Skip to content

chore(deps): update all non-major dependencies - #3944

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#3944
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@modelcontextprotocol/sdk (source) 1.29.0 → 1.30.0 age confidence
@solidjs/router 0.16.2 → 0.16.3 age confidence
@storybook/addon-a11y (source) 10.5.3 → 10.5.5 age confidence
@storybook/addon-links (source) 10.5.3 → 10.5.5 age confidence
@storybook/addon-vitest (source) 10.5.3 → 10.5.5 age confidence
@storybook/react-vite (source) 10.5.3 → 10.5.5 age confidence
@storybook/svelte (source) 10.5.3 → 10.5.5 age confidence
@storybook/sveltekit (source) 10.5.3 → 10.5.5 age confidence
@storybook/vue3-vite (source) 10.5.3 → 10.5.5 age confidence
@types/node (source) 26.1.1 → 26.1.2 age confidence
better-auth (source) 1.4.18 → 1.6.25 age confidence
effect (source) 3.21.4 → 3.22.0 age confidence
fs-extra 11.3.6 → 11.4.0 age confidence
lucide-react (source) 1.26.0 → 1.27.0 age confidence
lucide-solid (source) 1.26.0 → 1.27.0 age confidence
next (source) 15.5.21 → 15.5.22 age confidence
nuxt (source) 4.5.0 → 4.5.1 age confidence
react-hook-form (source) 7.82.0 → 7.83.0 age confidence
storybook (source) 10.5.3 → 10.5.5 age confidence
svelte (source) 5.56.7 → 5.56.8 age confidence
svelte-check 4.7.3 → 4.7.4 age confidence
vite-plugin-solid 2.11.13 → 2.11.14 age confidence

Release Notes

modelcontextprotocol/typescript-sdk (@​modelcontextprotocol/sdk)

v1.30.0

Compare Source

solidjs/solid-router (@​solidjs/router)

v0.16.3

Patch Changes
  • 31501fd: Add opt-in explicit scroll restoration for back/forward navigation: <Router scrollRestoration> (#​577). The browser's native same-document heuristic loses the saved offset when the destination route forces a layout while the document is still short — any component that measures itself on mount is enough to trigger it. When enabled the router sets history.scrollRestoration = "manual", captures positions continuously keyed by the history entry depth it already tracks, persists them across reloads, and restores after the navigation settles — retrying as the document grows if the target offset isn't reachable yet, cancelled by the first user scroll. Off by default on 0.x; no behavior changes unless enabled.
storybookjs/storybook (@​storybook/addon-a11y)

v10.5.5

Compare Source

v10.5.4

Compare Source

storybookjs/storybook (@​storybook/addon-links)

v10.5.5

Compare Source

v10.5.4

Compare Source

better-auth/better-auth (better-auth)

v1.6.25

Compare Source

Patch Changes

v1.6.24

Compare Source

Patch Changes

  • #​10235 03dc5a0 Thanks @​ping-maxwell! - Fixes silent foreign-key and adapter-join misrouting when a user remaps a built-in model name to a string that collides with another schema key

  • #​10357 7508940 Thanks @​c-nicol! - Fixes Kysely migration generation for new-table fields that are both unique: true and index: true.

  • #​10342 bae7198 Thanks @​ping-maxwell! - Fix organization.listMembers failing with "User not found for member" for orgs with more than ~100 members by applying the same membership limit to the users query.

  • #​10336 ef4d273 Thanks @​Tushar-Khandelwal-2004! - Prevent verification callbacks from failing auth requests when cloning the request throws.

  • #​10333 99dbdd7 Thanks @​c-nicol! - Fixes Drizzle schema generation for fields that are both unique: true and index: true.

  • #​10368 086ca91 Thanks @​gaurav0107! - Force-validate the request Origin on the magic-link (/sign-in/magic-link) and email-otp (/email-otp/send-verification-otp) send endpoints, including cookieless requests, to match the built-in /sign-in/email and /sign-up/email routes. A cookieless cross-origin POST can no longer trigger a magic-link or verification-OTP email to an arbitrary address. Cookieless requests that carry no Origin (server-to-server) are unaffected.

  • #​10290 8f2dedd Thanks @​GautamBytes! - Expose the remote MCP auth client's 401 challenge headers to browser clients using CORS.

  • #​10453 4e685ee Thanks @​ping-maxwell! - OpenAPI now includes user.additionalFields and plugin user schema fields (e.g. username plugin username / displayUsername) on /sign-up/email and /update-user request bodies.

  • #​10190 3bf0e49 Thanks @​gaurav-init! - Pass the endpoint context as the second argument to beforeDeleteOrganization and afterDeleteOrganization hooks in the organization plugin, matching the signature shown in the docs and the existing databaseHooks pattern. The Stripe plugin's beforeDeleteOrganization wrapper now forwards the context to user-supplied hooks instead of dropping it.

  • #​10040 f59a0ee Thanks @​shiminshen! - Organization invitations now let the database generate their id when ID generation is delegated to the database (e.g. advanced.database.generateId: "uuid" with a UUID-capable adapter such as Postgres), matching every other model. Previously createInvitation always generated the invitation id in application code, so invitation rows received an app-generated value instead of a database-generated one while organizations, members and teams correctly deferred to the database (better-auth/better-auth#10024). A caller-provided id (e.g. via beforeCreateInvitation) is still honored.

  • #​10302 0f2cc1b Thanks @​momomuchu! - Prefer exact schema-key matches over modelName aliases in getDefaultModelName, so remapping a built-in table onto another table's schema key (e.g. user.modelName = "account") does not reroute internal adapter queries to the wrong table.

  • #​9787 ae78109 Thanks @​ping-maxwell! - Fixes an issue where useSession({ throw: true }) incorrectly excluded null from its data type.

  • #​10222 46d2bf0 Thanks @​ping-maxwell! - fix: add no-store cache-control headers to get-session route

  • #​10316 29a373e Thanks @​vinay-oppuri! - Recognize SQLite BIGINT as a valid number type in migration diffs so database-backed rate limiter columns like lastRequest no longer report spurious pending changes on every run.

  • #​10379 f6d18fa Thanks @​ping-maxwell! - fix(client): restore auth query revalidation and signal listeners after remount

  • #​5753 f23ce50 Thanks @​ping-maxwell! - feat(last-login-method): beforeStoreCookie option for GDPR compliance

  • #​10376 c4d1dda Thanks @​ping-maxwell! - Pass the request endpoint context as a third argument to verifyIdToken, so custom ID token verifiers can read request headers (for example Apple's user-agent requirement).

  • Updated dependencies [6758231, 54fab08, c4d1dda]:

v1.6.23

Compare Source

Patch Changes

v1.6.22

Compare Source

Patch Changes

  • #​10239 c06a56d Thanks @​gustavovalverde! - Magic-link and email-OTP sign-in now reset the credentials on an account whose email had never been confirmed. When verification resolves to such an account, any existing password on it is removed and its sessions are revoked before the user is signed in, so proven control of the mailbox is the source of truth for the account.

    If you signed up with email and password but first signed in through a magic link or email OTP rather than confirming the verification email, your password is cleared and you will need to set a new one through password reset.

  • #​10240 3a035e9 Thanks @​gustavovalverde! - Add account-level lockout for two-factor verification. The attempt limit applies per account across sign-in challenges and across factors: TOTP, email-OTP, and backup codes share one counter, and a successful verification resets it.

    Enabled by default: an account locks for 15 minutes after 10 consecutive failed verifications, and locked attempts return 429 with the ACCOUNT_TEMPORARILY_LOCKED error code. Configure it with twoFactor({ accountLockout: { enabled, maxFailedAttempts, durationSeconds } }).

    Run a database migration after upgrading: this adds failedVerificationCount and lockedUntil columns to the twoFactor table.

  • Updated dependencies [8bd43d9]:

v1.6.21

Compare Source

Patch Changes

  • #​10212 e0762a1 Thanks @​bytaesu! - In root-mounted deployments, requests whose path does not start with the configured basePath now return 404 instead of resolving to an endpoint.

  • #​10187 882cf9e Thanks @​ping-maxwell! - Admin permission changes and bans now take effect immediately for admin APIs, even when session cookie cache is enabled. Sensitive session checks also continue to work in stateless apps where signed cookies are the session record.

  • #​9939 f52e1ab Thanks @​benpsnyder! - fixes a bug causing deviceAuthorization() throwing a ZodError at construction when called without a schema option

  • #​10196 b5bec19 Thanks @​Paola3stefania! - OAuth sign-up and account-link profile sync now ignore provider profile values for user fields marked input: false. Input-allowed additional fields still persist from mapProfileToUser, and schema defaults still apply when OAuth creates a user. Apps that used mapProfileToUser to fill input: false fields should set those fields in server-side provisioning code instead.

  • #​10197 816d7f9 Thanks @​Paola3stefania! - Google sign-in now accepts hd: "*" to allow any Google Workspace hosted domain while still rejecting tokens with no hosted-domain claim.

    Google One Tap now applies the configured Google hosted-domain restriction before creating a session.

  • #​10192 239bcc8 Thanks @​bytaesu! - Validate PayPal user info against the verified ID token subject during social sign-in.

  • #​10228 1bc370a Thanks @​gustavovalverde! - The SIWE plugin no longer binds a provided email that already belongs to another account. With anonymous set to false, /siwe/verify previously created the new account using that email even when it was already in use; it now keeps the wallet-derived address in that case, so one email cannot be attached to two accounts.

  • #​10198 570267c Thanks @​rachit367! - Honor disableMigration on plugin schema tables. Tables flagged with disableMigration: true are now skipped by better-auth generate (Drizzle and Prisma output) and by the runtime migrator, instead of being emitted and created anyway. The flag was previously dropped while assembling the table list, so it had no effect.

  • #​10182 461ca6f Thanks @​bytaesu! - Only store display username fallbacks as usernames when they pass username validation during email sign-up.

  • #​10183 88409b0 Thanks @​bytaesu! - Require OAuth proxy profile callbacks to match an issued OAuth state before creating sessions.

  • #​10203 5953157 Thanks @​bytaesu! - Rate limiting no longer trusts multi-hop X-Forwarded-For chains, preventing a client behind an appending proxy from spoofing the leftmost hop to bypass the per-IP rate limit. Single-value IP headers continue to work. To key the real client behind a proxy chain, set advanced.ipAddress.trustedProxies to your reverse-proxy IPs or CIDR ranges (the chain is walked right to left, skipping trusted hops), or point advanced.ipAddress.ipAddressHeaders at a single trusted client-IP header.

  • #​10191 b046f9e Thanks @​bytaesu! - Rate limit client requests before plugin request handlers run.

  • #​10210 ae647b4 Thanks @​gustavovalverde! - Two-factor verification now locks out after five wrong codes per sign-in challenge for TOTP and backup codes. Once the limit is reached the challenge is rejected with TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE, and a new sign-in is required to try again.

    During a rolling deploy, two-factor challenges issued by the previous version may prompt the user to sign in again; this clears once the deploy completes.

  • Updated dependencies [90d509e, 816d7f9, 570267c, 5953157]:

v1.6.20

Compare Source

Patch Changes

v1.6.19

Compare Source

Patch Changes

  • #​10088 de4aa52 Thanks @​bytaesu! - Session and account cache cookies near the browser's per-cookie size limit (for example with a long cookiePrefix or many cached fields) are now split into chunks instead of being silently dropped by the browser. A cache too large to fit even when chunked is skipped with a warning rather than failing the request, so reads fall back to the database.

  • #​9995 b4b0266 Thanks @​ElGauchooooo! - The device authorization plugin now accepts an optional user_id when issuing a device code via /device/code, pre-binding the code to that user. Only the bound user can approve or deny the code, so a publicly visible user code can no longer be claimed by someone else.

  • #​10086 5bd5e1c Thanks @​gustavovalverde! - Refresh-token rotation and token revocation, two-factor backup-code regeneration, device-code claiming, and organization invitation acceptance now work on Prisma. Concurrent or repeat requests in these flows could previously return an error on Prisma instead of the expected result.

    On MongoDB servers older than 5.0, these flows and other guarded value updates (rate-limit window resets, API-key refills) no longer fail with an empty-update error.

    @better-auth/core: incrementOne now reports a clear error when called with no increment and no set.

  • #​9319 581f827 Thanks @​ping-maxwell! - fix(last-login-method): include domain when clearing cross-subdomain cookies

  • #​10067 8407885 Thanks @​bytaesu! - The oauth-popup plugin now ignores internal OAuth state fields passed through its additionalData parameter, so additionalData only ever carries your own custom values.

  • #​9555 c1a8a64 Thanks @​ChrisMGeo! - Fix invalid OpenAPI output for Better Auth callback, session, and passkey routes so client generators can consume the schema.

  • #​10071 635f190 Thanks @​gustavovalverde! - Auth clients exported from wrapper packages can now be emitted in TypeScript declaration builds without extra type annotations.

  • #​10070 a787e0b Thanks @​gustavovalverde! - Single-use verification flows no longer hang on database adapters that use a one-connection pool. This fixes magic-link verification and similar token checks in connection-limited serverless database setups.

  • #​9348 c2f718f Thanks @​ping-maxwell! - fix: cookie cache fallback lookup

  • #​8863 7d18175 Thanks @​ping-maxwell! - sendVerificationEmail was invoked via runInBackgroundOrAwait, which could defer work when advanced.backgroundTasks.handler is configured (so the handler could return 200 before the email callback finished) and, in the default path, caught and logged errors without rethrowing. User callbacks that throw APIError (e.g. 429 from a rate limiter) were therefore not reliably reflected in the HTTP response (better-auth/better-auth#8757).

    Now we await sendVerificationEmailFn so failures surface to the client with the correct status. The unauthenticated /send-verification-email path enforces a constant-time floor (500 ms) so that the response duration does not reveal whether the email belongs to a real unverified user.

  • Updated dependencies [0895993, 5bd5e1c, a787e0b]:

v1.6.18

Compare Source

Patch Changes

v1.6.17

Compare Source

Patch Changes

  • #​9993 baeaa00 Thanks @​gustavovalverde! - When a team had a single open slot, accepting an invitation into it was wrongly rejected as over the member limit and left a dangling membership record. Two invitations accepted into a nearly-full team at the same time could also push it past its limit. Both are fixed.

  • #​9482 3e99e6c Thanks @​bytaesu! - admin.setUserPassword now creates a credential account when the target user does not have one, matching the behavior of resetPassword. Previously the call returned status: true without doing anything for users without an existing credential account (e.g., social-only or magic-link signups), so admins migrating users from another auth system or assigning an initial password to a social-only user can now do so directly without poking the account table.

  • 96c78c3 Thanks @​GautamBytes! - Downgrade expected auth validation failures from error logs to warnings.

  • #​9993 baeaa00 Thanks @​gustavovalverde! - Captcha provider verification requests now time out after 10 seconds and fail closed, so a slow or unreachable captcha provider can no longer tie up a request indefinitely.

  • #​9993 baeaa00 Thanks @​gustavovalverde! - A delete-account confirmation link can no longer delete the account more than once when its callback is opened concurrently.

  • #​9991 0c3856f Thanks @​gustavovalverde! - Completing account deletion through /delete-user/callback now fails when the session has been revoked server-side, instead of proceeding within the cookie-cache window. Deployments that keep sessions only in the cookie are unaffected.

  • #​9993 baeaa00 Thanks @​gustavovalverde! - Polling for a device-authorization token can no longer redeem the same approved device code more than once when several polls arrive together.

  • #​9993 baeaa00 Thanks @​gustavovalverde! - Submitting the same email OTP from several requests at once can no longer sign in more than once or gain extra tries beyond the attempt limit.

  • #​10002 ed7b6c9 Thanks @​gustavovalverde! - Adding a member to a team that is already at its maximumMembersPerTeam limit is now rejected on every path. addMember with a teamId and add-team-member previously skipped the limit that invitation acceptance enforced, so they could push a team over its cap. A rejected addMember no longer creates the organization member.

  • #​9677 e0a768c Thanks @​GautamBytes! - Refactor role.authorize control flow while preserving existing authorization behavior.

  • #​9987 7343284 Thanks @​bytaesu! - Generic OAuth sign-in works again for providers whose userinfo response has no sub or id field when mapProfileToUser derives the account id. An empty id field now falls back to sub.

  • #​9991 0c3856f Thanks @​gustavovalverde! - getCookieCache now returns null for an expired session instead of the stale session data. Middleware that calls it to gate access no longer treats an expired signed cookie as a live session.

  • #​9993 baeaa00 Thanks @​gustavovalverde! - The Have I Been Pwned plugin now checks submitted passwords against the breach database on more password-setting endpoints by default, including the email-OTP and phone-number reset-password routes and the admin create-user and set-user-password routes. A breached password can no longer be set through those routes when the plugin is enabled with its default paths.

  • #​9987 7343284 Thanks @​bytaesu! - Preserve the fresh account cookie issued while switching users in the same browser instead of expiring it from stale request cookie state.

  • #​9991 0c3856f Thanks @​gustavovalverde! - Expired MCP access tokens are no longer accepted. A protected MCP resource now rejects a bearer token once it has expired, both on the server and through the remote client. A refresh token is accepted only when the original authorization included the offline_access scope.

  • #​9991 0c3856f Thanks @​gustavovalverde! - The multi-session set-active and revoke endpoints now act only on the session the caller holds a signed cookie for. A request could previously activate or revoke a different session by naming its token in the request body without holding that session's cookie.

  • #​9890 d9c526b Thanks @​bytaesu! - Add an experimental oauthPopup plugin (with oauthPopupClient and signIn.popup) for popup-based OAuth sign-in. It lets an app sign in inside a cross-site iframe by completing OAuth in a popup and handing the session token back to the opener, where the bearer plugin authenticates with it. The API may change while it is experimental.

  • [#​9991](https://redirect.github.com/better-auth/bette

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@vercel

vercel Bot commented Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
ark-docs Error Error Jul 27, 2026 9:58pm

Request Review

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 67fb828 to 7156ce5 Compare July 27, 2026 11:04
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 7156ce5 to 69fbe54 Compare July 27, 2026 17:29
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 69fbe54 to 4f6a36d Compare July 27, 2026 21:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants