[dependabot]

Bumps the npm-deps group with 12 updates in the / directory:

Package	From	To
@better-auth/oauth-provider	1.7.7	1.7.17
@hono/node-server	2.1.4	2.1.6
better-auth	1.7.7	1.7.17
hono	4.13.13	4.13.16
@commitlint/cli	21.2.3	21.2.4
@commitlint/config-conventional	21.2.3	21.2.4
@playwright/test	1.64.0	1.64.1
eslint	10.12.0	10.14.0
fallow	3.32.0	3.39.0
globals	17.13.0	17.14.0
prettier	3.9.9	3.9.10
tap	21.8.0	21.8.1

Updates @better-auth/oauth-provider from 1.7.7 to 1.7.17

Release notes

Sourced from @​better-auth/oauth-provider's releases.

v1.7.17

better-auth

Bug Fixes

• Fixed sessions created by a session.delete.after hook being treated as revoked during "revoke all sessions" when using secondaryStorage with storeSessionInDatabase (#12212)
• Fixed remembered sign-ins and sign-ups to refresh their session even if an earlier sign-in in the same browser used rememberMe: false (#12181)
• Fixed denying a device authorization request to reject a revoked session that is still in the cookie cache (#12216)
• Fixed IP wildcard trusted origins such as exp://192.168.*.*:* matching custom-scheme hosts with out-of-range or zero-padded octets (#12217)
• Fixed the phone number plugin storing an empty phoneNumber on sign-up and replacing a verified number when linking an account with an empty phone number (#12219)
• Fixed TOTP verification rejecting API key sessions so they can now finish two-factor enrollment (#12211)
• Fixed trusted devices being ignored when an app runs the two-factor sign-in step from its own hook on another sign-in path, such as email OTP (#12228)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

• Fixed Expo social sign-in to reject authorization URLs without a state parameter when OAuth state is stored in a cookie (#12218)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• Fixed MySQL create with generateId: "serial" leaving an inserted row behind when the table reports no auto-increment id (#12220)

For detailed changes, see CHANGELOG

@better-auth/passkey

Bug Fixes

• Fixed passkey registration and sign-in when one passkey() plugin is shared between auth instances where only some set baseURL (#12225)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​aliamanatali, @​bytaesu

Full changelog: v1.7.16...v1.7.17

v1.7.16

better-auth

... (truncated)

Changelog

Sourced from @​better-auth/oauth-provider's changelog.

1.7.17

1.7.16

1.7.15

1.7.14

1.7.13

1.7.12

1.7.11

Patch Changes

• #11830 a1f6f0b Thanks @​gustavovalverde! - Apps using the CIMD plugin no longer lose an administrator's change to a discovered client when a metadata refresh is running at the same time. Before, disabling the client, setting skipConsent or enableEndSession, or assigning client_credentials scopes while its document was being fetched could be undone by the refresh. No action is needed.

• #10881 37debaa Thanks @​sahiljagtap08! - Corrected the OpenAPI response schemas for /oauth2/consent and /oauth2/continue to describe { redirect: true, url: string }, so generated clients no longer expect a nonexistent redirect_uri field. Runtime responses are unchanged.

1.7.10

Patch Changes

• #11786 cdd491b Thanks @​gustavovalverde! - DPoP proofs are accepted again for two setups that broke in v1.7.9:

  • Plugin endpoints with route params, such as /extension/:tenant/token, that issue tokens with a DPoP proof. A valid proof for /extension/acme/token was rejected with invalid_dpop_proof, because the expected htu contained the literal :tenant.
  • Token and UserInfo requests to a URL with a trailing slash, such as /api/auth/oauth2/token/, when advanced.skipTrailingSlashes is on. The proof was rejected because the expected htu dropped the slash.

  The expected htu still takes its origin and base path from baseURL, so keep baseURL set to the public URL clients call. Other setups are unaffected.

• #11815 44f14bb Thanks @​gustavovalverde! - Device-code clients that request offline_access and poll the token endpoint for only some of the RFC 8707 resources the user approved can now refresh for any approved resource. Previously, a refresh for an approved resource left out of the poll failed with invalid_target. Device codes polled without resource, or for every approved resource, are unaffected.

• #11695 fe550a9 Thanks @​gustavovalverde! - Confidential private_key_jwt clients that register inline jwks can now replace their own signing keys without a user session. Until now those keys were fixed at registration. The feature is off by default; set allowClientKeyRotation: true to enable it. No database migration is needed, but the provider refuses to start with it enabled on the memory adapter or with advanced.database.generateId: "serial", because neither enforces single-use client assertions.

  The client calls POST /oauth2/client/rotate-keys with its complete new jwks and a client assertion signed by one of its current keys, whose aud includes the rotation endpoint's URL. An assertion addressed only to the token endpoint or the issuer is rejected. Keys left out of the new set stop working at once, so roll a key in two steps: send the old and new keys together, then drop the old key once every instance signs with the new one.

• #11801 99cdfe7 Thanks @​gustavovalverde! - If postLogin.consentReferenceId returns no reference for some authorizations (for example, it returns an organization ID only for organization scopes), consent is now kept separate per reference. Approving consent without a reference no longer overwrites the consent stored for an organization, and an authorization without a reference no longer skips the consent prompt because the user consented under an organization. Previously, approving read write without a reference could replace an organization's stored read consent, so later authorizations for that organization were granted write without asking. For new authorizations, an empty string is treated the same as no reference, including the referenceId passed to token claim callbacks.

  Users may see the consent prompt once for authorizations that were previously approved through another reference's consent. Until they do, silent (prompt=none) authorizations in these setups return consent_required. Consent overwritten before this release is not repaired; users can review or revoke it through the consent management endpoints. Setups that never configured consentReferenceId, or that always return a reference, are unaffected.

• #11797 906c32f Thanks @​gustavovalverde! - If you enable dynamic client registration, Claude's MCP connector can now register. It requests urn:ietf:params:oauth:grant-type:jwt-bearer along with authorization_code and refresh_token, and Better Auth rejected the whole registration with invalid_client_metadata because one grant was unsupported. Dynamic registration now keeps the requested grants the server supports and lists them in the registration response. A request that shares no grant with the server is still rejected. Clients created with createOAuthClient or adminCreateOAuthClient still reject unsupported grants.

• #11798 2fa7e2f Thanks @​gustavovalverde! - With clientRegistrationDefaultApplicationType: "infer", clients that register an http callback on localhost, 127.0.0.1, or [::1] without application_type now register as native. This includes older Claude Code releases, which register http://127.0.0.1:<port>/callback. Current Claude Code releases send application_type: "native" and were not affected. Before, "infer" chose native only for callbacks whose scheme is not http or https, so these registrations were treated as web and rejected with invalid_redirect_uri. The "web" default and the "native" setting are unchanged, and an application_type the client sends is never overridden.

• #11176 8f3da46 Thanks @​Bekacru! - The token endpoint now returns invalid_client instead of invalid_grant when a request names a client_id that is not registered, for the authorization_code, refresh_token, and device code grants. MCP clients whose registration was deleted, for example by a database reset or an upgrade that dropped OAuth tables, now register again and prompt the user to sign in. Before, they kept the deleted client_id and stayed signed out until the user cleared their saved credentials by hand. A registered client that sends wrong credentials also gets invalid_client now, even when its code or refresh token is also invalid.

• #11596 963b7f9 Thanks @​mahoor! - /oauth2/userinfo, /oauth2/introspect and /oauth2/revoke now answer a JWT that fails verification the way they answer any unknown token. Before, they returned an empty 500. This covers an alg: none token, a tampered signature, an unknown kid and a wrong issuer: userinfo returns 401 invalid_token with a WWW-Authenticate challenge, introspection returns { "active": false }, and revocation returns its unknown-token error. Valid JWT and opaque access tokens are unaffected, including JWT-shaped tokens issued by generateOpaqueAccessToken.

  If you set disableJwtPlugin: true, a JWT-shaped token that is not a stored access token, such as an ID token, now gets the same unknown-token response instead of a 500.

... (truncated)

Commits

• e3ae9e1 chore: release v1.7.17 (#12214)
• 93edae1 chore: release v1.7.16 (#12199)
• f25081a fix: harden authentication flows (#12198)
• e556c07 chore: release v1.7.15 (#12101)
• a936663 chore: release v1.7.14 (#12055)
• 7f61081 chore: release v1.7.13 (#11994)
• f4260a9 chore: release v1.7.12 (#11922)
• 52ab801 chore: release v1.7.11 (#11827)
• a1f6f0b fix(oauth-provider): keep admin changes made during a CIMD refresh (#11830)
• 37debaa fix(oauth-provider): correct consent and continue OpenAPI response schemas (#...
• Additional commits viewable in compare view

Updates @hono/node-server from 2.1.4 to 2.1.6

Release notes

Sourced from @​hono/node-server's releases.

v2.1.6

Security fixes

This release includes fixes for the following security issues:

Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy

Affects: all requests. The raw request-target was passed to the WHATWG URL parser, which treats a backslash in the path as / and resolves .. segments, so /admin\secret reached the application as /admin/secret. A reverse proxy that forwards the backslash unchanged applied its path-based rules to the original path. GHSA-jpvv-r467-5p4w

A request whose path contains a raw backslash is now rejected with 400 Bad Request, for HTTP/1.1, HTTP/2 and WebSocket upgrades. A percent-encoded backslash (%5C) and a backslash in the query string are still accepted.

WebSocket upgrade request-target starting with // replaces the host in c.req.url, bypassing Origin checks

Affects: upgradeWebSocket. The URL of an upgrade request was built by resolving the request-target against the Host header, so a request-target such as //attacker.example/ws set the host of c.req.url to a client-chosen value while routing still saw /ws. An application that compared Origin with the origin of c.req.url could be bypassed by a page on another site. GHSA-7v5p-43qr-wch5

The host of upgrade requests now comes from the Host header, as for ordinary requests.

Unhandled ECONNRESET on the socket during an asynchronous WebSocket upgrade crashes the process

Affects: upgradeWebSocket. While the application handled an upgrade request, the socket had no error listener. A client that reset the connection during asynchronous middleware caused an unhandled 'error' event and terminated the process. GHSA-qv5m-9pm6-hqp3

Error and close events on the socket are now handled while the application runs, and a pending upgrade is released when the socket closes.

---

The backslash fix also ships in @hono/node-server v1.19.18. Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.1.5

What's Changed

• fix(listener): abort the request signal when an HTTP/2 client resets the stream by @​affanmomin in honojs/node-server#404
• fix(serve-static): only serve GET and HEAD requests by @​usualoma in honojs/node-server#405

New Contributors

• @​affanmomin made their first contribution in honojs/node-server#404

Full Changelog: honojs/node-server@v2.1.4...v2.1.5

Commits

• 123f782 2.1.6
• cfaa79f Merge commit from fork
• 61cc026 Merge commit from fork
• a152a45 test: wait for the first chunk before sending the second in the readable-stre...
• fb97395 Merge commit from fork
• 4b47a0d 2.1.5
• e77824a fix(serve-static): only serve GET and HEAD requests (#405)
• 1b6e6bf fix(listener): abort the request signal when an HTTP/2 client resets the stre...
• See full diff in compare view

Updates better-auth from 1.7.7 to 1.7.17

Release notes

Sourced from better-auth's releases.

v1.7.17

better-auth

Bug Fixes

• Fixed sessions created by a session.delete.after hook being treated as revoked during "revoke all sessions" when using secondaryStorage with storeSessionInDatabase (#12212)
• Fixed remembered sign-ins and sign-ups to refresh their session even if an earlier sign-in in the same browser used rememberMe: false (#12181)
• Fixed denying a device authorization request to reject a revoked session that is still in the cookie cache (#12216)
• Fixed IP wildcard trusted origins such as exp://192.168.*.*:* matching custom-scheme hosts with out-of-range or zero-padded octets (#12217)
• Fixed the phone number plugin storing an empty phoneNumber on sign-up and replacing a verified number when linking an account with an empty phone number (#12219)
• Fixed TOTP verification rejecting API key sessions so they can now finish two-factor enrollment (#12211)
• Fixed trusted devices being ignored when an app runs the two-factor sign-in step from its own hook on another sign-in path, such as email OTP (#12228)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

• Fixed Expo social sign-in to reject authorization URLs without a state parameter when OAuth state is stored in a cookie (#12218)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• Fixed MySQL create with generateId: "serial" leaving an inserted row behind when the table reports no auto-increment id (#12220)

For detailed changes, see CHANGELOG

@better-auth/passkey

Bug Fixes

• Fixed passkey registration and sign-in when one passkey() plugin is shared between auth instances where only some set baseURL (#12225)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​aliamanatali, @​bytaesu

Full changelog: v1.7.16...v1.7.17

v1.7.16

better-auth

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.17

Patch Changes

• #12181 b6a87ad Thanks @​aliamanatali! - A remembered sign-in or sign-up now refreshes its session like any other remembered session, even if an earlier sign-in in the same browser used rememberMe: false. Previously the earlier choice stayed in a dont_remember cookie until the browser closed, so the new session stopped sliding and expired expiresIn after it was created.

• #12216 cff7c1c Thanks @​bytaesu! - Denying a device authorization request now rejects a session that was revoked but still present in the cookie cache, matching the behavior of approving a request.

• #12217 16aa412 Thanks @​bytaesu! - IP wildcard trusted origins such as exp://192.168.*.*:* no longer match custom-scheme hosts with out-of-range or zero-padded octets like 192.168.999.999.

• #12219 9150314 Thanks @​bytaesu! - Signing up with an empty phoneNumber with the phone number plugin no longer stores the empty string or makes later sign-ups fail. Linking an account whose profile maps an empty phone number no longer replaces the user's verified number.

• #12212 f5be351 Thanks @​bytaesu! - Fixed sessions created by a session.delete.after hook during "revoke all sessions" being treated as revoked immediately when secondaryStorage is used with storeSessionInDatabase.

• #12211 98bcd98 Thanks @​bytaesu! - Fixed TOTP verification rejecting sessions created from an API key, so API-key sessions can now finish two-factor enrollment.

• #12228 fbff537 Thanks @​bytaesu! - Trusted devices are honored again when an app runs the two-factor sign-in step from its own hook on another sign-in path, such as email OTP.

• Updated dependencies [fc2e00b]:

  • @​better-auth/kysely-adapter@​1.7.17
  • @​better-auth/core@​1.7.17
  • @​better-auth/drizzle-adapter@​1.7.17
  • @​better-auth/memory-adapter@​1.7.17
  • @​better-auth/mongo-adapter@​1.7.17
  • @​better-auth/prisma-adapter@​1.7.17
  • @​better-auth/telemetry@​1.7.17

1.7.16

Patch Changes

• #12198 f25081a Thanks @​bytaesu! - /admin/update-user now requires the new user:set-phone permission to change phoneNumber or phoneNumberVerified. If you use a custom access control, add set-phone to your statements and grant it to roles that should change phone numbers.

• #12198 f25081a Thanks @​bytaesu! - Anonymous users are no longer linked or deleted on a sign-in that is still waiting for a second factor.

• #12198 f25081a Thanks @​bytaesu! - Email verification and change email links now only work for the account they were issued to. Opening a change email link no longer signs the user in, and it verifies the new email only if the current one was verified.

• #12198 f25081a Thanks @​bytaesu! - Wildcard trusted origins now match custom-scheme URLs by their parsed scheme, host, and path, and no longer match a URL with userinfo or one that cannot be parsed as an origin. A wildcard host made only of digits, dots, and wildcards, such as 192.168.*.*, now matches only IPv4 addresses in that range.

• #12198 f25081a Thanks @​bytaesu! - Looking up a user by email now returns only an account whose stored address matches the requested one, ignoring case, even on databases with accent-insensitive collations. The email OTP password reset routes now validate the address and send the code to the address on the account.

• #12198 f25081a Thanks @​bytaesu! - Email change codes from the email OTP plugin are now bound to the requesting account and the new address. Codes sent before the upgrade must be requested again.

• #12198 f25081a Thanks @​bytaesu! - Fixed the email OTP checkVerificationOtp and resetPassword endpoints and the phone number resetPassword endpoint allowing more OTP guesses than allowedAttempts when requests arrive concurrently. A correct check still leaves the OTP usable for the follow-up call.

• #12198 f25081a Thanks @​bytaesu! - The Expo authorization proxy now sets the signed state cookie only for an unexpired state issued by the server. getAuthStateVerificationIdentifier is now exported for plugins that look up OAuth state records.

• #12198 f25081a Thanks @​bytaesu! - Passkey registration, device authorization, two-factor enrollment and verification, social account linking, and phone number changes now reject a session revoked in the database or secondary storage, even when cookie caching is enabled. Sessions created from API keys are refused on these routes, except two-factor enrollment and phone number changes.

• #12198 f25081a Thanks @​bytaesu! - Generic OAuth providers whose discovery document has a jwks_uri now reject a user profile whose sub differs from the ID token's sub. Direct ID-token sign-in and linking with a generic OAuth provider now resolve the profile from the verified ID token only and ignore a submitted access or refresh token.

... (truncated)

Commits

• e3ae9e1 chore: release v1.7.17 (#12214)
• b6a87ad fix(cookies): clear the dont_remember marker on a remembered sign-in (#12181)
• fbff537 fix(two-factor): honor trusted devices when the sign-in step runs on custom p...
• 16aa412 fix(origin-check): validate IPv4 octets in IP wildcard trusted origins (#12217)
• 9150314 fix(phone-number): treat empty phone number as missing (#12219)
• cff7c1c fix(device-authorization): reject revoked cached sessions on deny (#12216)
• f5be351 fix: keep sessions created by delete hooks during bulk revocation (#12212)
• 98bcd98 fix(two-factor): accept API key sessions when verifying TOTP enrollment (#12211)
• 93edae1 chore: release v1.7.16 (#12199)
• f25081a fix: harden authentication flows (#12198)
• Additional commits viewable in compare view

Updates hono from 4.13.13 to 4.13.16

Release notes

Sourced from hono's releases.

v4.13.16

Security fixes

This release includes fixes for the following security issues:

mount() and app.mount() can forward a path that bypasses middleware scoped inside the mount prefix

Affects: mount() in hono/mount and app.mount(). A dynamic prefix such as /api/:tenant/* was removed by the length of the route pattern. The forwarded path was also re-normalized by the URL parser, so a decoded \ became / and .. collapsed. Both let a crafted request skip middleware scoped inside the mount prefix. Routes such as /assets* and duplicate parameter names now throw. GHSA-4m76-xfj5-7975

RegExpRouter skips wildcard middleware for certain route patterns and for paths with an encoded line terminator

Affects: RegExpRouter, including the default SmartRouter. Wildcard middleware was not applied in three cases: a parameter written as {[^/]+} in the middleware path only, a /prefix* route next to /prefix/* middleware, and a path with an encoded line terminator. RegExpRouter now covers the same routes as the other routers. Custom patterns that can match the empty string, such as {[0-9]*}, throw UnsupportedPathError. Regenerate PreparedRegExpRouter data. GHSA-h7mg-cq63-vhpq

validator('form') skips validation for multipart/form-data requests with extra parameters

Affects: validator('form') in hono/validator. A multipart/form-data request with an extra parameter such as charset was not recognized as a form. The validator then saw an empty object while the handler could read all fields. GHSA-4h7h-rv7c-7m2v

css helper does not escape a closing tag assembled from template parts and values, allowing HTML injection

Affects: css in hono/css. A </style> split between the template and a value, or between two values, was not escaped. Closing tags are now escaped after minification. GHSA-3gg2-335m-rxc6

csrf() does not check requests sent by hyperlink auditing (text/ping)

Affects: csrf() in hono/csrf. A POST sent by Chromium's <a ping> has the content type text/ping and was not checked against Origin and Sec-Fetch-Site. GHSA-46wx-v44x-9hh2

---

Users who rely on path-scoped middleware with mount(), wildcard middleware with the default router, validator('form'), the css helper with untrusted values, or csrf() are strongly encouraged to upgrade to this version.

What's Changed

• fix(jwt): reject a signature segment outside the base64url alphabet and a header with crit in honojs/hono#5597

Full Changelog: honojs/hono@v4.13.15...v4.13.16

v4.13.15

What's Changed

• fix(auth): escape backslashes in the WWW-Authenticate realm by @​yusukebe in honojs/hono#5590
• docs(contributing): drop the note about linking a fork branch by @​yusukebe in honojs/hono#5593
• fix(context): allow c.header() after the response body is consumed by @​yusukebe in honojs/hono#5587

Full Changelog: honojs/hono@v4.13.14...v4.13.15

v4.13.14

What's Changed

• docs(contributing): ask for issues instead of RPs honojs/hono#5526
• docs(readme): sync the contributing list with CONTRIBUTING.md honojs/hono#5527
• fix(adapters): accept Hono v5 prereleases in the hono peer range honojs/hono#5537
• chore: unified oxfmt and oxlint config honojs/hono#5518
• docs(readme): remove the deepwiki badge honojs/hono#5548

... (truncated)

Commits

• c91b60a 4.13.16
• e1dd588 fix(jwt): reject a signature segment outside the base64url alphabet and a hea...
• bf16471 Merge commit from fork
• d88fab3 Merge commit from fork
• 34f9043 Merge commit from fork
• 8a103aa Merge commit from fork
• 15bbd96 Merge commit from fork
• 3cb29de 4.13.15
• 17ad0e2 fix(context): allow c.header() after the response body is consumed (#5587)
• ee88684 docs(contributing): drop the note about linking a fork branch (#5593)
• Additional commits viewable in compare view

Updates @commitlint/cli from 21.2.3 to 21.2.4

Release notes

Sourced from @​commitlint/cli's releases.

v21.2.4

21.2.4 (2026-10-18)

Bug Fixes

• fix(load): replace config file arrays with seed arrays by @​escapedcat in conventional-changelog/commitlint#5056
• fix: update dependency jsonc to v3 by @​renovate[bot] in conventional-changelog/commitlint#5020

Performance Improvements

• perf(load): load typescript configs with jiti directly by @​escapedcat in conventional-changelog/commitlint#5052

Docs, etc

• docs: add AGENTS.md with commit type guidance by @​escapedcat in conventional-changelog/commitlint#5053
• test(ensure): pin case conversion of digits, punctuation and accents by @​escapedcat in conventional-changelog/commitlint#5055

Full Changelog: conventional-changelog/commitlint@v21.2.3...v21.2.4

Changelog

Sourced from @​commitlint/cli's changelog.

21.2.4 (2026-10-18)

Note: Version bump only for package @​commitlint/cli

Commits

• d8e3656 v21.2.4
• See full diff in compare view

Updates @commitlint/config-conventional from 21.2.3 to 21.2.4

Release notes

Sourced from @​commitlint/config-conventional's releases.

v21.2.4

21.2.4 (2026-10-18)

Bug Fixes

• fix(load): replace config file arrays with seed arrays by @​escapedcat in conventional-changelog/commitlint#5056
• fix: update dependency jsonc to v3 by @​renovate[bot] in conventional-changelog/commitlint#5020

Performance Improvements

• perf(load): load typescript configs with jiti directly by @​escapedcat in conventional-changelog/commitlint#5052

Docs, etc

• docs: add AGENTS.md with commit type guidance by @​escapedcat in conventional-changelog/commitlint#5053
• test(ensure): pin case conversion of digits, punctuation and accents by @​escapedcat in conventional-changelog/commitlint#5055

Full Changelog: conventional-changelog/commitlint@v21.2.3...v21.2.4

Changelog

Sourced from @​commitlint/config-conventional's changelog.

21.2.4 (2026-10-18)

Note: Version bump only for package @​commitlint/config-conventional

Commits

• d8e3656 v21.2.4
• See full diff in compare view

Updates @playwright/test from 1.64.0 to 1.64.1

Release notes

Sourced from @​playwright/test's releases.

v1.64.1

Bug Fixes

• #43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
• #43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

Commits

• cfe490d cherry-pick(#43353): docs: release notes for v1.64 Python
• 866cbb8 chore: mark v1.64.1 (#43354)
• 1b29247 cherry-pick(#43250): fix(electron): do not drop windows that have not navigat...
• 632d976 cherry-pick(#43249): fix(chromium): disable AvoidCorsURLLoaderRestartOnRedirect
• 824d0c5 cherry-pick(#43217): chore(dotnet): fix async suffix of optional-arg overload...
• See full diff in compare view

Updates eslint from 10.12.0 to 10.14.0

Release notes

Sourced from eslint's releases.

v10.14.0

Features

• d23a7f9 feat: fix property descriptor handling in func-name-matching (#21400) (xbinaryx)

Bug Fixes

• 4a12580 fix: require minimatch 10.2.6 to avoid vulnerable brace-expansion (#21460) (lumir)
• 827a8f3 fix: no-restricted-globals crash on global objects as property values (#21449) (xbinaryx)
• 161558a fix: handle LS, PS and empty hashbang comments (#21419) (lumir)
• 6194939 fix: no-invalid-this crash on accessor fields without initializer (#21442) (xbinaryx)
• 9155e14 fix: Update @​humanfs/node dependency version (#21434) (Nicholas C. Zakas)
• cb2b9d4 fix: avoid invalid object-shorthand fixes for super methods (#21323) (dvd233)
• 5ee3915 fix: yoda invalid autofix at statement start (#21424) (Daniel Pinto)

Documentation

• 0f94f47 docs: remove zh-hans from docs language switcher (#21437) (lumir)
• dab466e docs: Update README (GitHub Actions Bot)
• 97431f8 docs: replace --rulesdir with a virtual plugin in custom rules docs (#21452) (Pixel)
• 7697550 docs: Update README (GitHub Actions Bot)
• 0c699d5 docs: Remove Tidelift commercial support (#21416) (Milos Djermanovic)
• 0880666 docs: update loadESLint() documentation for v10 (#21374) (Minseon Kim)
• e06fe87 docs: Revise AI acknowledgment options in PR template (#21414) (Nicholas C. Zakas)

Chores

• 0e2ab70 ci: disable eslint-plugin-unicorn ecosystem test (#21462) (Francesco Trotta)
• 6e3f988 chore: update github/codeql-action action to v4.39.1 (#21450) (renovate[bot])
• a031c40 chore: update ecosystem plugins (#21445) (ESLint Bot)
• 67d2ca2 chore: add troubleshooting page URL to circular fixes warning message (#21429) (Milos Djermanovic)
• 276021d chore: update github/codeql-action action to v4.39.0 (#21432) (renovate[bot])
• 449724e chore: update ecosystem plugins (#21420) (ESLint Bot)
• 8ffeb8c chore: update dependency prettier to v3.9.10 (#21417) (renovate[bot])

v10.13.0

Features

• 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238) (Irfan fandi)
• a39d9fb feat: add globalThis to no-obj-calls (#21382) (synthex-byte)
• 66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#21399) (xbinaryx)

Bug Fixes

• 87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#21389) (Daniel Pinto)

Documentation

• 4783a68 docs: Update README (GitHub Actions Bot)...

  Description has been truncated

[mroderick]

Dependency Upgrade Review

Verdict: blocked: baseline red (head 969b2c6883b243b94315f376a43dc93a23f9c1a3) · Confidence: Low

Not assessed: the repository's suite is red at the default branch head, so this PR is not judged until the baseline is green.

Checks

Check	Result
planner suite	not-run
auth suite	not-run
round-trip probe	not-run

Calibration and confidence

Confidence: Low — Blocked on the repository baseline; no upgrade analysis ran.

1. Weakest claim: Nothing was verified while the baseline is red.
2. Relied on but unverified: Everything; no analysis ran.
3. Falsifier: A green baseline would allow a real review.

Previous verdicts

• 2026-11-12T10:30:02.953Z head 17f36e401ad86104c0e53ce22ce13f802071759e: blocked: baseline red (Low)