From 6312750f134cd41fdd8460ea82905f4076af6670 Mon Sep 17 00:00:00 2001
From: Mao Nakamoto <41178744+maonakamoto@users.noreply.github.com>
Date: Thu, 6 Aug 2026 15:58:04 +0200
Subject: [PATCH] fix(security): bump @auth/pg-adapter so @auth/core reaches
 the patched 0.41.3
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumping next-auth to beta.32 (#260) fixed the next-auth advisories but left
one critical open. beta.32 ships its own nested @auth/core@0.41.3, while
@auth/pg-adapter@1.11.2 depends on EXACTLY @auth/core@0.41.2 — the
vulnerable copy — and that is the one hoisted to the top of node_modules.

@auth/pg-adapter@1.11.3 requires 0.41.3, so the tree collapses to a single
patched @auth/core.

Advisories cleared: the Unicode-normalisation email normalizer bypass
(critical), getToken() throwing on a malformed Bearer header (high), and
OAuth state/nonce/PKCE cookies not bound to the transaction (medium).

Verified: only one @auth/core remains in the lockfile at 0.41.3, and
typecheck is clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 package-lock.json | 47 +++++++++--------------------------------------
 package.json      |  2 +-
 2 files changed, 10 insertions(+), 39 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index d7d683557..18edbdfbe 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9,7 +9,7 @@
       "version": "0.1.0",
       "license": "MIT",
       "dependencies": {
-        "@auth/pg-adapter": "^1.11.1",
+        "@auth/pg-adapter": "^1.11.3",
         "@aws-sdk/client-s3": "^3.1070.0",
         "@eslint/eslintrc": "^3.3.3",
         "@eslint/js": "^9.39.2",
@@ -178,9 +178,9 @@
       "license": "ISC"
     },
     "node_modules/@auth/core": {
-      "version": "0.41.2",
-      "resolved": "https://registry.npmjs.org/@auth/core/-/core-0.41.2.tgz",
-      "integrity": "sha512-Hx5MNBxN2fJTbJKGUKAA0wca43D0Akl3TvufY54Gn8lop7F+34vU1zA1pn0vQfIoVuLIrpfc2nkyjwIaPJMW7w==",
+      "version": "0.41.3",
+      "resolved": "https://registry.npmjs.org/@auth/core/-/core-0.41.3.tgz",
+      "integrity": "sha512-sJ3JMHHkXMD3aOjopv7mOBTO1Ocw4b0fAEXJBz6k7YHLpYQI6C40jCUPc5fNvUKxXRXNE1/sRISA15UrwWJBTw==",
       "license": "ISC",
       "dependencies": {
         "@panva/hkdf": "^1.2.1",
@@ -192,7 +192,7 @@
       "peerDependencies": {
         "@simplewebauthn/browser": "^9.0.1",
         "@simplewebauthn/server": "^9.0.2",
-        "nodemailer": "^7.0.7"
+        "nodemailer": "^7.0.7 || ^8.0.5"
       },
       "peerDependenciesMeta": {
         "@simplewebauthn/browser": {
@@ -207,12 +207,12 @@
       }
     },
     "node_modules/@auth/pg-adapter": {
-      "version": "1.11.2",
-      "resolved": "https://registry.npmjs.org/@auth/pg-adapter/-/pg-adapter-1.11.2.tgz",
-      "integrity": "sha512-GPT3EkNtQiZ5fVycoTjQ9KeplnAhOCA2RVf0AXJffT1wrYpoN3zyg02W4F7oAOnB5NYsF09SPuRXZyjtiE6VSQ==",
+      "version": "1.11.3",
+      "resolved": "https://registry.npmjs.org/@auth/pg-adapter/-/pg-adapter-1.11.3.tgz",
+      "integrity": "sha512-6yPx8rWH3h3hv5jmVQvuQSPBpaC+jsfuxn7vl8W8Od6kOymGpw7Ku+plWCY7dFb2ya6KaBNw15GG6nciX9ewBA==",
       "license": "ISC",
       "dependencies": {
-        "@auth/core": "0.41.2"
+        "@auth/core": "0.41.3"
       },
       "peerDependencies": {
         "pg": "^8"
@@ -15967,35 +15967,6 @@
         }
       }
     },
-    "node_modules/next-auth/node_modules/@auth/core": {
-      "version": "0.41.3",
-      "resolved": "https://registry.npmjs.org/@auth/core/-/core-0.41.3.tgz",
-      "integrity": "sha512-sJ3JMHHkXMD3aOjopv7mOBTO1Ocw4b0fAEXJBz6k7YHLpYQI6C40jCUPc5fNvUKxXRXNE1/sRISA15UrwWJBTw==",
-      "license": "ISC",
-      "dependencies": {
-        "@panva/hkdf": "^1.2.1",
-        "jose": "^6.0.6",
-        "oauth4webapi": "^3.3.0",
-        "preact": "10.24.3",
-        "preact-render-to-string": "6.5.11"
-      },
-      "peerDependencies": {
-        "@simplewebauthn/browser": "^9.0.1",
-        "@simplewebauthn/server": "^9.0.2",
-        "nodemailer": "^7.0.7 || ^8.0.5"
-      },
-      "peerDependenciesMeta": {
-        "@simplewebauthn/browser": {
-          "optional": true
-        },
-        "@simplewebauthn/server": {
-          "optional": true
-        },
-        "nodemailer": {
-          "optional": true
-        }
-      }
-    },
     "node_modules/next-intl": {
       "version": "4.13.4",
       "resolved": "https://registry.npmjs.org/next-intl/-/next-intl-4.13.4.tgz",
diff --git a/package.json b/package.json
index b737900a6..ded03649c 100644
--- a/package.json
+++ b/package.json
@@ -89,7 +89,7 @@
     "compliance:i18n-stale": "node scripts/i18n-stale.mjs"
   },
   "dependencies": {
-    "@auth/pg-adapter": "^1.11.1",
+    "@auth/pg-adapter": "^1.11.3",
     "@aws-sdk/client-s3": "^3.1070.0",
     "@eslint/eslintrc": "^3.3.3",
     "@eslint/js": "^9.39.2",