deps: bump next-auth from 5.0.0-beta.31 to 5.0.0-beta.32 - #260
Merged
github-actions[bot] merged 1 commit intoAug 6, 2026
Merged
Conversation
Contributor
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
dependabot
Bot
added
the
dependencies
Collaborator
|
@dependabot rebase |
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/next-auth-5.0.0-beta.32
branch
2 times, most recently
from
August 6, 2026 11:40
efe1ea7 to
aee43f2
Compare
Bumps [next-auth](https://github.com/nextauthjs/next-auth) from 5.0.0-beta.31 to 5.0.0-beta.32. - [Release notes](https://github.com/nextauthjs/next-auth/releases) - [Commits](https://github.com/nextauthjs/next-auth/compare/next-auth@5.0.0-beta.31...next-auth@5.0.0-beta.32) --- updated-dependencies: - dependency-name: next-auth dependency-version: 5.0.0-beta.32 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/next-auth-5.0.0-beta.32
branch
from
August 6, 2026 12:23
aee43f2 to
609f584
Compare
github-actions
Bot
deleted the
dependabot/npm_and_yarn/next-auth-5.0.0-beta.32
branch
August 6, 2026 13:23
github-actions Bot
pushed a commit
that referenced
this pull request
Aug 6, 2026
…d 0.41.3 (#276) Bumping next-auth to beta.32 (#260) fixed the next-auth advisories but left one critical open. beta.32 ships its own nested @auth/core@0.41.3, while @auth/pg-adapter@1.11.2 depends on EXACTLY @auth/core@0.41.2 — the vulnerable copy — and that is the one hoisted to the top of node_modules. @auth/pg-adapter@1.11.3 requires 0.41.3, so the tree collapses to a single patched @auth/core. Advisories cleared: the Unicode-normalisation email normalizer bypass (critical), getToken() throwing on a malformed Bearer header (high), and OAuth state/nonce/PKCE cookies not bound to the transaction (medium). Verified: only one @auth/core remains in the lockfile at 0.41.3, and typecheck is clean. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps next-auth from 5.0.0-beta.31 to 5.0.0-beta.32.
Release notes
Sourced from next-auth's releases.
Commits
e293b37chore(release): next-auth@5.0.0-beta.32 [skip ci]b690d91chore: add npm bugs metadata and fix repository field format (#13452)5af7357chore(release): bump package version(s) [skip ci]8a933f9fix(core): document that getToken returns null for malformed authorization he...5b1aa47chore(ci): pin surrealdb test server to the v2 image for the 1.3 client (#13468)1116034Chore/nodemailer 8 peer deps (#13434)7b35fc3fix(docs): repair docs build broken by floating TypeScript resolution (#13450)b24abfafix(proxy): override Vercel build command so it doesn't run turbo (#13448)a99514bchore(deps): resolve remaining Dependabot alerts via cross-major dependency u...d008b9bMerge commit from fork