chore(deps): bump the npm_and_yarn group across 3 directories with 2 updates#4709
chore(deps): bump the npm_and_yarn group across 3 directories with 2 updates#4709dependabot[bot] wants to merge 1 commit into
Conversation
…updates Bumps the npm_and_yarn group with 2 updates in the / directory: [turbo](https://github.com/vercel/turborepo) and [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth). Bumps the npm_and_yarn group with 1 update in the /apps/sim directory: [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth). Bumps the npm_and_yarn group with 1 update in the /packages/auth directory: [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth). Updates `turbo` from 2.9.12 to 2.9.14 - [Release notes](https://github.com/vercel/turborepo/releases) - [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md) - [Commits](vercel/turborepo@v2.9.12...v2.9.14) Updates `better-auth` from 1.3.12 to 1.6.2 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/better-auth@1.6.2/packages/better-auth) Updates `better-auth` from 1.3.12 to 1.6.2 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/better-auth@1.6.2/packages/better-auth) Updates `better-auth` from 1.3.12 to 1.6.2 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/better-auth@1.6.2/packages/better-auth) --- updated-dependencies: - dependency-name: turbo dependency-version: 2.9.14 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: better-auth dependency-version: 1.6.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: better-auth dependency-version: 1.6.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: better-auth dependency-version: 1.6.2 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
PR SummaryMedium Risk Overview Also bumps the monorepo build tool Reviewed by Cursor Bugbot for commit 1fd1906. Bugbot is set up for automated code reviews on this repo. Configure here. |
Greptile SummaryThis PR bumps
Confidence Score: 5/5Safe to merge — all changes are manifest-only version bumps that pick up security and bug fixes with no application code changes. Both upgrades bring security fixes and no application code is modified. The one breaking change in better-auth 1.6.2 (schema migration for the twoFactor table) does not apply because neither auth configuration in this repo uses the twoFactor plugin. The nextCookies fix is directly beneficial to the existing setup. No files require special attention. Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[Dependency Bump PR] --> B[turbo 2.9.12 → 2.9.14]
A --> C[better-auth 1.3.12 → 1.6.2]
B --> B1[Fix: VSCode extension command injection - High]
B --> B2[Fix: Login callback CSRF/session fixation - Low]
B --> B3[Fix: Yarn Berry detection local code exec - Low]
C --> C1[Fix: OAuth state CSRF via cookie nonce]
C --> C2[Fix: nextCookies infinite refresh loop]
C --> C3[Fix: Cross-provider account collision]
C --> C4[Breaking: twoFactor verified column]
C4 --> C5{App uses twoFactor plugin?}
C5 -->|No| C6[Not applicable - safe to merge]
C5 -->|Yes| C7[Schema migration required]
Reviews (1): Last reviewed commit: "chore(deps): bump the npm_and_yarn group..." | Re-trigger Greptile |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 1fd1906. Configure here.
| "@trigger.dev/sdk": "4.4.3", | ||
| "ajv": "8.18.0", | ||
| "better-auth": "1.3.12", | ||
| "better-auth": "1.6.2", |
There was a problem hiding this comment.
Lockfile not updated to match package.json versions
High Severity
The bun.lock file was not regenerated to reflect the version bumps. It still resolves better-auth@1.3.12 and turbo@2.9.12, meaning the intended upgrades to 1.6.2 and 2.9.14 won't actually take effect. CI using --frozen-lockfile will either fail or install stale versions. Additionally, @better-auth/sso@1.3.12 and @better-auth/stripe@1.3.12 declare an exact peerDependencies on better-auth@1.3.12, creating a peer dependency mismatch once the lockfile is regenerated.
Additional Locations (2)
Reviewed by Cursor Bugbot for commit 1fd1906. Configure here.
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
1 participant
Bumps the npm_and_yarn group with 2 updates in the / directory: turbo and better-auth.
Bumps the npm_and_yarn group with 1 update in the /apps/sim directory: better-auth.
Bumps the npm_and_yarn group with 1 update in the /packages/auth directory: better-auth.
Updates
turbofrom 2.9.12 to 2.9.14Release notes
Sourced from turbo's releases.
... (truncated)
Commits
fc62fe0publish 2.9.14 to registryfb8c9aechore: Release 2.9.13 (#12803)e8e629dfix: Avoid project-local Yarn during detection (#12801)91c90cbfix: Harden VS Code extension command execution (#12800)84f4508fix: Validate auth callback state (#12802)1779ad7Removed unneeded import form hash creation script in docs (#12799)71f8c90test: Validate lockfiles without dependency downloads (#12789)5fcb960ci: Scope GitHub Actions caches by branch (#12788)4cf9fabci: Usepull_requestfor PR title linting (#12787)859c629fix: Restore docs mobile menu (#12782)Updates
better-authfrom 1.3.12 to 1.6.2Release notes
Sourced from better-auth's releases.
... (truncated)
Changelog
Sourced from better-auth's changelog.
... (truncated)
Commits
700d298chore: version packages (#9052)b20fa42fix(next-js): replace cookie probe with header-based RSC detection in nextCoo...2cbcb9bfix(oauth2): prevent cross-provider account collision in link-social callback...9deb793fix: cookie store strategy should verify oauth state (#8949)8409843feat(two-factor): include enabled 2fa methods in sign-in redirect response (#...e78a7b1fix(two-factor): prevent unverified TOTP enrollment from gating sign-in (#8711)85bb710chore: version packages (#9018)7495830fix(api): restore getSession accessibility in generic Auth<O> context (#9017)2e537dffix: endpoint instrumentation to always use route template (#9023)f61ad1cfix: useINVALID_PASSWORDfor allcheckPasswordfailures (#8902)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for better-auth since your current version.
Updates
better-authfrom 1.3.12 to 1.6.2Release notes
Sourced from better-auth's releases.
... (truncated)
Changelog
Sourced from better-auth's changelog.
... (truncated)
Commits
700d298chore: version packages (#9052)b20fa42fix(next-js): replace cookie probe with header-based RSC detection in nextCoo...2cbcb9bfix(oauth2): prevent cross-provider account collision in link-social callback...9deb793fix: cookie store strategy should verify oauth state (#8949)8409843feat(two-factor): include enabled 2fa methods in sign-in redirect response (#...e78a7b1fix(two-factor): prevent unverified TOTP enrollment from gating sign-in (#8711)85bb710chore: version packages (#9018)7495830fix(api): restore getSession accessibility in generic Auth<O> context (#9017)2e537dffix: endpoint instrumentation to always use route template (#9023)f61ad1cfix: useINVALID_PASSWORDfor allcheckPasswordfailures (#8902)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for better-auth since your current version.
Updates
better-authfrom 1.3.12 to 1.6.2Release notes
Sourced from better-auth's releases.
... (truncated)
Changelog
Sourced from better-auth's changelog.
... (truncated)
Commits
700d298chore: version packages (#9052)b20fa42fix(next-js): replace cookie probe with header-based RSC detection in nextCoo...2cbcb9bfix(oauth2): prevent cross-provider account collision in link-social callback...9deb793fix: cookie store strategy should verify oauth state (#8949)8409843feat(two-factor): include enabled 2fa methods in sign-in redirect response (#...e78a7b1fix(two-factor): prevent unverified TOTP enrollment from gating sign-in (#8711)85bb710chore: version packages (#9018)7495830fix(api): restore getSession accessibility in generic Auth<O> context (#9017)2e537dffix: endpoint instrumentation to always use route template (#9023)f61ad1cfix: useINVALID_PASSWORDfor allcheckPasswordfailures (#8902)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for better-auth since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.