node-mongodb-native/releases)
- [Changelog](https://github.com/mongodb/node-mongodb-native/blob/main/HISTORY.md)
- [Commits](mongodb/node-mongodb-native@v7.5.0...v7.6.0)
Updates `@better-auth/core` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/core/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/core)
Updates `@better-auth/oauth-provider` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/oauth-provider/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/oauth-provider)
Updates `@better-auth/scim` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/scim/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/scim)
Updates `@better-auth/sso` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/sso/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/sso)
Updates `@noble/hashes` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/paulmillr/noble-hashes/releases)
- [Changelog](https://github.com/paulmillr/noble-hashes/blob/main/CHANGELOG.md)
- [Commits](paulmillr/noble-hashes@2.3.0...2.4.0)
Updates `better-auth` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/better-auth)
Updates `jose` from 6.2.8 to 6.2.10
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.8...v6.2.10)
Updates `hono` from 4.13.2 to 4.13.5
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.2...v4.13.5)
Updates `nodemailer` from 9.0.5 to 9.0.6
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v9.0.5...v9.0.6)
Updates `pinyin-pro` from 3.29.1 to 3.29.3
- [Release notes](https://github.com/zh-lx/pinyin-pro/releases)
- [Changelog](https://github.com/zh-lx/pinyin-pro/blob/main/CHANGELOG.md)
- [Commits](https://github.com/zh-lx/pinyin-pro/commits/3.29.3/packages/pinyin-pro)
Updates `@noble/ciphers` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/paulmillr/noble-ciphers/releases)
- [Changelog](https://github.com/paulmillr/noble-ciphers/blob/main/CHANGELOG.md)
- [Commits](paulmillr/noble-ciphers@2.3.0...2.4.0)
Updates `fumadocs-core` from 16.14.4 to 16.15.4
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs@16.14.4...fumadocs@16.15.4)
Updates `fumadocs-mdx` from 15.2.3 to 15.4.0
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs-mdx@15.2.3...fumadocs-mdx@15.4.0)
Updates `fumadocs-ui` from 16.14.4 to 16.15.4
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs@16.14.4...fumadocs@16.15.4)
Updates `lucide-react` from 1.31.0 to 1.34.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.34.0/packages/lucide-react)
Updates `mermaid` from 11.16.1 to 11.17.2
- [Release notes](https://github.com/mermaid-js/mermaid/releases)
- [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.16.1...mermaid@11.17.2)
Updates `next` from 16.3.1 to 16.3.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.3.1...v16.3.3)
---
updated-dependencies:
- dependency-name: "@oclif/core"
dependency-version: 4.14.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: js-yaml
dependency-version: 5.4.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: sql.js
dependency-version: 1.14.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: mongodb
dependency-version: 7.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: "@better-auth/core"
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@better-auth/oauth-provider"
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@better-auth/scim"
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@better-auth/sso"
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@noble/hashes"
dependency-version: 2.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: better-auth
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: jose
dependency-version: 6.2.10
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: hono
dependency-version: 4.13.5
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: nodemailer
dependency-version: 9.0.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: pinyin-pro
dependency-version: 3.29.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@noble/ciphers"
dependency-version: 2.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: fumadocs-core
dependency-version: 16.15.4
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: fumadocs-mdx
dependency-version: 15.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: fumadocs-ui
dependency-version: 16.15.4
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: lucide-react
dependency-version: 1.34.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: mermaid
dependency-version: 11.17.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: next
dependency-version: 16.3.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot
added

dependencies
Pull requests that update a dependency file
javascript
Pull requests that update javascript code
labels
Aug 31, 2026
@github-actions
github-actionsBot
commented
Aug 31, 2026

Copy link


Copy Markdown

Contributor
📓 Docs Drift Check
⚠️9 changed file(s) yielded no anchor (packages/cli/package.json, packages/drivers/driver-mongodb/package.json, packages/drivers/driver-sqlite-wasm/package.json, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 9 changed package(s)).
What this run could not see
  • 9 changed file(s) yielded no anchor (packages/cli/package.json, packages/drivers/driver-mongodb/package.json, packages/drivers/driver-sqlite-wasm/package.json, …) — pages documenting those are invisible to this run
  • a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
Coarse fallback — 46 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 9c120f0308d5aed3c26f53c406054a95a631d156 → packageMentionDocs.
@github-actionsgithub-actionsBot
added
the 
documentation
Improvements or additions to documentation
label
Aug 31, 2026
@huangyiirenehuangyiirene
mentioned this pull request
Aug 31, 2026

Closed

@os-samos-sam
closed this
Aug 31, 2026
@dependabot@github
dependabotBot
commented
on behalf of githubAug 31, 2026

Copy link


Copy Markdown

ContributorAuthor
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.
To ignore these dependencies, configure ignore rules in dependabot.yml
@dependabot
dependabotBot
deleted the

dependabot/npm_and_yarn/production-dependencies-6f36c788ab

branch
August 31, 2026 14:47
@os-samos-sam
mentioned this pull request
Aug 31, 2026

Closed

@claudeclaudeBot
mentioned this pull request
Aug 31, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency filedocumentationImprovements or additions to documentationjavascriptPull requests that update javascript codesize/s

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@os-sam

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(deps)(deps): Bump the production-dependencies group with 21 updates - #13589
Closed
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/npm_and_yarn/production-dependencies-6f36c788ab
Closed
chore(deps)(deps): Bump the production-dependencies group with 21 updates#13589
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/npm_and_yarn/production-dependencies-6f36c788ab
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubAug 31, 2026

Copy link


Copy Markdown

Contributor
Bumps the production-dependencies group with 21 updates:
PackageFromTo
@oclif/core4.13.34.14.0
js-yaml5.2.35.4.1
sql.js1.14.11.14.2
mongodb7.5.07.6.0
@better-auth/core1.7.11.7.2
@better-auth/oauth-provider1.7.11.7.2
@better-auth/scim1.7.11.7.2
@better-auth/sso1.7.11.7.2
@noble/hashes2.3.02.4.0
better-auth1.7.11.7.2
jose6.2.86.2.10
hono4.13.24.13.5
nodemailer9.0.59.0.6
pinyin-pro3.29.13.29.3
@noble/ciphers2.3.02.4.0
fumadocs-core16.14.416.15.4
fumadocs-mdx15.2.315.4.0
fumadocs-ui16.14.416.15.4
lucide-react1.31.01.34.0
mermaid11.16.111.17.2
next16.3.116.3.3
Updates @oclif/core from 4.13.3 to 4.14.0
Release notes
Sourced from @​oclif/core's releases.
4.14.0
Features
  • bumping to eslint v10 (W-23473845) (248de04)
4.13.5
Bug Fixes
  • replaced require with dynamic import (W-23807278) (d35e325)
4.13.4
Bug Fixes
  • resolved security vulnerability in powershell path (W-23807278) (911e9d2)
Changelog
Sourced from @​oclif/core's changelog.
4.14.0 (2026-08-19)
Features
  • bumping to eslint v10 (W-23473845) (248de04)
4.13.5 (2026-08-14)
Bug Fixes
  • replaced require with dynamic import (W-23807278) (d35e325)
4.13.4 (2026-08-14)
Bug Fixes
  • resolved security vulnerability in powershell path (W-23807278) (911e9d2)
Commits
  • 1d2903e chore(release): 4.14.0 [skip ci]
  • 45c7f0a Merge pull request #1635 from oclif/d/W-23473845
  • 395c8bc chore: prune stale eslint suppressions after merge
  • 35ddd2e chore: merge main into d/W-23473845
  • 0d01467 chore(release): 4.13.5 [skip ci]
  • 06949eb Merge pull request #1638 from oclif/d/W-23807278-2
  • d35e325 fix: replaced require with dynamic import (W-23807278)
  • 85370b7 chore(release): 4.13.4 [skip ci]
  • 3318c6e Merge pull request #1636 from oclif/d/W-23807278
  • 911e9d2 fix: resolved security vulnerability in powershell path (W-23807278)
  • Additional commits viewable in compare view

Updates js-yaml from 5.2.3 to 5.4.1
Changelog
Sourced from js-yaml's changelog.
[5.4.1] - 2026-08-26
Changed
  • Hard-limit merge sequence size to 100.
Security
  • Count empty mappings in merge sequences toward maxTotalMergeKeys to limit
CPU usage, #797.
[5.4.0] - 2026-08-25
Added
  • Added the scalarStyleRules dumper option to customize string formatting.
See Scalar styling for details.
Changed
  • [breaking] Flattened the low-level AST node style representation. Scalar
and collection nodes now use SCALAR_STYLE and COLLECTION_STYLE values;
explicit tags use the separate tagged property. Alias nodes now contain
only kind and anchor. This only affects code that directly constructs or
edits AST nodes.
  • [breaking] The sortKeys option was rewritten using AST mutation to avoid
side effects.
  • Reworked scalar style selection. This can change formatting without changing
loaded values; in particular, whitespace-only strings are now double-quoted.
Fixed
  • Accept a byte order mark at the start of each document in a stream, #791.
  • Produce valid flow mappings with quoteFlowKeys and flowSkipColonSpace,
including alias and property-only keys, #786.
  • Preserve empty scalar items when converting block sequences to flow style.
  • Do not apply the 1024-character simple-key limit to flow mapping keys.
  • Count Unicode code points, rather than UTF-16 code units, for the
1024-character simple-key limit.
  • Add an explicit document-end marker after keep-chomped block scalars when
needed to preserve trailing newlines.
[5.3.0] - 2026-08-14
This release focuses on reworking the documentation and making small
architectural improvements before moving forward.
Added
  • Added completely new documentation.
  • Exported DUMP_SCHEMA, the default schema used by the dumper.
  • Added YAMLException.throwAt() for throwing an error at a source position.
Changed
... (truncated)
Commits

Updates sql.js from 1.14.1 to 1.14.2
Commits
  • 9c4e167 ci: debug npm publish http log
  • 1d5db45 ci: use npm 11 for OIDC trusted publishing
  • c2c6909 debug: oidc env dump
  • 17159df debug: oidc
  • 7e943bd ci: publish to npm via OIDC trusted publishing
  • c11695f Bump version to 1.14.2
  • 5489808 fix: restore WASM stack in Database.exec to prevent stack leak (#631)
  • See full diff in compare view
Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for sql.js since your current version.

Updates mongodb from 7.5.0 to 7.6.0
Release notes
Sourced from mongodb's releases.
v7.6.0
7.6.0 (2026-08-21)
The MongoDB Node.js team is pleased to announce version 7.6.0 of the mongodb package!
Release Notes
Support for MongoDB 4.2 is removed
[!WARNING]
When the driver connects to a MongoDB server of version 4.2 or less, it will now throw an error.
HTTP proxy support for KMS requests in CSFLE and Queryable Encryption
In-use encryption can now route KMS requests through an HTTP proxy. Set kmsConnectCallback on your ClientEncryption or auto-encryption options to control how the driver connects to a KMS host. The callback receives the target host and port and returns a connected socket (for example, a tunnel
opened with HTTP CONNECT); the driver then performs the KMS TLS handshake over that socket using the provider's configured TLS options. This unblocks CSFLE and Queryable Encryption in environments that require an HTTP forward proxy for outbound KMS traffic, which the existing SOCKS5 proxyOptions does not cover.
constclientEncryption=newClientEncryption(keyVaultClient,{
keyVaultNamespace,
kmsProviders,// Establish the KMS connection through your HTTP proxy; the driver adds TLS.kmsConnectCallback: ({ host, port })=>connectThroughHttpProxy(host,port)});
Improved Intelligent Workload Management
Improved performance for MongoDB 9.0's Intelligent Workload Management (IWM) by only retrying overload errors when doing so is expected to not worsen server conditions
Bundling the driver into ESM no longer throws ReferenceError: require is not defined
v7.2.0 introduced the experimental runtimeAdapters option and, as part of it, replaced the driver’s static import of Node’s os module with a runtime require('os'). That works in a CommonJS build, but when the driver is bundled into ESM output (e.g. a Vite/esbuild/rollup server build with "type": "module"), there is no require in module scope, so constructing a client threw ReferenceError: require is not defined. The driver now loads the default os adapter through a dynamic import() that survives bundling, so new MongoClient() works in ESM bundles. CommonJS usage is unchanged, and supplying your own runtimeAdapters.os continues to work.
Bulk writes serialize each document only once
insertMany and bulkWrite previously processed each document twice - once to measure its size for batch splitting (a full recursive walk via calculateObjectSize) and again to serialize it into the command sent to the server. Documents are now serialized a single time and the resulting bytes are reused for both, decreasing the BSON-encoding CPU spent on bulk writes and reducing event-loop blocking during large batches. The improvement is most noticeable with high document counts and documents that have many fields.
Features
  • NODE-7546: add HTTP Proxy support for QE & CSFLE (#5007) (3366c21)
  • NODE-7547: bump minimum support server/wire versions to '4.4' & '9' respectively (#4994) (3d97028)
  • NODE-7624: support baseBackoffMS and update client backpressure backoff (#5020) (560837b)
Bug Fixes
  • NODE-7603: emit dynamic import('os') via tsconfig (#4992) (52f5e61)
Performance Improvements
... (truncated)
Changelog
Sourced from mongodb's changelog.
7.6.0 (2026-08-21)
Features
  • NODE-7546: add HTTP Proxy support for QE & CSFLE (#5007) (3366c21)
  • NODE-7547: bump minimum support server/wire versions to '4.4' & '9' respectively (#4994) (3d97028)
  • NODE-7624: support baseBackoffMS and update client backpressure backoff (#5020) (560837b)
Bug Fixes
  • NODE-7603: emit dynamic import('os') via tsconfig (#4992) (52f5e61)
Performance Improvements
  • NODE-7660: serialize bulk write documents a single time (#4999) (1217aa1)
Commits
  • 0fb2c13 chore(main): release 7.6.0 (#5001)
  • bb35ded docs: Add preliminary checks to release instructions (#5028)
  • 560837b feat(NODE-7624): support baseBackoffMS and update client backpressure backoff...
  • ce33c59 chore(NODE-7767): bson compat tests snappy fix (#5025)
  • 0f2ed29 chore(NODE-7770): add server 9.0 to the test matrix (#5024)
  • bc92c29 chore(NODE-7767): snappy 7.4 is incompatible in CI (#5021)
  • dce7939 chore(NODE-7759): pin bson-compat server (#5018)
  • 7f8edf3 chore: run bson compat tests against latest server (#5017)
  • 30c31e5 ci(deps): bump drivers-evergreen-tools from 3741fa9 to e86753e (#5016)
  • 3366c21 feat(NODE-7546): add HTTP Proxy support for QE & CSFLE (#5007)
  • Additional commits viewable in compare view

Updates @better-auth/core from 1.7.1 to 1.7.2
Release notes
Sourced from @​better-auth/core's releases.
v1.7.2
better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
For detailed changes, see CHANGELOG
@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)
For detailed changes, see CHANGELOG
@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)
For detailed changes, see CHANGELOG
@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
... (truncated)
Changelog
Sourced from @​better-auth/core's changelog.
1.7.2
Patch Changes
  • #10938557e19b Thanks @​bytaesu! - Added synchronous auth endpoint context access with getCurrentAuthEndpointContext and optional access with tryGetCurrentAuthEndpointContext. The existing getCurrentAuthContext and getCurrentAuthContextAsyncLocalStorage functions remain available as deprecated compatibility APIs.
  • #1085564da15b Thanks @​bytaesu! - Prevent async context loss in Cloudflare Workers bundles that enable multiple runtime conditions.
  • #10982b4ad5a1 Thanks @​bytaesu! - Built-in placeholder emails now consistently use the namespaced {identifier}@{namespace}.placeholder.invalid format.
  • #10979fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.
  • #10939e1d4011 Thanks @​bytaesu! - Logs emitted while handling auth requests now respect the configured custom logger, log level, and disabled setting.
Commits

Updates @better-auth/oauth-provider from 1.7.1 to 1.7.2
Release notes
Sourced from @​better-auth/oauth-provider's releases.
v1.7.2
better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
For detailed changes, see CHANGELOG
@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)
For detailed changes, see CHANGELOG
@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)
For detailed changes, see CHANGELOG
@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
... (truncated)
Changelog
Sourced from @​better-auth/oauth-provider's changelog.
1.7.2
Patch Changes
  • #11010bb8d7c4 Thanks @​bytaesu! - Client ID Metadata Document clients that declare a grant the server does not offer (such as Claude's enterprise jwt-bearer grant) can now register. Only documents sharing no grant with the server are refused.
  • #10979fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.
Commits

Updates @better-auth/scim from 1.7.1 to 1.7.2
Release notes
Sourced from @​better-auth/scim's releases.
v1.7.2
better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
For detailed changes, see CHANGELOG
@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)
For detailed changes, see CHANGELOG
@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)
For detailed changes, see CHANGELOG
@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
... (truncated)
Changelog
Sourced from @​better-auth/scim's changelog.
1.7.2
Commits

Updates @better-auth/sso from 1.7.1 to 1.7.2
Release notes
Sourced from @​better-auth/sso's releases.
v1.7.2
better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
For detailed changes, see CHANGELOG
@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)
For detailed changes, see CHANGELOG
@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)
For detailed changes, see CHANGELOG
@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
... (truncated)
Changelog
Sourced from @​better-auth/sso's changelog.
1.7.2
Patch Changes
  • #10979fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.
Commits

Updates @noble/hashes from 2.3.0 to 2.4.0
Release notes
Sourced from @​noble/hashes's releases.
2.4.0
Security and correctness
  • Protect passed options against mutation / pollution
  • keccakprg: fail until entropy is added
  • webcrypto: reject output sizes which crashed engine
  • blake3: fix tree merging for multi-terabyte streams
  • Improve zeroization
Misc
  • Speed-up Argon2 by 20%
  • Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
  • Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
  • nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.
Full Changelog: paulmillr/noble-hashes@2.3.0...2.4.0
Changelog
Sourced from @​noble/hashes's changelog.
2.4.0 (2026-08-27)
Security and correctness
  • Protect passed options against mutation / pollution
  • keccakprg: fail until entropy is added
  • webcrypto: reject output sizes which crashed engine
  • blake3: fix tree merging for multi-terabyte streams
  • Improve zeroization
Misc
  • Speed-up Argon2 by 20%
  • Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
  • Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
  • nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.
Commits

Updates better-auth from 1.7.1 to 1.7.2
Release notes
Sourced from better-auth's releases.
v1.7.2
better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
For detailed changes, see CHANGELOG
@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)
For detailed changes, see CHANGELOG
@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)
For detailed changes, see CHANGELOG
@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
... (truncated)
Changelog
Sourced from better-auth's changelog.
1.7.2
Patch Changes
  • #10875d5d889b Thanks @​bytaesu! - Fix programmatic migrations failing on Cloudflare D1 while preserving existing-index validation across supported databases.
  • #10982b4ad5a1 Thanks @​bytaesu! - Built-in placeholder emails now consistently use the namespaced {identifier}@{namespace}.placeholder.invalid format.
  • #10934c7a5c1a Thanks @​bytaesu! - Cookie-cache reads now warn when signed session data is invalid instead of silently appearing as a signed-out session.
  • #1087978f0c39 Thanks @​starslingdev! - Test suites using getTestInstance now run faster because the shared fixture avoids production password-hashing costs by default. Custom emailAndPassword.password implementations continue to take precedence.
  • #10823ce8a3ab Thanks @​sosyz! - Ensure permanently banning a user clears any expiration from a previous temporary ban.
  • #10907a021eaf Thanks @​heliohm! - A client created with more plugins is again assignable to a client type declaring fewer plugins, as in 1.6.
  • #10959c8dcfa5 Thanks @​bytaesu! - Allow same-origin form submissions from pages using Referrer-Policy: no-referrer while continuing to reject untrusted request origins.
  • #10979fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.
  • #10041f6891a2 Thanks @​GautamBytes! - Allow ~...

    Description has been truncated
@dependabot
chore(deps)(deps): Bump the production-dependencies group with 21 upd…
8daf8c1
…ates
Bumps the production-dependencies group with 21 updates:
| Package | From | To |
| --- | --- | --- |
| [@oclif/core](https://github.com/oclif/core) | `4.13.3` | `4.14.0` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `5.2.3` | `5.4.1` |
| [sql.js](https://github.com/sql-js/sql.js) | `1.14.1` | `1.14.2` |
| [mongodb](https://github.com/mongodb/node-mongodb-native) | `7.5.0` | `7.6.0` |
| [@better-auth/core](https://github.com/better-auth/better-auth/tree/HEAD/packages/core) | `1.7.1` | `1.7.2` |
| [@better-auth/oauth-provider](https://github.com/better-auth/better-auth/tree/HEAD/packages/oauth-provider) | `1.7.1` | `1.7.2` |
| [@better-auth/scim](https://github.com/better-auth/better-auth/tree/HEAD/packages/scim) | `1.7.1` | `1.7.2` |
| [@better-auth/sso](https://github.com/better-auth/better-auth/tree/HEAD/packages/sso) | `1.7.1` | `1.7.2` |
| [@noble/hashes](https://github.com/paulmillr/noble-hashes) | `2.3.0` | `2.4.0` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.1` | `1.7.2` |
| [jose](https://github.com/panva/jose) | `6.2.8` | `6.2.10` |
| [hono](https://github.com/honojs/hono) | `4.13.2` | `4.13.5` |
| [nodemailer](https://github.com/nodemailer/nodemailer) | `9.0.5` | `9.0.6` |
| [pinyin-pro](https://github.com/zh-lx/pinyin-pro/tree/HEAD/packages/pinyin-pro) | `3.29.1` | `3.29.3` |
| [@noble/ciphers](https://github.com/paulmillr/noble-ciphers) | `2.3.0` | `2.4.0` |
| [fumadocs-core](https://github.com/fuma-nama/fumadocs) | `16.14.4` | `16.15.4` |
| [fumadocs-mdx](https://github.com/fuma-nama/fumadocs) | `15.2.3` | `15.4.0` |
| [fumadocs-ui](https://github.com/fuma-nama/fumadocs) | `16.14.4` | `16.15.4` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.31.0` | `1.34.0` |
| [mermaid](https://github.com/mermaid-js/mermaid) | `11.16.1` | `11.17.2` |
| [next](https://github.com/vercel/next.js) | `16.3.1` | `16.3.3` |
Updates `@oclif/core` from 4.13.3 to 4.14.0
- [Release notes](https://github.com/oclif/core/releases)
- [Changelog](https://github.com/oclif/core/blob/main/CHANGELOG.md)
- [Commits](oclif/core@4.13.3...4.14.0)
Updates `js-yaml` from 5.2.3 to 5.4.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@5.2.3...5.4.1)
Updates `sql.js` from 1.14.1 to 1.14.2
- [Release notes](https://github.com/sql-js/sql.js/releases)
- [Commits](sql-js/sql.js@v1.14.1...v1.14.2)
Updates `mongodb` from 7.5.0 to 7.6.0
- [Release notes](https://github.com/mongodb/node-mongodb-native/releases)
- [Changelog](https://github.com/mongodb/node-mongodb-native/blob/main/HISTORY.md)
- [Commits](mongodb/node-mongodb-native@v7.5.0...v7.6.0)
Updates `@better-auth/core` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/core/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/core)
Updates `@better-auth/oauth-provider` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/oauth-provider/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/oauth-provider)
Updates `@better-auth/scim` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/scim/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/scim)
Updates `@better-auth/sso` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/sso/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/sso)
Updates `@noble/hashes` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/paulmillr/noble-hashes/releases)
- [Changelog](https://github.com/paulmillr/noble-hashes/blob/main/CHANGELOG.md)
- [Commits](paulmillr/noble-hashes@2.3.0...2.4.0)
Updates `better-auth` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/better-auth)
Updates `jose` from 6.2.8 to 6.2.10
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.8...v6.2.10)
Updates `hono` from 4.13.2 to 4.13.5
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.2...v4.13.5)
Updates `nodemailer` from 9.0.5 to 9.0.6
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v9.0.5...v9.0.6)
Updates `pinyin-pro` from 3.29.1 to 3.29.3
- [Release notes](https://github.com/zh-lx/pinyin-pro/releases)
- [Changelog](https://github.com/zh-lx/pinyin-pro/blob/main/CHANGELOG.md)
- [Commits](https://github.com/zh-lx/pinyin-pro/commits/3.29.3/packages/pinyin-pro)
Updates `@noble/ciphers` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/paulmillr/noble-ciphers/releases)
- [Changelog](https://github.com/paulmillr/noble-ciphers/blob/main/CHANGELOG.md)
- [Commits](paulmillr/noble-ciphers@2.3.0...2.4.0)
Updates `fumadocs-core` from 16.14.4 to 16.15.4
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs@16.14.4...fumadocs@16.15.4)
Updates `fumadocs-mdx` from 15.2.3 to 15.4.0
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs-mdx@15.2.3...fumadocs-mdx@15.4.0)
Updates `fumadocs-ui` from 16.14.4 to 16.15.4
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs@16.14.4...fumadocs@16.15.4)
Updates `lucide-react` from 1.31.0 to 1.34.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.34.0/packages/lucide-react)
Updates `mermaid` from 11.16.1 to 11.17.2
- [Release notes](https://github.com/mermaid-js/mermaid/releases)
- [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.16.1...mermaid@11.17.2)
Updates `next` from 16.3.1 to 16.3.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.3.1...v16.3.3)
---
updated-dependencies:
- dependency-name: "@oclif/core"
dependency-version: 4.14.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: js-yaml
dependency-version: 5.4.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: sql.js
dependency-version: 1.14.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: mongodb
dependency-version: 7.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: "@better-auth/core"
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@better-auth/oauth-provider"
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@better-auth/scim"
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@better-auth/sso"
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@noble/hashes"
dependency-version: 2.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: better-auth
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: jose
dependency-version: 6.2.10
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: hono
dependency-version: 4.13.5
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: nodemailer
dependency-version: 9.0.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: pinyin-pro
dependency-version: 3.29.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@noble/ciphers"
dependency-version: 2.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: fumadocs-core
dependency-version: 16.15.4
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: fumadocs-mdx
dependency-version: 15.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: fumadocs-ui
dependency-version: 16.15.4
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: lucide-react
dependency-version: 1.34.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: mermaid
dependency-version: 11.17.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: next
dependency-version: 16.3.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot
added

dependencies
Pull requests that update a dependency file
javascript
Pull requests that update javascript code
labels
Aug 31, 2026
@github-actions
github-actionsBot
commented
Aug 31, 2026

Copy link


Copy Markdown

Contributor
📓 Docs Drift Check
⚠️9 changed file(s) yielded no anchor (packages/cli/package.json, packages/drivers/driver-mongodb/package.json, packages/drivers/driver-sqlite-wasm/package.json, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 9 changed package(s)).
What this run could not see
  • 9 changed file(s) yielded no anchor (packages/cli/package.json, packages/drivers/driver-mongodb/package.json, packages/drivers/driver-sqlite-wasm/package.json, …) — pages documenting those are invisible to this run
  • a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
Coarse fallback — 46 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 9c120f0308d5aed3c26f53c406054a95a631d156 → packageMentionDocs.
@github-actionsgithub-actionsBot
added
the 
documentation
Improvements or additions to documentation
label
Aug 31, 2026
@huangyiirenehuangyiirene
mentioned this pull request
Aug 31, 2026

Closed

@os-samos-sam
closed this
Aug 31, 2026
@dependabot@github
dependabotBot
commented
on behalf of githubAug 31, 2026

Copy link


Copy Markdown

ContributorAuthor
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.
To ignore these dependencies, configure ignore rules in dependabot.yml
@dependabot
dependabotBot
deleted the

dependabot/npm_and_yarn/production-dependencies-6f36c788ab

branch
August 31, 2026 14:47
@os-samos-sam
mentioned this pull request
Aug 31, 2026

Closed

@claudeclaudeBot
mentioned this pull request
Aug 31, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency filedocumentationImprovements or additions to documentationjavascriptPull requests that update javascript codesize/s

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@os-sam

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(deps)(deps): Bump the production-dependencies group with 21 updates - #13589
Closed
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/npm_and_yarn/production-dependencies-6f36c788ab
Closed
chore(deps)(deps): Bump the production-dependencies group with 21 updates#13589
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/npm_and_yarn/production-dependencies-6f36c788ab
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubAug 31, 2026

Copy link


Copy Markdown

Contributor
Bumps the production-dependencies group with 21 updates:
PackageFromTo
@oclif/core4.13.34.14.0
js-yaml5.2.35.4.1
sql.js1.14.11.14.2
mongodb7.5.07.6.0
@better-auth/core1.7.11.7.2
@better-auth/oauth-provider1.7.11.7.2
@better-auth/scim1.7.11.7.2
@better-auth/sso1.7.11.7.2
@noble/hashes2.3.02.4.0
better-auth1.7.11.7.2
jose6.2.86.2.10
hono4.13.24.13.5
nodemailer9.0.59.0.6
pinyin-pro3.29.13.29.3
@noble/ciphers2.3.02.4.0
fumadocs-core16.14.416.15.4
fumadocs-mdx15.2.315.4.0
fumadocs-ui16.14.416.15.4
lucide-react1.31.01.34.0
mermaid11.16.111.17.2
next16.3.116.3.3
Updates @oclif/core from 4.13.3 to 4.14.0
Release notes
Sourced from @​oclif/core's releases.
4.14.0
Features
  • bumping to eslint v10 (W-23473845) (248de04)
4.13.5
Bug Fixes
  • replaced require with dynamic import (W-23807278) (d35e325)
4.13.4
Bug Fixes
  • resolved security vulnerability in powershell path (W-23807278) (911e9d2)
Changelog
Sourced from @​oclif/core's changelog.
4.14.0 (2026-08-19)
Features
  • bumping to eslint v10 (W-23473845) (248de04)
4.13.5 (2026-08-14)
Bug Fixes
  • replaced require with dynamic import (W-23807278) (d35e325)
4.13.4 (2026-08-14)
Bug Fixes
  • resolved security vulnerability in powershell path (W-23807278) (911e9d2)
Commits
  • 1d2903e chore(release): 4.14.0 [skip ci]
  • 45c7f0a Merge pull request #1635 from oclif/d/W-23473845
  • 395c8bc chore: prune stale eslint suppressions after merge
  • 35ddd2e chore: merge main into d/W-23473845
  • 0d01467 chore(release): 4.13.5 [skip ci]
  • 06949eb Merge pull request #1638 from oclif/d/W-23807278-2
  • d35e325 fix: replaced require with dynamic import (W-23807278)
  • 85370b7 chore(release): 4.13.4 [skip ci]
  • 3318c6e Merge pull request #1636 from oclif/d/W-23807278
  • 911e9d2 fix: resolved security vulnerability in powershell path (W-23807278)
  • Additional commits viewable in compare view

Updates js-yaml from 5.2.3 to 5.4.1
Changelog
Sourced from js-yaml's changelog.
[5.4.1] - 2026-08-26
Changed
  • Hard-limit merge sequence size to 100.
Security
  • Count empty mappings in merge sequences toward maxTotalMergeKeys to limit
CPU usage, #797.
[5.4.0] - 2026-08-25
Added
  • Added the scalarStyleRules dumper option to customize string formatting.
See Scalar styling for details.
Changed
  • [breaking] Flattened the low-level AST node style representation. Scalar
and collection nodes now use SCALAR_STYLE and COLLECTION_STYLE values;
explicit tags use the separate tagged property. Alias nodes now contain
only kind and anchor. This only affects code that directly constructs or
edits AST nodes.
  • [breaking] The sortKeys option was rewritten using AST mutation to avoid
side effects.
  • Reworked scalar style selection. This can change formatting without changing
loaded values; in particular, whitespace-only strings are now double-quoted.
Fixed
  • Accept a byte order mark at the start of each document in a stream, #791.
  • Produce valid flow mappings with quoteFlowKeys and flowSkipColonSpace,
including alias and property-only keys, #786.
  • Preserve empty scalar items when converting block sequences to flow style.
  • Do not apply the 1024-character simple-key limit to flow mapping keys.
  • Count Unicode code points, rather than UTF-16 code units, for the
1024-character simple-key limit.
  • Add an explicit document-end marker after keep-chomped block scalars when
needed to preserve trailing newlines.
[5.3.0] - 2026-08-14
This release focuses on reworking the documentation and making small
architectural improvements before moving forward.
Added
  • Added completely new documentation.
  • Exported DUMP_SCHEMA, the default schema used by the dumper.
  • Added YAMLException.throwAt() for throwing an error at a source position.
Changed
... (truncated)
Commits

Updates sql.js from 1.14.1 to 1.14.2
Commits
  • 9c4e167 ci: debug npm publish http log
  • 1d5db45 ci: use npm 11 for OIDC trusted publishing
  • c2c6909 debug: oidc env dump
  • 17159df debug: oidc
  • 7e943bd ci: publish to npm via OIDC trusted publishing
  • c11695f Bump version to 1.14.2
  • 5489808 fix: restore WASM stack in Database.exec to prevent stack leak (#631)
  • See full diff in compare view
Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for sql.js since your current version.

Updates mongodb from 7.5.0 to 7.6.0
Release notes
Sourced from mongodb's releases.
v7.6.0
7.6.0 (2026-08-21)
The MongoDB Node.js team is pleased to announce version 7.6.0 of the mongodb package!
Release Notes
Support for MongoDB 4.2 is removed
[!WARNING]
When the driver connects to a MongoDB server of version 4.2 or less, it will now throw an error.
HTTP proxy support for KMS requests in CSFLE and Queryable Encryption
In-use encryption can now route KMS requests through an HTTP proxy. Set kmsConnectCallback on your ClientEncryption or auto-encryption options to control how the driver connects to a KMS host. The callback receives the target host and port and returns a connected socket (for example, a tunnel
opened with HTTP CONNECT); the driver then performs the KMS TLS handshake over that socket using the provider's configured TLS options. This unblocks CSFLE and Queryable Encryption in environments that require an HTTP forward proxy for outbound KMS traffic, which the existing SOCKS5 proxyOptions does not cover.
constclientEncryption=newClientEncryption(keyVaultClient,{
keyVaultNamespace,
kmsProviders,// Establish the KMS connection through your HTTP proxy; the driver adds TLS.kmsConnectCallback: ({ host, port })=>connectThroughHttpProxy(host,port)});
Improved Intelligent Workload Management
Improved performance for MongoDB 9.0's Intelligent Workload Management (IWM) by only retrying overload errors when doing so is expected to not worsen server conditions
Bundling the driver into ESM no longer throws ReferenceError: require is not defined
v7.2.0 introduced the experimental runtimeAdapters option and, as part of it, replaced the driver’s static import of Node’s os module with a runtime require('os'). That works in a CommonJS build, but when the driver is bundled into ESM output (e.g. a Vite/esbuild/rollup server build with "type": "module"), there is no require in module scope, so constructing a client threw ReferenceError: require is not defined. The driver now loads the default os adapter through a dynamic import() that survives bundling, so new MongoClient() works in ESM bundles. CommonJS usage is unchanged, and supplying your own runtimeAdapters.os continues to work.
Bulk writes serialize each document only once
insertMany and bulkWrite previously processed each document twice - once to measure its size for batch splitting (a full recursive walk via calculateObjectSize) and again to serialize it into the command sent to the server. Documents are now serialized a single time and the resulting bytes are reused for both, decreasing the BSON-encoding CPU spent on bulk writes and reducing event-loop blocking during large batches. The improvement is most noticeable with high document counts and documents that have many fields.
Features
  • NODE-7546: add HTTP Proxy support for QE & CSFLE (#5007) (3366c21)
  • NODE-7547: bump minimum support server/wire versions to '4.4' & '9' respectively (#4994) (3d97028)
  • NODE-7624: support baseBackoffMS and update client backpressure backoff (#5020) (560837b)
Bug Fixes
  • NODE-7603: emit dynamic import('os') via tsconfig (#4992) (52f5e61)
Performance Improvements
... (truncated)
Changelog
Sourced from mongodb's changelog.
7.6.0 (2026-08-21)
Features
  • NODE-7546: add HTTP Proxy support for QE & CSFLE (#5007) (3366c21)
  • NODE-7547: bump minimum support server/wire versions to '4.4' & '9' respectively (#4994) (3d97028)
  • NODE-7624: support baseBackoffMS and update client backpressure backoff (#5020) (560837b)
Bug Fixes
  • NODE-7603: emit dynamic import('os') via tsconfig (#4992) (52f5e61)
Performance Improvements
  • NODE-7660: serialize bulk write documents a single time (#4999) (1217aa1)
Commits
  • 0fb2c13 chore(main): release 7.6.0 (#5001)
  • bb35ded docs: Add preliminary checks to release instructions (#5028)
  • 560837b feat(NODE-7624): support baseBackoffMS and update client backpressure backoff...
  • ce33c59 chore(NODE-7767): bson compat tests snappy fix (#5025)
  • 0f2ed29 chore(NODE-7770): add server 9.0 to the test matrix (#5024)
  • bc92c29 chore(NODE-7767): snappy 7.4 is incompatible in CI (#5021)
  • dce7939 chore(NODE-7759): pin bson-compat server (#5018)
  • 7f8edf3 chore: run bson compat tests against latest server (#5017)
  • 30c31e5 ci(deps): bump drivers-evergreen-tools from 3741fa9 to e86753e (#5016)
  • 3366c21 feat(NODE-7546): add HTTP Proxy support for QE & CSFLE (#5007)
  • Additional commits viewable in compare view

Updates @better-auth/core from 1.7.1 to 1.7.2
Release notes
Sourced from @​better-auth/core's releases.
v1.7.2
better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
For detailed changes, see CHANGELOG
@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)
For detailed changes, see CHANGELOG
@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)
For detailed changes, see CHANGELOG
@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
... (truncated)
Changelog
Sourced from @​better-auth/core's changelog.
1.7.2
Patch Changes
  • #10938557e19b Thanks @​bytaesu! - Added synchronous auth endpoint context access with getCurrentAuthEndpointContext and optional access with tryGetCurrentAuthEndpointContext. The existing getCurrentAuthContext and getCurrentAuthContextAsyncLocalStorage functions remain available as deprecated compatibility APIs.
  • #1085564da15b Thanks @​bytaesu! - Prevent async context loss in Cloudflare Workers bundles that enable multiple runtime conditions.
  • #10982b4ad5a1 Thanks @​bytaesu! - Built-in placeholder emails now consistently use the namespaced {identifier}@{namespace}.placeholder.invalid format.
  • #10979fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.
  • #10939e1d4011 Thanks @​bytaesu! - Logs emitted while handling auth requests now respect the configured custom logger, log level, and disabled setting.
Commits

Updates @better-auth/oauth-provider from 1.7.1 to 1.7.2
Release notes
Sourced from @​better-auth/oauth-provider's releases.
v1.7.2
better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
For detailed changes, see CHANGELOG
@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)
For detailed changes, see CHANGELOG
@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)
For detailed changes, see CHANGELOG
@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
... (truncated)
Changelog
Sourced from @​better-auth/oauth-provider's changelog.
1.7.2
Patch Changes
  • #11010bb8d7c4 Thanks @​bytaesu! - Client ID Metadata Document clients that declare a grant the server does not offer (such as Claude's enterprise jwt-bearer grant) can now register. Only documents sharing no grant with the server are refused.
  • #10979fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.
Commits

Updates @better-auth/scim from 1.7.1 to 1.7.2
Release notes
Sourced from @​better-auth/scim's releases.
v1.7.2
better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
For detailed changes, see CHANGELOG
@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)
For detailed changes, see CHANGELOG
@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)
For detailed changes, see CHANGELOG
@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
... (truncated)
Changelog
Sourced from @​better-auth/scim's changelog.
1.7.2
Commits

Updates @better-auth/sso from 1.7.1 to 1.7.2
Release notes
Sourced from @​better-auth/sso's releases.
v1.7.2
better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
For detailed changes, see CHANGELOG
@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)
For detailed changes, see CHANGELOG
@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)
For detailed changes, see CHANGELOG
@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
... (truncated)
Changelog
Sourced from @​better-auth/sso's changelog.
1.7.2
Patch Changes
  • #10979fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.
Commits

Updates @noble/hashes from 2.3.0 to 2.4.0
Release notes
Sourced from @​noble/hashes's releases.
2.4.0
Security and correctness
  • Protect passed options against mutation / pollution
  • keccakprg: fail until entropy is added
  • webcrypto: reject output sizes which crashed engine
  • blake3: fix tree merging for multi-terabyte streams
  • Improve zeroization
Misc
  • Speed-up Argon2 by 20%
  • Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
  • Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
  • nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.
Full Changelog: paulmillr/noble-hashes@2.3.0...2.4.0
Changelog
Sourced from @​noble/hashes's changelog.
2.4.0 (2026-08-27)
Security and correctness
  • Protect passed options against mutation / pollution
  • keccakprg: fail until entropy is added
  • webcrypto: reject output sizes which crashed engine
  • blake3: fix tree merging for multi-terabyte streams
  • Improve zeroization
Misc
  • Speed-up Argon2 by 20%
  • Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
  • Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
  • nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.
Commits

Updates better-auth from 1.7.1 to 1.7.2
Release notes
Sourced from better-auth's releases.
v1.7.2
better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
For detailed changes, see CHANGELOG
@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)
For detailed changes, see CHANGELOG
@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)
For detailed changes, see CHANGELOG
@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
... (truncated)
Changelog
Sourced from better-auth's changelog.
1.7.2
Patch Changes
  • #10875d5d889b Thanks @​bytaesu! - Fix programmatic migrations failing on Cloudflare D1 while preserving existing-index validation across supported databases.
  • #10982b4ad5a1 Thanks @​bytaesu! - Built-in placeholder emails now consistently use the namespaced {identifier}@{namespace}.placeholder.invalid format.
  • #10934c7a5c1a Thanks @​bytaesu! - Cookie-cache reads now warn when signed session data is invalid instead of silently appearing as a signed-out session.
  • #1087978f0c39 Thanks @​starslingdev! - Test suites using getTestInstance now run faster because the shared fixture avoids production password-hashing costs by default. Custom emailAndPassword.password implementations continue to take precedence.
  • #10823ce8a3ab Thanks @​sosyz! - Ensure permanently banning a user clears any expiration from a previous temporary ban.
  • #10907a021eaf Thanks @​heliohm! - A client created with more plugins is again assignable to a client type declaring fewer plugins, as in 1.6.
  • #10959c8dcfa5 Thanks @​bytaesu! - Allow same-origin form submissions from pages using Referrer-Policy: no-referrer while continuing to reject untrusted request origins.
  • #10979fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.
  • #10041f6891a2 Thanks @​GautamBytes! - Allow ~...

    Description has been truncated
@dependabot
chore(deps)(deps): Bump the production-dependencies group with 21 upd…
8daf8c1
…ates
Bumps the production-dependencies group with 21 updates:
| Package | From | To |
| --- | --- | --- |
| [@oclif/core](https://github.com/oclif/core) | `4.13.3` | `4.14.0` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `5.2.3` | `5.4.1` |
| [sql.js](https://github.com/sql-js/sql.js) | `1.14.1` | `1.14.2` |
| [mongodb](https://github.com/mongodb/node-mongodb-native) | `7.5.0` | `7.6.0` |
| [@better-auth/core](https://github.com/better-auth/better-auth/tree/HEAD/packages/core) | `1.7.1` | `1.7.2` |
| [@better-auth/oauth-provider](https://github.com/better-auth/better-auth/tree/HEAD/packages/oauth-provider) | `1.7.1` | `1.7.2` |
| [@better-auth/scim](https://github.com/better-auth/better-auth/tree/HEAD/packages/scim) | `1.7.1` | `1.7.2` |
| [@better-auth/sso](https://github.com/better-auth/better-auth/tree/HEAD/packages/sso) | `1.7.1` | `1.7.2` |
| [@noble/hashes](https://github.com/paulmillr/noble-hashes) | `2.3.0` | `2.4.0` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.1` | `1.7.2` |
| [jose](https://github.com/panva/jose) | `6.2.8` | `6.2.10` |
| [hono](https://github.com/honojs/hono) | `4.13.2` | `4.13.5` |
| [nodemailer](https://github.com/nodemailer/nodemailer) | `9.0.5` | `9.0.6` |
| [pinyin-pro](https://github.com/zh-lx/pinyin-pro/tree/HEAD/packages/pinyin-pro) | `3.29.1` | `3.29.3` |
| [@noble/ciphers](https://github.com/paulmillr/noble-ciphers) | `2.3.0` | `2.4.0` |
| [fumadocs-core](https://github.com/fuma-nama/fumadocs) | `16.14.4` | `16.15.4` |
| [fumadocs-mdx](https://github.com/fuma-nama/fumadocs) | `15.2.3` | `15.4.0` |
| [fumadocs-ui](https://github.com/fuma-nama/fumadocs) | `16.14.4` | `16.15.4` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.31.0` | `1.34.0` |
| [mermaid](https://github.com/mermaid-js/mermaid) | `11.16.1` | `11.17.2` |
| [next](https://github.com/vercel/next.js) | `16.3.1` | `16.3.3` |
Updates `@oclif/core` from 4.13.3 to 4.14.0
- [Release notes](https://github.com/oclif/core/releases)
- [Changelog](https://github.com/oclif/core/blob/main/CHANGELOG.md)
- [Commits](oclif/core@4.13.3...4.14.0)
Updates `js-yaml` from 5.2.3 to 5.4.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@5.2.3...5.4.1)
Updates `sql.js` from 1.14.1 to 1.14.2
- [Release notes](https://github.com/sql-js/sql.js/releases)
- [Commits](sql-js/sql.js@v1.14.1...v1.14.2)
Updates `mongodb` from 7.5.0 to 7.6.0
- [Release notes](https://github.com/mongodb/node-mongodb-native/releases)
- [Changelog](https://github.com/mongodb/node-mongodb-native/blob/main/HISTORY.md)
- [Commits](mongodb/node-mongodb-native@v7.5.0...v7.6.0)
Updates `@better-auth/core` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/core/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/core)
Updates `@better-auth/oauth-provider` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/oauth-provider/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/oauth-provider)
Updates `@better-auth/scim` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/scim/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/scim)
Updates `@better-auth/sso` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/sso/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/sso)
Updates `@noble/hashes` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/paulmillr/noble-hashes/releases)
- [Changelog](https://github.com/paulmillr/noble-hashes/blob/main/CHANGELOG.md)
- [Commits](paulmillr/noble-hashes@2.3.0...2.4.0)
Updates `better-auth` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/better-auth)
Updates `jose` from 6.2.8 to 6.2.10
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.8...v6.2.10)
Updates `hono` from 4.13.2 to 4.13.5
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.2...v4.13.5)
Updates `nodemailer` from 9.0.5 to 9.0.6
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v9.0.5...v9.0.6)
Updates `pinyin-pro` from 3.29.1 to 3.29.3
- [Release notes](https://github.com/zh-lx/pinyin-pro/releases)
- [Changelog](https://github.com/zh-lx/pinyin-pro/blob/main/CHANGELOG.md)
- [Commits](https://github.com/zh-lx/pinyin-pro/commits/3.29.3/packages/pinyin-pro)
Updates `@noble/ciphers` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/paulmillr/noble-ciphers/releases)
- [Changelog](https://github.com/paulmillr/noble-ciphers/blob/main/CHANGELOG.md)
- [Commits](paulmillr/noble-ciphers@2.3.0...2.4.0)
Updates `fumadocs-core` from 16.14.4 to 16.15.4
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs@16.14.4...fumadocs@16.15.4)
Updates `fumadocs-mdx` from 15.2.3 to 15.4.0
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs-mdx@15.2.3...fumadocs-mdx@15.4.0)
Updates `fumadocs-ui` from 16.14.4 to 16.15.4
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs@16.14.4...fumadocs@16.15.4)
Updates `lucide-react` from 1.31.0 to 1.34.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.34.0/packages/lucide-react)
Updates `mermaid` from 11.16.1 to 11.17.2
- [Release notes](https://github.com/mermaid-js/mermaid/releases)
- [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.16.1...mermaid@11.17.2)
Updates `next` from 16.3.1 to 16.3.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.3.1...v16.3.3)
---
updated-dependencies:
- dependency-name: "@oclif/core"
dependency-version: 4.14.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: js-yaml
dependency-version: 5.4.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: sql.js
dependency-version: 1.14.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: mongodb
dependency-version: 7.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: "@better-auth/core"
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@better-auth/oauth-provider"
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@better-auth/scim"
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@better-auth/sso"
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@noble/hashes"
dependency-version: 2.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: better-auth
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: jose
dependency-version: 6.2.10
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: hono
dependency-version: 4.13.5
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: nodemailer
dependency-version: 9.0.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: pinyin-pro
dependency-version: 3.29.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@noble/ciphers"
dependency-version: 2.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: fumadocs-core
dependency-version: 16.15.4
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: fumadocs-mdx
dependency-version: 15.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: fumadocs-ui
dependency-version: 16.15.4
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: lucide-react
dependency-version: 1.34.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: mermaid
dependency-version: 11.17.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: next
dependency-version: 16.3.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot
added

dependencies
Pull requests that update a dependency file
javascript
Pull requests that update javascript code
labels
Aug 31, 2026
@github-actions
github-actionsBot
commented
Aug 31, 2026

Copy link


Copy Markdown

Contributor
📓 Docs Drift Check
⚠️9 changed file(s) yielded no anchor (packages/cli/package.json, packages/drivers/driver-mongodb/package.json, packages/drivers/driver-sqlite-wasm/package.json, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 9 changed package(s)).
What this run could not see
  • 9 changed file(s) yielded no anchor (packages/cli/package.json, packages/drivers/driver-mongodb/package.json, packages/drivers/driver-sqlite-wasm/package.json, …) — pages documenting those are invisible to this run
  • a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
Coarse fallback — 46 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 9c120f0308d5aed3c26f53c406054a95a631d156 → packageMentionDocs.
@github-actionsgithub-actionsBot
added
the 
documentation
Improvements or additions to documentation
label
Aug 31, 2026
@huangyiirenehuangyiirene
mentioned this pull request
Aug 31, 2026

Closed

@os-samos-sam
closed this
Aug 31, 2026
@dependabot@github
dependabotBot
commented
on behalf of githubAug 31, 2026

Copy link


Copy Markdown

ContributorAuthor
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.
To ignore these dependencies, configure ignore rules in dependabot.yml
@dependabot
dependabotBot
deleted the

dependabot/npm_and_yarn/production-dependencies-6f36c788ab

branch
August 31, 2026 14:47
@os-samos-sam
mentioned this pull request
Aug 31, 2026

Closed

@claudeclaudeBot
mentioned this pull request
Aug 31, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency filedocumentationImprovements or additions to documentationjavascriptPull requests that update javascript codesize/s

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@os-sam

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
chore(deps)(deps): Bump the production-dependencies group with 21 updates - #13589
Closed
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/npm_and_yarn/production-dependencies-6f36c788ab
Closed
chore(deps)(deps): Bump the production-dependencies group with 21 updates#13589
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/npm_and_yarn/production-dependencies-6f36c788ab
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubAug 31, 2026

Copy link


Copy Markdown

Contributor
Bumps the production-dependencies group with 21 updates:
PackageFromTo
@oclif/core4.13.34.14.0
js-yaml5.2.35.4.1
sql.js1.14.11.14.2
mongodb7.5.07.6.0
@better-auth/core1.7.11.7.2
@better-auth/oauth-provider1.7.11.7.2
@better-auth/scim1.7.11.7.2
@better-auth/sso1.7.11.7.2
@noble/hashes2.3.02.4.0
better-auth1.7.11.7.2
jose6.2.86.2.10
hono4.13.24.13.5
nodemailer9.0.59.0.6
pinyin-pro3.29.13.29.3
@noble/ciphers2.3.02.4.0
fumadocs-core16.14.416.15.4
fumadocs-mdx15.2.315.4.0
fumadocs-ui16.14.416.15.4
lucide-react1.31.01.34.0
mermaid11.16.111.17.2
next16.3.116.3.3
Updates @oclif/core from 4.13.3 to 4.14.0
Release notes
Sourced from @​oclif/core's releases.
4.14.0
Features
  • bumping to eslint v10 (W-23473845) (248de04)
4.13.5
Bug Fixes
  • replaced require with dynamic import (W-23807278) (d35e325)
4.13.4
Bug Fixes
  • resolved security vulnerability in powershell path (W-23807278) (911e9d2)
Changelog
Sourced from @​oclif/core's changelog.
4.14.0 (2026-08-19)
Features
  • bumping to eslint v10 (W-23473845) (248de04)
4.13.5 (2026-08-14)
Bug Fixes
  • replaced require with dynamic import (W-23807278) (d35e325)
4.13.4 (2026-08-14)
Bug Fixes
  • resolved security vulnerability in powershell path (W-23807278) (911e9d2)
Commits
  • 1d2903e chore(release): 4.14.0 [skip ci]
  • 45c7f0a Merge pull request #1635 from oclif/d/W-23473845
  • 395c8bc chore: prune stale eslint suppressions after merge
  • 35ddd2e chore: merge main into d/W-23473845
  • 0d01467 chore(release): 4.13.5 [skip ci]
  • 06949eb Merge pull request #1638 from oclif/d/W-23807278-2
  • d35e325 fix: replaced require with dynamic import (W-23807278)
  • 85370b7 chore(release): 4.13.4 [skip ci]
  • 3318c6e Merge pull request #1636 from oclif/d/W-23807278
  • 911e9d2 fix: resolved security vulnerability in powershell path (W-23807278)
  • Additional commits viewable in compare view

Updates js-yaml from 5.2.3 to 5.4.1
Changelog
Sourced from js-yaml's changelog.
[5.4.1] - 2026-08-26
Changed
  • Hard-limit merge sequence size to 100.
Security
  • Count empty mappings in merge sequences toward maxTotalMergeKeys to limit
CPU usage, #797.
[5.4.0] - 2026-08-25
Added
  • Added the scalarStyleRules dumper option to customize string formatting.
See Scalar styling for details.
Changed
  • [breaking] Flattened the low-level AST node style representation. Scalar
and collection nodes now use SCALAR_STYLE and COLLECTION_STYLE values;
explicit tags use the separate tagged property. Alias nodes now contain
only kind and anchor. This only affects code that directly constructs or
edits AST nodes.
  • [breaking] The sortKeys option was rewritten using AST mutation to avoid
side effects.
  • Reworked scalar style selection. This can change formatting without changing
loaded values; in particular, whitespace-only strings are now double-quoted.
Fixed
  • Accept a byte order mark at the start of each document in a stream, #791.
  • Produce valid flow mappings with quoteFlowKeys and flowSkipColonSpace,
including alias and property-only keys, #786.
  • Preserve empty scalar items when converting block sequences to flow style.
  • Do not apply the 1024-character simple-key limit to flow mapping keys.
  • Count Unicode code points, rather than UTF-16 code units, for the
1024-character simple-key limit.
  • Add an explicit document-end marker after keep-chomped block scalars when
needed to preserve trailing newlines.
[5.3.0] - 2026-08-14
This release focuses on reworking the documentation and making small
architectural improvements before moving forward.
Added
  • Added completely new documentation.
  • Exported DUMP_SCHEMA, the default schema used by the dumper.
  • Added YAMLException.throwAt() for throwing an error at a source position.
Changed
... (truncated)
Commits

Updates sql.js from 1.14.1 to 1.14.2
Commits
  • 9c4e167 ci: debug npm publish http log
  • 1d5db45 ci: use npm 11 for OIDC trusted publishing
  • c2c6909 debug: oidc env dump
  • 17159df debug: oidc
  • 7e943bd ci: publish to npm via OIDC trusted publishing
  • c11695f Bump version to 1.14.2
  • 5489808 fix: restore WASM stack in Database.exec to prevent stack leak (#631)
  • See full diff in compare view
Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for sql.js since your current version.

Updates mongodb from 7.5.0 to 7.6.0
Release notes
Sourced from mongodb's releases.
v7.6.0
7.6.0 (2026-08-21)
The MongoDB Node.js team is pleased to announce version 7.6.0 of the mongodb package!
Release Notes
Support for MongoDB 4.2 is removed
[!WARNING]
When the driver connects to a MongoDB server of version 4.2 or less, it will now throw an error.
HTTP proxy support for KMS requests in CSFLE and Queryable Encryption
In-use encryption can now route KMS requests through an HTTP proxy. Set kmsConnectCallback on your ClientEncryption or auto-encryption options to control how the driver connects to a KMS host. The callback receives the target host and port and returns a connected socket (for example, a tunnel
opened with HTTP CONNECT); the driver then performs the KMS TLS handshake over that socket using the provider's configured TLS options. This unblocks CSFLE and Queryable Encryption in environments that require an HTTP forward proxy for outbound KMS traffic, which the existing SOCKS5 proxyOptions does not cover.
constclientEncryption=newClientEncryption(keyVaultClient,{
keyVaultNamespace,
kmsProviders,// Establish the KMS connection through your HTTP proxy; the driver adds TLS.kmsConnectCallback: ({ host, port })=>connectThroughHttpProxy(host,port)});
Improved Intelligent Workload Management
Improved performance for MongoDB 9.0's Intelligent Workload Management (IWM) by only retrying overload errors when doing so is expected to not worsen server conditions
Bundling the driver into ESM no longer throws ReferenceError: require is not defined
v7.2.0 introduced the experimental runtimeAdapters option and, as part of it, replaced the driver’s static import of Node’s os module with a runtime require('os'). That works in a CommonJS build, but when the driver is bundled into ESM output (e.g. a Vite/esbuild/rollup server build with "type": "module"), there is no require in module scope, so constructing a client threw ReferenceError: require is not defined. The driver now loads the default os adapter through a dynamic import() that survives bundling, so new MongoClient() works in ESM bundles. CommonJS usage is unchanged, and supplying your own runtimeAdapters.os continues to work.
Bulk writes serialize each document only once
insertMany and bulkWrite previously processed each document twice - once to measure its size for batch splitting (a full recursive walk via calculateObjectSize) and again to serialize it into the command sent to the server. Documents are now serialized a single time and the resulting bytes are reused for both, decreasing the BSON-encoding CPU spent on bulk writes and reducing event-loop blocking during large batches. The improvement is most noticeable with high document counts and documents that have many fields.
Features
  • NODE-7546: add HTTP Proxy support for QE & CSFLE (#5007) (3366c21)
  • NODE-7547: bump minimum support server/wire versions to '4.4' & '9' respectively (#4994) (3d97028)
  • NODE-7624: support baseBackoffMS and update client backpressure backoff (#5020) (560837b)
Bug Fixes
  • NODE-7603: emit dynamic import('os') via tsconfig (#4992) (52f5e61)
Performance Improvements
... (truncated)
Changelog
Sourced from mongodb's changelog.
7.6.0 (2026-08-21)
Features
  • NODE-7546: add HTTP Proxy support for QE & CSFLE (#5007) (3366c21)
  • NODE-7547: bump minimum support server/wire versions to '4.4' & '9' respectively (#4994) (3d97028)
  • NODE-7624: support baseBackoffMS and update client backpressure backoff (#5020) (560837b)
Bug Fixes
  • NODE-7603: emit dynamic import('os') via tsconfig (#4992) (52f5e61)
Performance Improvements
  • NODE-7660: serialize bulk write documents a single time (#4999) (1217aa1)
Commits
  • 0fb2c13 chore(main): release 7.6.0 (#5001)
  • bb35ded docs: Add preliminary checks to release instructions (#5028)
  • 560837b feat(NODE-7624): support baseBackoffMS and update client backpressure backoff...
  • ce33c59 chore(NODE-7767): bson compat tests snappy fix (#5025)
  • 0f2ed29 chore(NODE-7770): add server 9.0 to the test matrix (#5024)
  • bc92c29 chore(NODE-7767): snappy 7.4 is incompatible in CI (#5021)
  • dce7939 chore(NODE-7759): pin bson-compat server (#5018)
  • 7f8edf3 chore: run bson compat tests against latest server (#5017)
  • 30c31e5 ci(deps): bump drivers-evergreen-tools from 3741fa9 to e86753e (#5016)
  • 3366c21 feat(NODE-7546): add HTTP Proxy support for QE & CSFLE (#5007)
  • Additional commits viewable in compare view

Updates @better-auth/core from 1.7.1 to 1.7.2
Release notes
Sourced from @​better-auth/core's releases.
v1.7.2
better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
For detailed changes, see CHANGELOG
@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)
For detailed changes, see CHANGELOG
@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)
For detailed changes, see CHANGELOG
@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
... (truncated)
Changelog
Sourced from @​better-auth/core's changelog.
1.7.2
Patch Changes
  • #10938557e19b Thanks @​bytaesu! - Added synchronous auth endpoint context access with getCurrentAuthEndpointContext and optional access with tryGetCurrentAuthEndpointContext. The existing getCurrentAuthContext and getCurrentAuthContextAsyncLocalStorage functions remain available as deprecated compatibility APIs.
  • #1085564da15b Thanks @​bytaesu! - Prevent async context loss in Cloudflare Workers bundles that enable multiple runtime conditions.
  • #10982b4ad5a1 Thanks @​bytaesu! - Built-in placeholder emails now consistently use the namespaced {identifier}@{namespace}.placeholder.invalid format.
  • #10979fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.
  • #10939e1d4011 Thanks @​bytaesu! - Logs emitted while handling auth requests now respect the configured custom logger, log level, and disabled setting.
Commits

Updates @better-auth/oauth-provider from 1.7.1 to 1.7.2
Release notes
Sourced from @​better-auth/oauth-provider's releases.
v1.7.2
better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
For detailed changes, see CHANGELOG
@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)
For detailed changes, see CHANGELOG
@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)
For detailed changes, see CHANGELOG
@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
... (truncated)
Changelog
Sourced from @​better-auth/oauth-provider's changelog.
1.7.2
Patch Changes
  • #11010bb8d7c4 Thanks @​bytaesu! - Client ID Metadata Document clients that declare a grant the server does not offer (such as Claude's enterprise jwt-bearer grant) can now register. Only documents sharing no grant with the server are refused.
  • #10979fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.
Commits

Updates @better-auth/scim from 1.7.1 to 1.7.2
Release notes
Sourced from @​better-auth/scim's releases.
v1.7.2
better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
For detailed changes, see CHANGELOG
@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)
For detailed changes, see CHANGELOG
@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)
For detailed changes, see CHANGELOG
@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
... (truncated)
Changelog
Sourced from @​better-auth/scim's changelog.
1.7.2
Commits

Updates @better-auth/sso from 1.7.1 to 1.7.2
Release notes
Sourced from @​better-auth/sso's releases.
v1.7.2
better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
For detailed changes, see CHANGELOG
@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)
For detailed changes, see CHANGELOG
@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)
For detailed changes, see CHANGELOG
@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
... (truncated)
Changelog
Sourced from @​better-auth/sso's changelog.
1.7.2
Patch Changes
  • #10979fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.
Commits

Updates @noble/hashes from 2.3.0 to 2.4.0
Release notes
Sourced from @​noble/hashes's releases.
2.4.0
Security and correctness
  • Protect passed options against mutation / pollution
  • keccakprg: fail until entropy is added
  • webcrypto: reject output sizes which crashed engine
  • blake3: fix tree merging for multi-terabyte streams
  • Improve zeroization
Misc
  • Speed-up Argon2 by 20%
  • Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
  • Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
  • nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.
Full Changelog: paulmillr/noble-hashes@2.3.0...2.4.0
Changelog
Sourced from @​noble/hashes's changelog.
2.4.0 (2026-08-27)
Security and correctness
  • Protect passed options against mutation / pollution
  • keccakprg: fail until entropy is added
  • webcrypto: reject output sizes which crashed engine
  • blake3: fix tree merging for multi-terabyte streams
  • Improve zeroization
Misc
  • Speed-up Argon2 by 20%
  • Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
  • Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
  • nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.
Commits

Updates better-auth from 1.7.1 to 1.7.2
Release notes
Sourced from better-auth's releases.
v1.7.2
better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
For detailed changes, see CHANGELOG
@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)
For detailed changes, see CHANGELOG
@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)
For detailed changes, see CHANGELOG
@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
... (truncated)
Changelog
Sourced from better-auth's changelog.
1.7.2
Patch Changes
  • #10875d5d889b Thanks @​bytaesu! - Fix programmatic migrations failing on Cloudflare D1 while preserving existing-index validation across supported databases.
  • #10982b4ad5a1 Thanks @​bytaesu! - Built-in placeholder emails now consistently use the namespaced {identifier}@{namespace}.placeholder.invalid format.
  • #10934c7a5c1a Thanks @​bytaesu! - Cookie-cache reads now warn when signed session data is invalid instead of silently appearing as a signed-out session.
  • #1087978f0c39 Thanks @​starslingdev! - Test suites using getTestInstance now run faster because the shared fixture avoids production password-hashing costs by default. Custom emailAndPassword.password implementations continue to take precedence.
  • #10823ce8a3ab Thanks @​sosyz! - Ensure permanently banning a user clears any expiration from a previous temporary ban.
  • #10907a021eaf Thanks @​heliohm! - A client created with more plugins is again assignable to a client type declaring fewer plugins, as in 1.6.
  • #10959c8dcfa5 Thanks @​bytaesu! - Allow same-origin form submissions from pages using Referrer-Policy: no-referrer while continuing to reject untrusted request origins.
  • #10979fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.
  • #10041f6891a2 Thanks @​GautamBytes! - Allow ~...

    Description has been truncated
@dependabot
chore(deps)(deps): Bump the production-dependencies group with 21 upd…
8daf8c1
…ates
Bumps the production-dependencies group with 21 updates:
| Package | From | To |
| --- | --- | --- |
| [@oclif/core](https://github.com/oclif/core) | `4.13.3` | `4.14.0` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `5.2.3` | `5.4.1` |
| [sql.js](https://github.com/sql-js/sql.js) | `1.14.1` | `1.14.2` |
| [mongodb](https://github.com/mongodb/node-mongodb-native) | `7.5.0` | `7.6.0` |
| [@better-auth/core](https://github.com/better-auth/better-auth/tree/HEAD/packages/core) | `1.7.1` | `1.7.2` |
| [@better-auth/oauth-provider](https://github.com/better-auth/better-auth/tree/HEAD/packages/oauth-provider) | `1.7.1` | `1.7.2` |
| [@better-auth/scim](https://github.com/better-auth/better-auth/tree/HEAD/packages/scim) | `1.7.1` | `1.7.2` |
| [@better-auth/sso](https://github.com/better-auth/better-auth/tree/HEAD/packages/sso) | `1.7.1` | `1.7.2` |
| [@noble/hashes](https://github.com/paulmillr/noble-hashes) | `2.3.0` | `2.4.0` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.1` | `1.7.2` |
| [jose](https://github.com/panva/jose) | `6.2.8` | `6.2.10` |
| [hono](https://github.com/honojs/hono) | `4.13.2` | `4.13.5` |
| [nodemailer](https://github.com/nodemailer/nodemailer) | `9.0.5` | `9.0.6` |
| [pinyin-pro](https://github.com/zh-lx/pinyin-pro/tree/HEAD/packages/pinyin-pro) | `3.29.1` | `3.29.3` |
| [@noble/ciphers](https://github.com/paulmillr/noble-ciphers) | `2.3.0` | `2.4.0` |
| [fumadocs-core](https://github.com/fuma-nama/fumadocs) | `16.14.4` | `16.15.4` |
| [fumadocs-mdx](https://github.com/fuma-nama/fumadocs) | `15.2.3` | `15.4.0` |
| [fumadocs-ui](https://github.com/fuma-nama/fumadocs) | `16.14.4` | `16.15.4` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.31.0` | `1.34.0` |
| [mermaid](https://github.com/mermaid-js/mermaid) | `11.16.1` | `11.17.2` |
| [next](https://github.com/vercel/next.js) | `16.3.1` | `16.3.3` |
Updates `@oclif/core` from 4.13.3 to 4.14.0
- [Release notes](https://github.com/oclif/core/releases)
- [Changelog](https://github.com/oclif/core/blob/main/CHANGELOG.md)
- [Commits](oclif/core@4.13.3...4.14.0)
Updates `js-yaml` from 5.2.3 to 5.4.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@5.2.3...5.4.1)
Updates `sql.js` from 1.14.1 to 1.14.2
- [Release notes](https://github.com/sql-js/sql.js/releases)
- [Commits](sql-js/sql.js@v1.14.1...v1.14.2)
Updates `mongodb` from 7.5.0 to 7.6.0
- [Release notes](https://github.com/mongodb/node-mongodb-native/releases)
- [Changelog](https://github.com/mongodb/node-mongodb-native/blob/main/HISTORY.md)
- [Commits](mongodb/node-mongodb-native@v7.5.0...v7.6.0)
Updates `@better-auth/core` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/core/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/core)
Updates `@better-auth/oauth-provider` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/oauth-provider/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/oauth-provider)
Updates `@better-auth/scim` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/scim/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/scim)
Updates `@better-auth/sso` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/sso/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/sso)
Updates `@noble/hashes` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/paulmillr/noble-hashes/releases)
- [Changelog](https://github.com/paulmillr/noble-hashes/blob/main/CHANGELOG.md)
- [Commits](paulmillr/noble-hashes@2.3.0...2.4.0)
Updates `better-auth` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/better-auth)
Updates `jose` from 6.2.8 to 6.2.10
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.8...v6.2.10)
Updates `hono` from 4.13.2 to 4.13.5
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.2...v4.13.5)
Updates `nodemailer` from 9.0.5 to 9.0.6
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v9.0.5...v9.0.6)
Updates `pinyin-pro` from 3.29.1 to 3.29.3
- [Release notes](https://github.com/zh-lx/pinyin-pro/releases)
- [Changelog](https://github.com/zh-lx/pinyin-pro/blob/main/CHANGELOG.md)
- [Commits](https://github.com/zh-lx/pinyin-pro/commits/3.29.3/packages/pinyin-pro)
Updates `@noble/ciphers` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/paulmillr/noble-ciphers/releases)
- [Changelog](https://github.com/paulmillr/noble-ciphers/blob/main/CHANGELOG.md)
- [Commits](paulmillr/noble-ciphers@2.3.0...2.4.0)
Updates `fumadocs-core` from 16.14.4 to 16.15.4
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs@16.14.4...fumadocs@16.15.4)
Updates `fumadocs-mdx` from 15.2.3 to 15.4.0
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs-mdx@15.2.3...fumadocs-mdx@15.4.0)
Updates `fumadocs-ui` from 16.14.4 to 16.15.4
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs@16.14.4...fumadocs@16.15.4)
Updates `lucide-react` from 1.31.0 to 1.34.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.34.0/packages/lucide-react)
Updates `mermaid` from 11.16.1 to 11.17.2
- [Release notes](https://github.com/mermaid-js/mermaid/releases)
- [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.16.1...mermaid@11.17.2)
Updates `next` from 16.3.1 to 16.3.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.3.1...v16.3.3)
---
updated-dependencies:
- dependency-name: "@oclif/core"
dependency-version: 4.14.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: js-yaml
dependency-version: 5.4.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: sql.js
dependency-version: 1.14.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: mongodb
dependency-version: 7.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: "@better-auth/core"
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@better-auth/oauth-provider"
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@better-auth/scim"
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@better-auth/sso"
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@noble/hashes"
dependency-version: 2.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: better-auth
dependency-version: 1.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: jose
dependency-version: 6.2.10
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: hono
dependency-version: 4.13.5
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: nodemailer
dependency-version: 9.0.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: pinyin-pro
dependency-version: 3.29.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@noble/ciphers"
dependency-version: 2.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: fumadocs-core
dependency-version: 16.15.4
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: fumadocs-mdx
dependency-version: 15.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: fumadocs-ui
dependency-version: 16.15.4
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: lucide-react
dependency-version: 1.34.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: mermaid
dependency-version: 11.17.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: next
dependency-version: 16.3.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot
added

dependencies
Pull requests that update a dependency file
javascript
Pull requests that update javascript code
labels
Aug 31, 2026
@github-actions
github-actionsBot
commented
Aug 31, 2026

Copy link


Copy Markdown

Contributor
📓 Docs Drift Check
⚠️9 changed file(s) yielded no anchor (packages/cli/package.json, packages/drivers/driver-mongodb/package.json, packages/drivers/driver-sqlite-wasm/package.json, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 9 changed package(s)).
What this run could not see
  • 9 changed file(s) yielded no anchor (packages/cli/package.json, packages/drivers/driver-mongodb/package.json, packages/drivers/driver-sqlite-wasm/package.json, …) — pages documenting those are invisible to this run
  • a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
Coarse fallback — 46 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 9c120f0308d5aed3c26f53c406054a95a631d156 → packageMentionDocs.
@github-actionsgithub-actionsBot
added
the 
documentation
Improvements or additions to documentation
label
Aug 31, 2026
@huangyiirenehuangyiirene
mentioned this pull request
Aug 31, 2026

Closed

@os-samos-sam
closed this
Aug 31, 2026
@dependabot@github
dependabotBot
commented
on behalf of githubAug 31, 2026

Copy link


Copy Markdown

ContributorAuthor
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.
To ignore these dependencies, configure ignore rules in dependabot.yml
@dependabot
dependabotBot
deleted the

dependabot/npm_and_yarn/production-dependencies-6f36c788ab

branch
August 31, 2026 14:47
@os-samos-sam
mentioned this pull request
Aug 31, 2026

Closed

@claudeclaudeBot
mentioned this pull request
Aug 31, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency filedocumentationImprovements or additions to documentationjavascriptPull requests that update javascript codesize/s

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@os-sam