build(deps): refresh compatible workspace and CodeQL dependencies

[steipete]

What Problem This Solves

Compatible dependency updates were spread across three bot PRs. This consolidates #123, #125, and #126 into one update and keeps the Better Auth schema generator on the same version as the runtime.

User Impact

Developers and operators get compatible library and tooling updates. The Node.js floor, package versions, security overrides, and two-day dependency cooldown are preserved.

Why This Change Was Made

Updates include Better Auth 1.7.7, Hono 4.13.12, TanStack Query 5.104.1, Biome 2.5.15, Vite 8.3.2, Cloudflare's Vitest plugin 1.3.6, Workers types, Wrangler 4.147.0, Node types, and the CodeQL 4.38.2 pin. The Node.js floor, package versions, security overrides, and two-day dependency cooldown are preserved.

Vitest 5 (#118) was closed because the current Cloudflare plugin requires Vitest 4 and the proposed upgrade fails to start the Worker suite. jsdom 30 (#117) was closed because its Node.js requirement excludes the declared 22.22.0 floor. Neither major is included.

Evidence

Validation passed on one AWS Crabbox lease with Node 24.19.0 and pnpm 11.28.0: frozen install, lint, typecheck, all 276 tests (6 script, 37 core, 33 React, 72 CLI, 128 Worker), dashboard/demo/CLI builds, docs build, and packed SDK verification. The lockfile was generated by pnpm and passed its supply-chain policy checks. Local actionlint and independent Codex review through P2 passed. Existing CSS warnings, synthetic test-secret warnings, and non-failing Worker DNS diagnostics remain.

The first remote setup attempt failed because Corepack could not write global shims; using a task-owned shim directory resolved it. No application gate was skipped. Exact-head CI and CodeQL passed at 03b8715678352deef9e1d4919b0ad30859d2fb3b. This PR awaits the required code-owner approval from the requested reviewers.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: blocked before merge. Reviewed October 7, 2026, 3:46 PM ET / 19:46 UTC (Revision 3).

ClawSweeper review

What this changes

Refreshes workspace libraries, development tools, and pinned CodeQL actions while aligning the Better Auth schema generator with its runtime.

Merge readiness

⛔ Blocked before merge - 3 items remain

This consolidation remains useful and is absent from pinned main. The unchanged head still leaves the earlier authentication upgrade concerns unresolved; passing CI does not establish compatibility with existing authentication state.

Priority: P2
Reviewed head: 03b8715678352deef9e1d4919b0ad30859d2fb3b

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The focused refresh has strong supplemental validation, but authentication upgrade evidence and operator guidance remain incomplete.
Proof confidence	🦐 gold shrimp (3/6)	Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.
Evidence reviewed	11 items	Pinned introduced change: The verified base-to-head delta changes eight files: dependency manifests, their lockfile, two CodeQL pins, and an Unreleased changelog entry. Better Auth and its schema generator move from 1.6.33 to 1.7.7; SDK versions, Node floor, dependency cooldown, security overrides, and workflow permissions remain unchanged. Still necessary on main: Pinned main retains Better Auth 1.6.33, Hono 4.13.9, and the older development dependencies. The supplied latest release, sdk-v0.0.1, also predates these updates; its API manifest contains Better Auth 1.6.25. No merged replacement is established. Release comparison: Read the API manifest at sdk-v0.0.1 and confirmed that the supplied release does not include this refresh.
Findings	None	None.
Security	None	None.

How this fits together

Workspace dependencies support Krillswitch’s dashboard, Cloudflare Worker, and development tooling. Better Auth receives GitHub sign-in callbacks and D1 authentication records, then supplies sessions used by management authorization; public flag evaluation remains separate.

flowchart TD
  A[Workspace dependency pins] --> B[Dashboard and Worker builds]
  C[GitHub sign-in callback] --> D[Worker authentication]
  E[D1 accounts and verification state] --> D
  D --> F[Session and role checks]
  F --> G[Management API]
  H[SDK evaluation requests] --> B

Loading

Before merge

• Resolve merge risk (P1) - Sign-ins started under Better Auth 1.6.33 cannot complete after the update; deployments participating in the same authentication flow or sharing verification storage need coordinated cutover and documented restart guidance.
• Resolve merge risk (P1) - Compatibility with existing D1 accounts and sessions remains unverified; fresh-suite validation does not establish upgraded-state behavior or successful recovery from an interrupted GitHub sign-in.
• Complete next step (P2) - Document the Better Auth cutover scope and tell operators to restart sign-ins begun before the upgrade.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Authentication version alignment	Runtime and schema generator: 1.6.33 → 1.7.7	Both execution paths move together, while upstream changes the persisted OAuth state contract.

Root-cause cluster

Relationship: canonical
Canonical: #127
Summary: This PR is the explicit consolidation of three closed dependency proposals; the excluded major upgrades are distinct compatibility work.

Members:

• superseded: build(deps): bump the actions group across 1 directory with 2 updates #123 - Closed unmerged after its CodeQL update was consolidated here.
• superseded: build(deps): bump the production group across 1 directory with 3 updates #125 - Closed unmerged after its production dependency updates were consolidated here.
• superseded: build(deps-dev): bump the development group across 1 directory with 6 updates #126 - Closed unmerged after its development dependency updates were consolidated here.
• adjacent_distinct: build(deps-dev): bump jsdom from 29.1.1 to 30.1.1 #117 - The jsdom major upgrade is excluded to preserve the declared Node floor.
• adjacent_distinct: build(deps-dev): bump vitest from 4.1.11 to 5.0.3 #118 - The Vitest major upgrade is excluded because the Worker testing plugin requires Vitest 4.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge-risk options

Maintainer options:

1. Verify and explain the authentication upgrade (recommended)
   Provide fresh and upgraded D1 authentication evidence and document the coordinated cutover and sign-in restart requirement before landing the refresh.

Technical review

Best possible solution:

Retain the security update with verified existing-state compatibility and a clear deployment guide explaining coordinated cutover and restarting interrupted sign-ins.

Do we have a high-confidence way to reproduce the issue?

Yes, source provides a high-confidence path for the upgrade interruption: start GitHub sign-in under 1.6.33, then process its callback under 1.7.7, whose database lookup requires the new state prefix. This review did not execute that scenario.

Is this the best way to solve the issue?

Yes, consolidating the compatible updates and aligning the auth generator is a focused approach. Preserve the upstream security boundary and address its upgrade implications rather than restoring acceptance of legacy state.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 7be7204292c9.

Labels

Label changes:

No label changes.

Label justifications:

• P2: This is a bounded dependency refresh with an authentication upgrade requirement, without an established urgent target-runtime failure.
• merge-risk: 🚨 compatibility: The Better Auth update invalidates pending sign-in state and requires coordinated deployment; existing-state compatibility is not yet demonstrated.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.

Evidence

What I checked:

• Pinned introduced change: The verified base-to-head delta changes eight files: dependency manifests, their lockfile, two CodeQL pins, and an Unreleased changelog entry. Better Auth and its schema generator move from 1.6.33 to 1.7.7; SDK versions, Node floor, dependency cooldown, security overrides, and workflow permissions remain unchanged. (apps/api/package.json:22, 03b871567835)
• Still necessary on main: Pinned main retains Better Auth 1.6.33, Hono 4.13.9, and the older development dependencies. The supplied latest release, sdk-v0.0.1, also predates these updates; its API manifest contains Better Auth 1.6.25. No merged replacement is established. (apps/api/package.json:22, 7be7204292c9)
• Release comparison: Read the API manifest at sdk-v0.0.1 and confirmed that the supplied release does not include this refresh. (apps/api/package.json:22, 031f919ec4dd)
• Applicable dependency and storage boundary: The runtime directly imports Better Auth and its Drizzle adapter, binds them to D1 and the tracked authentication schema, and configures GitHub OAuth. No alternative state-storage strategy is configured. This establishes that Better Auth’s state and upgrade contracts apply. (apps/api/src/auth/auth.ts:43, 03b871567835)
• Verified upstream upgrade contract: The pinned 1.7.7 changelog requires restarting pending OAuth sign-ins and coordinated upgrades for nodes participating in the same authentication flow or verification storage. It explicitly removes compatibility with prior state formats. The 1.7.3 notes restore compatibility with 1.6 account schemas, so an account migration should not be invented solely for this update. (packages/better-auth/CHANGELOG.md:15, b96aefb4afcb)
• Persisted state and rejection boundary: Database-backed OAuth state is written and looked up using the new auth-state: identifier prefix. Parsing checks the signed state cookie and expiration. The OAuth callback calls state parsing before exchanging the authorization code or creating an authenticated account/session; inspected source does not establish an introduced authorization bypass. (packages/better-auth/src/state.ts, b96aefb4afcb)

Likely related people:

• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• jesse-merhi: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Record fresh and upgraded D1 behavior for existing accounts and sessions, rejection of old pending OAuth callbacks, and successful restarted GitHub sign-in.
• Document coordinated deployment and restarting sign-ins interrupted by the Better Auth update.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (2 earlier review cycles)

• reviewed 2026-10-07T03:45:38.986Z sha 03b8715 :: blocked before merge. :: none
• reviewed 2026-10-07T03:53:40.120Z sha 03b8715 :: blocked before merge. :: none

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​cloudflare/​vitest-plugin@​1.3.0 ⏵ 1.3.6	+1		+1	+1
	@​types/​node@​26.6.3 ⏵ 26.6.4			+1	+1
	vite@​8.3.1 ⏵ 8.3.2
	better-auth@​1.6.33 ⏵ 1.7.7
	@​tanstack/​react-query@​5.104.0 ⏵ 5.104.1
	wrangler@​4.142.0 ⏵ 4.147.0				+1
	@​cloudflare/​workers-types@​5.20260928.1 ⏵ 5.20261003.1			+1
	hono@​4.13.9 ⏵ 4.13.12	+1
	@​biomejs/​biome@​2.5.14 ⏵ 2.5.15	+1		+1

View full report

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: build(deps): refresh compatible workspace and CodeQL dependencies This is item 1/1 in the current shard. Shard 0/1.

This temporary status tracks the active review worker. The completed review will appear in the durable ClawSweeper review comment.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.