Skip to content

chore(deps): bump the production group across 1 directory with 6 updates - #93

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-ca2fd710d1
Closed

chore(deps): bump the production group across 1 directory with 6 updates#93
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-ca2fd710d1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production group with 6 updates in the / directory:

Package From To
@tanstack/react-query 5.102.4 5.102.8
react-router 8.3.0 8.3.1
better-auth 1.6.30 1.7.2
hono 4.13.5 4.13.7
jose 6.2.10 6.2.12
zod 4.4.3 4.5.4

Updates @tanstack/react-query from 5.102.4 to 5.102.8

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.102.8

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.102.8
    • @​tanstack/react-query@​5.102.8

@​tanstack/react-query-next-experimental@​5.102.8

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.102.8

@​tanstack/react-query-persist-client@​5.102.8

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.102.8
    • @​tanstack/react-query@​5.102.8

@​tanstack/react-query@​5.102.8

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.102.8

@​tanstack/react-query-devtools@​5.102.7

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.102.7
    • @​tanstack/react-query@​5.102.7

@​tanstack/react-query-next-experimental@​5.102.7

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.102.7

@​tanstack/react-query-persist-client@​5.102.7

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.102.7
    • @​tanstack/react-query@​5.102.7

@​tanstack/react-query@​5.102.7

Patch Changes

  • Updated dependencies []:

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.102.8

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.102.8

5.102.7

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.102.7

5.102.6

Patch Changes

  • #11305 ac2b612 - fix(react-query): throw falsy errors from useQueries and useSuspenseQueries to the error boundary

  • Updated dependencies []:

    • @​tanstack/query-core@​5.102.6

5.102.5

Patch Changes

  • Updated dependencies [578e5c2]:
    • @​tanstack/query-core@​5.102.5
Commits

Updates react-router from 8.3.0 to 8.3.1

Release notes

Sourced from react-router's releases.

v8.3.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v831

Changelog

Sourced from react-router's changelog.

v8.3.1

Patch Changes

  • Fix Expected fetcher: <key> error thrown on navigation when a fetcher is aborted during its post-action revalidation (#15365)
  • Fix lazy route discovery caching a path as discovered when the triggering navigation was aborted after the manifest response settled but before the route tree was patched, which permanently (for the session) shadowed the real route behind a catch-all or produced 404s on every subsequent visit (#15399)
  • Improve route matching performance for long paths (#15417)
  • Improve validation of action request origins (#15419)
  • Fix <ScrollRestoration> leaving history.scrollRestoration set to "auto" after a bfcache restore, which let the browser restore scroll on subsequent history traversals before the destination route had rendered (#15397)
  • Properly respect the relative option in useSubmit/fetcher.submit when resolivng the action path (#15400)
  • Add additional URL validation on client side navigations/redirects (#15445)
Commits
  • da2a0f0 Release v8.3.1 (#15368)
  • 917e6fd fix(fog-of-war): don't cache aborted lazy route discoveries as discovered (#1...
  • 2e0bf72 Validate client-side navigation targets (#15445)
  • f45d4ca Revert "fix: normalize control characters in relative URLs (#15416)" (#15442)
  • c091832 fix: validate schemeful action origins (#15419)
  • 308d206 fix: improve matching perf (#15417)
  • 36bdbeb fix: normalize control characters in relative URLs (#15416)
  • 801e2ae fix(react-router): re-enable manual scroll restoration after a bfcache restor...
  • 5e98140 fix: honor the relative option in useSubmit and fetcher.submit (#15400)
  • 5843d38 refactor(router): use definite assignment assertions in createDeferred (#15396)
  • Additional commits viewable in compare view

Updates better-auth from 1.6.30 to 1.7.2

Release notes

Sourced from better-auth's releases.

v1.7.2

better-auth

Bug Fixes

  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.2

Patch Changes

  • #10875 d5d889b Thanks @​bytaesu! - Fix programmatic migrations failing on Cloudflare D1 while preserving existing-index validation across supported databases.

  • #10982 b4ad5a1 Thanks @​bytaesu! - Built-in placeholder emails now consistently use the namespaced {identifier}@{namespace}.placeholder.invalid format.

  • #10934 c7a5c1a Thanks @​bytaesu! - Cookie-cache reads now warn when signed session data is invalid instead of silently appearing as a signed-out session.

  • #10879 78f0c39 Thanks @​starslingdev! - Test suites using getTestInstance now run faster because the shared fixture avoids production password-hashing costs by default. Custom emailAndPassword.password implementations continue to take precedence.

  • #10823 ce8a3ab Thanks @​sosyz! - Ensure permanently banning a user clears any expiration from a previous temporary ban.

  • #10907 a021eaf Thanks @​heliohm! - A client created with more plugins is again assignable to a client type declaring fewer plugins, as in 1.6.

  • #10959 c8dcfa5 Thanks @​bytaesu! - Allow same-origin form submissions from pages using Referrer-Policy: no-referrer while continuing to reject untrusted request origins.

  • #10979 fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.

  • #10041 f6891a2 Thanks @​GautamBytes! - Allow ~ in relative callback URLs validated by trusted origin checks.

  • #10877 649818a Thanks @​bytaesu! - Prevent disabled MyISAM indexes from satisfying migration index checks.

  • Updated dependencies [557e19b, 64da15b, d5d889b, b4ad5a1, ea77118, 5aea9f7, fced1a5, e1d4011]:

    • @​better-auth/core@​1.7.2
    • @​better-auth/kysely-adapter@​1.7.2
    • @​better-auth/drizzle-adapter@​1.7.2
    • @​better-auth/memory-adapter@​1.7.2
    • @​better-auth/mongo-adapter@​1.7.2
    • @​better-auth/prisma-adapter@​1.7.2
    • @​better-auth/telemetry@​1.7.2

1.7.1

Patch Changes

  • #10863 845bbd1 Thanks @​gustavovalverde! - auth migrate no longer attempts to add a required column with no default value to a table that already has rows. It stops with an error naming the column and the backfill to run first. Previously the generated statement failed on SQLite, Postgres, and SQL Server; on MySQL it filled the new column with an empty string for every existing row and reported success. If auth migrate already ran against a MySQL database on 1.7, run the check in the upgrade guide's account identity section.

    getMigrations throws the new UnsafeMigrationError (exported from better-auth/db/migration) for this refusal, so callers can distinguish it from other migration errors such as an index-definition conflict.

    auth generate still emits the statements for external migration tooling, with a comment banner naming any column that needs a manual backfill first.

    A required field whose database column is still nullable logs a warning instead of blocking the migration.

    A CLI command that fails now prints its error and exits with a non-zero code instead of an unhandled promise rejection.

  • Updated dependencies []:

    • @​better-auth/core@​1.7.1
    • @​better-auth/drizzle-adapter@​1.7.1

... (truncated)

Commits
  • ba12fcd chore: release v1.7.2 (#10870)
  • 79904f0 fix(origin-check): support fragments in relative redirect URLs (#10983)
  • c8dcfa5 fix(origin-check): validate null origins using fetch metadata (#10959)
  • e1d4011 fix(logger): respect configured logger in auth request context (#10939)
  • 557e19b refactor(context): clarify auth endpoint context access (#10938)
  • b4ad5a1 refactor: centralize placeholder email generation (#10982)
  • fced1a5 fix(origin-check): improve relative callback URL validation (#10979)
  • f6891a2 fix(origin-check): allow tilde in relative callback URLs (#10041)
  • ce8a3ab fix(admin): ban without a duration should clear the previous expiration (#10823)
  • a021eaf fix(client): a client with more plugins fits a narrower client type again (#1...
  • Additional commits viewable in compare view

Updates hono from 4.13.5 to 4.13.7

Release notes

Sourced from hono's releases.

v4.13.7

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

What's Changed

Full Changelog: honojs/hono@v4.13.5...v4.13.6

Commits

Updates jose from 6.2.10 to 6.2.12

Release notes

Sourced from jose's releases.

v6.2.12

Documentation

  • clarify and shorten public API guidance (be62530)

Refactor

  • simplify JWS and JWE operation cores (92e9640)

Performance

  • avoid copying AES-GCM output (6925d43)
  • deduplicate pending jwks key imports (bf5138b)
  • encode single-signature JWS input once (7bc9a33)
  • normalize General JWE shared headers once (78637bd)
  • normalize jwks selection metadata once (fd3ae3f)
  • use native encoding for larger ASCII strings (b23a6f3)

v6.2.11

Documentation

  • render subpath indexes as tables (94589ee)
  • shorten API index descriptions (681482f)

Refactor

  • model JWE key management modes (e01dda6)
  • types: reduce declaration repetition (55b970f)
Changelog

Sourced from jose's changelog.

6.2.12 (2026-09-05)

Documentation

  • clarify and shorten public API guidance (be62530)

Refactor

  • simplify JWS and JWE operation cores (92e9640)

Performance

  • avoid copying AES-GCM output (6925d43)
  • deduplicate pending jwks key imports (bf5138b)
  • encode single-signature JWS input once (7bc9a33)
  • normalize General JWE shared headers once (78637bd)
  • normalize jwks selection metadata once (fd3ae3f)
  • use native encoding for larger ASCII strings (b23a6f3)

6.2.11 (2026-09-04)

Documentation

  • render subpath indexes as tables (94589ee)
  • shorten API index descriptions (681482f)

Refactor

  • model JWE key management modes (e01dda6)
  • types: reduce declaration repetition (55b970f)
Commits
  • 505a55b chore(release): 6.2.12
  • 7bc9a33 perf: encode single-signature JWS input once
  • 78637bd perf: normalize General JWE shared headers once
  • bf5138b perf: deduplicate pending jwks key imports
  • b23a6f3 perf: use native encoding for larger ASCII strings
  • fd3ae3f perf: normalize jwks selection metadata once
  • 6925d43 perf: avoid copying AES-GCM output
  • be62530 docs: clarify and shorten public API guidance
  • 1b41312 build: preserve README when generation fails
  • 0b51829 build: check tree-shaking for every public binding
  • Additional commits viewable in compare view

Updates zod from 4.4.3 to 4.5.4

Release notes

Sourced from zod's releases.

v4.5.4

Commits:

  • 84e416fbf4740527bbc8f319634f4e1b065bb42c fix(v4): stop the cycle walk from firing a default factory (#6500)
  • e8e206fa33ac5fe7ce20a2beb12d57b1cb3df653 4.5.4

v4.5.3

Commits:

  • e6b6ab347675cd2bd54b1bdbed16f98c59be82a9 docs(blog): widen the z.compile example to a 20-property schema
  • 87d6464418582bb96fc665a01f852ca6da324ad0 fix(docs): drop the OG description when the title wraps past two lines
  • 99fce394a026823e602b9c30d8d5d9f5f1932ce7 bench(v4): z.compile() against zod-compiler (#6499)
  • e3a695b6bf3f0d591ea682816e3cdaea04b0f967 docs(v4): record the email regex and container output-shape findings under Open
  • 7e24a24288183ce02554f1ded7775d0650a7b7e6 docs(blog): drop the reading time and put a GitHub link in the navbar
  • eab51ff3592b2d11d863f4ee4d5452f31a3de1b6 fix(v4): emit record numeric keys as strings in toJSONSchema (#6497)

v4.5.2

Commits:

  • a354314ac04fdd5484aa62dd5c3a4b553211a0e4 fix(docs): keep blog posts out of the docs collection (#6484)
  • d378c42aff6869f0929058a7923cd775880f5c4c ci: drop canary publishing from the release workflow (#6487)
  • 212b941791e7faae078e17645eb612824fd8f79a fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#6488)
  • e7576f542a7bc7ef3cc5eeec237714fd0e6b6e98 docs(blog): let the page show through the navbar in dark mode (#6489)
  • fedb06fafe33a66ce0b5c236ad2557e0a5a170fe fix(docs): match the blog TOC hover bar to the 2px active indicator
  • 6c932fcb2eea6eb671710ea058ca9fdc382ada89 chore: bump devcontainer image to Node 24 (#6470)
  • 6635d9dd367a664109de83c021995821f48efa29 docs(blog): soften the "method memoization" attribution
  • 019ae299cc75daa132bf1acf59086a520abf6b85 fix(docs): drop ISR on the docs route so the home page hydrates
  • 652bb438aa4c626c1cd7948c6849c4691239fca7 chore(docs): drop the scroll log from the route-change scroller
  • 571c8e8a3d73b4305f4abfdd6977773cc12f2bf5 fix(docs): render blog tabs with the stock fumadocs tab card
  • 9a193aa24b4efa3b315b91d4c56c8bc385b8513f 4.5.2

v4.5.1

Commits:

  • 2e862dbf89da2835e5206a8fd3d3be61afe3cf7f ci: gate the GitHub release and JSR publish on the version being live on npm
  • 8e03380510db36fa6fda979fc78a375fdea8021c 4.5.1

v4.5.0

Zod 4.5 is now available.

npm install zod@latest

At a glance:

... (truncated)

Commits
  • e8e206f 4.5.4
  • 84e416f fix(v4): stop the cycle walk from firing a default factory (#6500)
  • 1a16102 4.5.3
  • eab51ff fix(v4): emit record numeric keys as strings in toJSONSchema (#6497)
  • 7e24a24 docs(blog): drop the reading time and put a GitHub link in the navbar
  • e3a695b docs(v4): record the email regex and container output-shape findings under Open
  • 99fce39 bench(v4): z.compile() against zod-compiler (#6499)
  • 87d6464 fix(docs): drop the OG description when the title wraps past two lines
  • e6b6ab3 docs(blog): widen the z.compile example to a 20-property schema
  • 9a193aa 4.5.2
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the production group across 1 directory with 6 updates
681da33 
Bumps the production group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.102.4` | `5.102.8` |
| [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router) | `8.3.0` | `8.3.1` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.6.30` | `1.7.2` |
| [hono](https://github.com/honojs/hono) | `4.13.5` | `4.13.7` |
| [jose](https://github.com/panva/jose) | `6.2.10` | `6.2.12` |
| [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.5.4` |



Updates `@tanstack/react-query` from 5.102.4 to 5.102.8
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.102.8/packages/react-query)

Updates `react-router` from 8.3.0 to 8.3.1
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router@8.3.1/packages/react-router)

Updates `better-auth` from 1.6.30 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/better-auth)

Updates `hono` from 4.13.5 to 4.13.7
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.5...v4.13.7)

Updates `jose` from 6.2.10 to 6.2.12
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.10...v6.2.12)

Updates `zod` from 4.4.3 to 4.5.4
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.4.3...v4.5.4)

---
updated-dependencies:
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.102.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: react-router
  dependency-version: 8.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: better-auth
  dependency-version: 1.7.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: hono
  dependency-version: 4.13.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: jose
  dependency-version: 6.2.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: zod
  dependency-version: 4.5.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 7, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner September 7, 2026 18:38
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 7, 2026
@clawsweeper

clawsweeper Bot commented Sep 7, 2026 •
edited
Loading

Copy link
Copy Markdown

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review in progress

ClawSweeper is reviewing this revision. This supersedes any previous blocked status.

View the workflow run.

@clawsweeper clawsweeper Bot added P2 Normal priority bug or improvement with limited blast radius. merge-risk: 🚨 auth-provider 🚨 Merging this PR could break OAuth, tokens, provider routing, model choice, or credentials. merge-risk: 🚨 compatibility 🚨 Merging this PR could break existing users, config, migrations, defaults, or upgrades. rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. labels Sep 7, 2026
@clawsweeper

clawsweeper Bot commented Sep 7, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex review: blocked before merge. Reviewed September 9, 2026, 2:40 PM ET / 18:40 UTC (Revision 3).

ClawSweeper review

What this changes

Updates six dashboard and Worker dependencies and their lockfile resolutions, including Better Auth from 1.6.30 to 1.7.2.

Regression provenance

Possible regression — suspected (reviewed change). No predecessor PR is attributed.

Merge readiness

⛔ Blocked before merge - 6 items remain

The dependency refresh remains useful, but the previously reported authentication blocker is unchanged. Current main has not adopted these updates, and the overlapping dependency PR does not cover the entire change.

Priority: P2
Reviewed head: 681da33a519d1dc3346fa3e951d7f419cccf6801

Review scores

Measure Result What it means
Overall readiness 🦪 silver shellfish (2/6) The refresh is focused and repairable, but its unchanged auth pin introduces a deterministic login failure.
Proof confidence 🌊 off-meta tidepool Not applicable: Dependabot is exempt from the ordinary contributor proof gate. Source establishes the account-schema failure; CI is supplemental, and no separate unresolved unauthorized-principal scenario was identified.
Patch quality 🦪 silver shellfish (2/6) 1 actionable review finding remain.

Verification

Check Result Evidence
Real behavior Not applicable Not applicable: Dependabot is exempt from the ordinary contributor proof gate. Source establishes the account-schema failure; CI is supplemental, and no separate unresolved unauthorized-principal scenario was identified.
Evidence reviewed 8 items Verified introduced dependency changes: The complete local delta contains two package manifests and the lockfile, with no application or migration changes. Better Auth changes from 1.6.30 to 1.7.2. The previous review examined this same head, so its existing blocker remains applicable.
Explicit dependency contract and incompatible account schema: createAuth imports Better Auth and its Drizzle adapter, explicitly passing authSchema. The account table defines accountId and providerId but no issuer; the checked-in D1 migrations also contain no issuer column. This directly establishes the relevant Better Auth dependency boundary.
Pinned dependency requires issuer during sign-in: At the verified v1.7.2 commit, OAuth account lookup filters by issuer, while email sign-in requires account.issuer to match the credential issuer. The Drizzle adapter rejects query fields missing from its supplied schema. OAuth linking calls this account lookup before creating a session.
Findings 1 actionable finding [P1] Skip Better Auth versions that require the missing issuer schema
Security None None.

How this fits together

The dashboard uses React dependencies for navigation and server data, while the Worker handles evaluation and authenticated administration. Better Auth reads accounts through a Drizzle schema backed by D1; public flag evaluation remains independent of dashboard login.

flowchart LR
  A[Dashboard] --> B[Worker authentication]
  B --> C[Better Auth account lookup]
  C --> D[D1 account schema]
  D --> E[Session and role checks]
  E --> F[Admin operations]
  G[SDK evaluation requests] --> H[Public flag evaluation]
Loading

Before merge

  • Skip Better Auth versions that require the missing issuer schema (P1) - Better Auth 1.7.2 resolves OAuth accounts by issuer, but createAuth supplies an authSchema.account without that field and no D1 migration adds it. Its Drizzle adapter therefore rejects GitHub account lookup. Existing local credential accounts also fail the new account.issuer comparison. This previously reported blocker remains unchanged at the reviewed head. Retain 1.6.30, or validate a later schema-compatible release such as 1.7.3 before updating the pin.
  • Resolve merge risk (P1) - Merging the 1.7.2 pin would break GitHub-backed login and existing local credential accounts because their schema lacks issuer.
  • Resolve merge risk (P1) - Compatibility of a replacement Better Auth version with fresh and existing D1 databases remains unvalidated.
  • Complete next step (P2) - Restore Better Auth 1.6.30 and regenerate the lockfile, then validate fresh and existing-account login before merge.
  • Improve patch quality - Retain Better Auth 1.6.30 and regenerate the lockfile.
  • Improve patch quality - Validate fresh and repeat persona login and run the Worker suite after the dependency repair.

Findings

  • [P1] Skip Better Auth versions that require the missing issuer schema — apps/api/package.json:22
Agent review details

Security

None.

Review metrics

Metric Value Why it matters
Dependency scope 6 direct updates across 2 manifests; 1 lockfile The incompatible auth update can be removed without discarding the remaining dependency refresh.

Merge-risk options

Maintainer options:

  1. Retain the compatible auth pin (recommended)
    Keep Better Auth at 1.6.30 and regenerate the lockfile while preserving the other dependency updates.
  2. Validate a later compatible release
    Evaluate Better Auth 1.7.3 or a later compatible release against the existing schema and account data before changing the auth pin.
Copy recommended automerge instruction 
@clawsweeper automerge

Special instructions:
Restore Better Auth 1.6.30, regenerate pnpm-lock.yaml with the declared pnpm version, preserve the existing auth schema and migrations, and validate fresh and repeat local persona login plus the Worker tests.

Technical review

Best possible solution:

Preserve Better Auth 1.6.30 and the existing D1 schema while landing compatible updates; evaluate a schema-compatible auth release separately with fresh-install and upgrade coverage.

Do we have a high-confidence way to reproduce the issue?

Yes, source establishes a deterministic PR-head failure: OAuth lookup queries the missing issuer field, and existing credential accounts fail the new issuer comparison. No local runtime reproduction was executed, and this is not a current-main bug.

Is this the best way to solve the issue?

No, the grouped update is not safe as submitted; retaining the current auth pin is the narrowest repair and matches the compatibility direction documented in the overlapping maintainer PR.

Full review comments:

  • [P1] Skip Better Auth versions that require the missing issuer schema — apps/api/package.json:22
    Better Auth 1.7.2 resolves OAuth accounts by issuer, but createAuth supplies an authSchema.account without that field and no D1 migration adds it. Its Drizzle adapter therefore rejects GitHub account lookup. Existing local credential accounts also fail the new account.issuer comparison. This previously reported blocker remains unchanged at the reviewed head. Retain 1.6.30, or validate a later schema-compatible release such as 1.7.3 before updating the pin.
    Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.99

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 59f724c8d5aa.

Labels

Label justifications:

  • P2: This is bounded dependency maintenance with a pre-merge authentication defect, not evidence of a current production outage.
  • merge-risk: 🚨 compatibility: The new auth runtime requires an account field absent from existing and freshly migrated D1 databases.
  • merge-risk: 🚨 auth-provider: The incompatible pin prevents supported GitHub and local credential sign-in paths from authenticating.
  • rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🌊 off-meta tidepool and patch quality is 🦪 silver shellfish.
  • status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: Dependabot is exempt from the ordinary contributor proof gate. Source establishes the account-schema failure; CI is supplemental, and no separate unresolved unauthorized-principal scenario was identified.

Evidence

Acceptance criteria:

  • [P1] pnpm --dir apps/api exec vitest run test/adminAuth.test.ts test/accessTokens.test.ts.
  • [P1] pnpm --dir apps/api test.
  • [P1] pnpm lint.
  • [P1] pnpm typecheck.

What I checked:

  • Verified introduced dependency changes: The complete local delta contains two package manifests and the lockfile, with no application or migration changes. Better Auth changes from 1.6.30 to 1.7.2. The previous review examined this same head, so its existing blocker remains applicable. (apps/api/package.json:22, 681da33a519d)
  • Explicit dependency contract and incompatible account schema: createAuth imports Better Auth and its Drizzle adapter, explicitly passing authSchema. The account table defines accountId and providerId but no issuer; the checked-in D1 migrations also contain no issuer column. This directly establishes the relevant Better Auth dependency boundary. (apps/api/src/auth/auth.ts:44, 681da33a519d)
  • Pinned dependency requires issuer during sign-in: At the verified v1.7.2 commit, OAuth account lookup filters by issuer, while email sign-in requires account.issuer to match the credential issuer. The Drizzle adapter rejects query fields missing from its supplied schema. OAuth linking calls this account lookup before creating a session. (packages/better-auth/src/db/internal-adapter.ts:1003, ba12fcdfa774)
  • Upstream confirms the compatibility break: The v1.7.3 release explicitly restores the 1.6 account schema and providerId/accountId identity contract. It provides a potential later upgrade path, not proof that this PR's 1.7.2 pin is compatible. Release: https://github.com/better-auth/better-auth/releases/tag/v1.7.3.
  • Existing login contract and supplemental CI failures: The Worker test expects dev persona login to establish a session and an editor role. Current-head Test annotations report repeated unauthorized responses in management tests. These support the authentication concern but do not independently establish its cause. (apps/api/test/adminAuth.test.ts:171, 681da33a519d)
  • Current main and overlapping maintainer work: GitHub still reports main at 59f724c, whose API manifest retains Better Auth 1.6.30. The open build(deps): refresh compatible dependencies and patch Undici #87 overlaps the dashboard updates and explicitly defers Better Auth 1.7.2 to preserve the account schema; it is not a complete replacement for this PR. Historical release-file inspection failed because the required blob was unavailable, so no shipped-version claim is made. (apps/api/package.json:22, 59f724c8d5aa)

Likely related people:

  • steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
  • vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score Internal tier Crab rank Meaning
6/6 S 🦀 challenger crab Exceptional readiness
5/6 A 🦞 diamond lobster Very strong readiness
4/6 B 🐚 platinum hermit Good normal PR; ordinary maintainer review
3/6 C 🦐 gold shrimp Useful, but confidence is limited
2/6 D 🦪 silver shellfish Proof or implementation needs work
1/6 F 🧂 unranked krab Not merge-ready
N/A NA 🌊 off-meta tidepool Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (2 earlier review cycles)
  • reviewed 2026-09-07T18:41:01.188Z sha 681da33 :: blocked before merge. :: [P1] Skip Better Auth versions that require the missing issuer schema
  • reviewed 2026-09-08T18:42:35.745Z sha 681da33 :: blocked before merge. :: [P1] Skip Better Auth versions that require the missing issuer schema

@dependabot @github

dependabot Bot commented on behalf of github Sep 10, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 10, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/production-ca2fd710d1 branch September 10, 2026 18:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code merge-risk: 🚨 auth-provider 🚨 Merging this PR could break OAuth, tokens, provider routing, model choice, or credentials. merge-risk: 🚨 compatibility 🚨 Merging this PR could break existing users, config, migrations, defaults, or upgrades. P2 Normal priority bug or improvement with limited blast radius. rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants