chore(deps): bump the npm_and_yarn group across 3 directories with 2 updates#4708
chore(deps): bump the npm_and_yarn group across 3 directories with 2 updates#4708dependabot[bot] wants to merge 1 commit into
Conversation
…updates Bumps the npm_and_yarn group with 2 updates in the / directory: [turbo](https://github.com/vercel/turborepo) and [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth). Bumps the npm_and_yarn group with 1 update in the /apps/sim directory: [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth). Bumps the npm_and_yarn group with 1 update in the /packages/auth directory: [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth). Updates `turbo` from 2.9.12 to 2.9.14 - [Release notes](https://github.com/vercel/turborepo/releases) - [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md) - [Commits](vercel/turborepo@v2.9.12...v2.9.14) Updates `better-auth` from 1.3.12 to 1.6.2 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/better-auth@1.6.2/packages/better-auth) Updates `better-auth` from 1.3.12 to 1.6.2 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/better-auth@1.6.2/packages/better-auth) Updates `better-auth` from 1.3.12 to 1.6.2 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/better-auth@1.6.2/packages/better-auth) --- updated-dependencies: - dependency-name: turbo dependency-version: 2.9.14 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: better-auth dependency-version: 1.6.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: better-auth dependency-version: 1.6.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: better-auth dependency-version: 1.6.2 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
PR SummaryMedium Risk Overview Reviewed by Cursor Bugbot for commit b197db0. Bugbot is set up for automated code reviews on this repo. Configure here. |
Greptile SummaryThis PR bumps two dependencies across three workspace packages:
Confidence Score: 5/5Safe to merge — both updates are straightforward version bumps that bring in security patches with no breaking changes applicable to this codebase. Both packages land security fixes. The only breaking change in better-auth 1.6.2 (a required No files require special attention. Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[package.json] -->|turbo 2.9.12 → 2.9.14| B[Security: VSCode cmd injection fix\nCSRF/session fixation fix\nYarn Berry detection fix]
A -->|better-auth 1.3.12 → 1.6.2| C[Security: OAuth CSRF fix\nCross-provider account collision fix\nnextCookies infinite loop fix]
D[apps/sim/package.json] -->|better-auth 1.3.12 → 1.6.2| C
E[packages/auth/package.json] -->|better-auth 1.3.12 → 1.6.2| C
C --> F{twoFactor plugin used?}
F -->|No| G[No DB migration needed]
F -->|Yes| H[verified column migration required]
Reviews (1): Last reviewed commit: "chore(deps): bump the npm_and_yarn group..." | Re-trigger Greptile |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit b197db0. Configure here.
| "@trigger.dev/sdk": "4.4.3", | ||
| "ajv": "8.18.0", | ||
| "better-auth": "1.3.12", | ||
| "better-auth": "1.6.2", |
There was a problem hiding this comment.
Companion packages have incompatible peer dependency on old version
High Severity
better-auth is bumped from 1.3.12 to 1.6.2, but the companion packages @better-auth/sso and @better-auth/stripe remain at 1.3.12. The lockfile shows both have an exact peer dependency on "better-auth": "1.3.12". These ecosystem packages are released in lockstep and share internal APIs, so this version mismatch is likely to cause runtime failures in SSO and Stripe authentication/billing flows.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit b197db0. Configure here.
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
dependabot
Bot
deleted the
dependabot/npm_and_yarn/npm_and_yarn-5adeebf319
branch
1 participant
Bumps the npm_and_yarn group with 2 updates in the / directory: turbo and better-auth.
Bumps the npm_and_yarn group with 1 update in the /apps/sim directory: better-auth.
Bumps the npm_and_yarn group with 1 update in the /packages/auth directory: better-auth.
Updates
turbofrom 2.9.12 to 2.9.14Release notes
Sourced from turbo's releases.
... (truncated)
Commits
fc62fe0publish 2.9.14 to registryfb8c9aechore: Release 2.9.13 (#12803)e8e629dfix: Avoid project-local Yarn during detection (#12801)91c90cbfix: Harden VS Code extension command execution (#12800)84f4508fix: Validate auth callback state (#12802)1779ad7Removed unneeded import form hash creation script in docs (#12799)71f8c90test: Validate lockfiles without dependency downloads (#12789)5fcb960ci: Scope GitHub Actions caches by branch (#12788)4cf9fabci: Usepull_requestfor PR title linting (#12787)859c629fix: Restore docs mobile menu (#12782)Updates
better-authfrom 1.3.12 to 1.6.2Release notes
Sourced from better-auth's releases.
... (truncated)
Changelog
Sourced from better-auth's changelog.
... (truncated)
Commits
700d298chore: version packages (#9052)b20fa42fix(next-js): replace cookie probe with header-based RSC detection in nextCoo...2cbcb9bfix(oauth2): prevent cross-provider account collision in link-social callback...9deb793fix: cookie store strategy should verify oauth state (#8949)8409843feat(two-factor): include enabled 2fa methods in sign-in redirect response (#...e78a7b1fix(two-factor): prevent unverified TOTP enrollment from gating sign-in (#8711)85bb710chore: version packages (#9018)7495830fix(api): restore getSession accessibility in generic Auth<O> context (#9017)2e537dffix: endpoint instrumentation to always use route template (#9023)f61ad1cfix: useINVALID_PASSWORDfor allcheckPasswordfailures (#8902)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for better-auth since your current version.
Updates
better-authfrom 1.3.12 to 1.6.2Release notes
Sourced from better-auth's releases.
... (truncated)
Changelog
Sourced from better-auth's changelog.
... (truncated)
Commits
700d298chore: version packages (#9052)b20fa42fix(next-js): replace cookie probe with header-based RSC detection in nextCoo...2cbcb9bfix(oauth2): prevent cross-provider account collision in link-social callback...9deb793fix: cookie store strategy should verify oauth state (#8949)8409843feat(two-factor): include enabled 2fa methods in sign-in redirect response (#...e78a7b1fix(two-factor): prevent unverified TOTP enrollment from gating sign-in (#8711)85bb710chore: version packages (#9018)7495830fix(api): restore getSession accessibility in generic Auth<O> context (#9017)2e537dffix: endpoint instrumentation to always use route template (#9023)f61ad1cfix: useINVALID_PASSWORDfor allcheckPasswordfailures (#8902)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for better-auth since your current version.
Updates
better-authfrom 1.3.12 to 1.6.2Release notes
Sourced from better-auth's releases.
... (truncated)
Changelog
Sourced from better-auth's changelog.
... (truncated)
Commits
700d298chore: version packages (#9052)b20fa42fix(next-js): replace cookie probe with header-based RSC detection in nextCoo...2cbcb9bfix(oauth2): prevent cross-provider account collision in link-social callback...9deb793fix: cookie store strategy should verify oauth state (#8949)8409843feat(two-factor): include enabled 2fa methods in sign-in redirect response (#...e78a7b1fix(two-factor): prevent unverified TOTP enrollment from gating sign-in (#8711)85bb710chore: version packages (#9018)7495830fix(api): restore getSession accessibility in generic Auth<O> context (#9017)2e537dffix: endpoint instrumentation to always use route template (#9023)f61ad1cfix: useINVALID_PASSWORDfor allcheckPasswordfailures (#8902)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for better-auth since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.