chore(deps): update all non-major dependencies#257
Merged
Conversation
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
commit: |
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
9a18f98 to
1f1d603
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
1f1d603 to
b8e58cf
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
b8e58cf to
98d0227
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^1.6.10→^1.6.11^1.2.107→^1.2.108^1.2.82→^1.2.83^6.0.6→^6.0.7>=0.12.3→>=0.12.4^6.0.177→^6.0.185^1.6.10→^1.6.11^12.9.0→^12.10.0^2.5.120→^2.5.124^2.9.12→^2.9.14^8.0.12→^8.0.13^3.2.8→^3.3.0Release Notes
better-auth/better-auth (@better-auth/api-key)
v1.6.11Compare Source
Patch Changes
#9505
b039985Thanks @Kvizas! - API key requests that exceed the configured rate limit now return HTTP 429 (Too Many Requests) instead of HTTP 401 (Unauthorized), so clients can distinguish throttling from authentication failures.Updated dependencies [
0cbddb8,a26333b,99a254a,ee93485,5f09d56,b4bc65a,da7e50b,a1c9f3c,23094a6,142b86c,1f2ff42,b0ef96f,699b09a,e21d744]:vitejs/vite-plugin-vue (@vitejs/plugin-vue)
v6.0.7Features
@rolldown/pluginutilsversion (#776) (941b651)Bug Fixes
cloudflare/agents (agents)
v0.12.4Compare Source
Patch Changes
#1376
6561a3fThanks @hrushikeshdeshpande! - Avoid throwing when chat stream resume negotiation/replay races with a closed WebSocket connection.#1509
4aa4176Thanks @threepointone! - Prevent duplicate initial state frames during Agent WebSocket connection setup so client-originated state updates are not overwritten by stale initial state messages.#1476
3c48858Thanks @whoiskatrin! - Fixed a bug that could cause client state to drift from internal Durable Object state when agent tool calls spanned a Durable Object restart. Recovery now defers user finish hooks until after agent startup and isolates hook failures so one failed mirror write does not block other recovered runs from finalizing.#1514
0371a6fThanks @threepointone! - Route streamable HTTP server-to-client requests through the originating POST stream when no standalone SSE stream is available.#1500
7090e9eThanks @threepointone! - Preserve structured tool output shapes when truncating older messages or oversized persisted rows, preventing customtoModelOutputhandlers from crashing or mis-replaying compacted results.Also harden Think's workspace
readtool so legacy raw-string read outputs replay as text instead of stalling subsequent turns.#1504
5d27b71Thanks @threepointone! - Prune stale sub-agent schedule rows when their owning facet registry entry no longer exists.#1503
7b8ab51Thanks @threepointone! - Bump PartyServer to pick up transient Durable Object routing retries and exposeroutingRetryconfiguration throughgetAgentByName.vercel/ai (ai)
v6.0.185Compare Source
Patch Changes
488ef33]v6.0.184Compare Source
Patch Changes
40fc5e4: fix(ai): default missing embedding warnings to an empty arrayv6.0.183Compare Source
Patch Changes
363cefe]v6.0.182Compare Source
Patch Changes
e76a29a: fix(ai): download tool-result file URLsv6.0.180Compare Source
Patch Changes
253bd5a: fix(gateway): enable retry support for gateway errors57ec10f: fix URL of hero animation in README253bd5a]v6.0.178Compare Source
Patch Changes
ac6f27e: fix(ai): update opentelemetry pinned versionbetter-auth/better-auth (better-auth)
v1.6.11Compare Source
Patch Changes
#9568
0cbddb8Thanks @gustavovalverde! - AddinternalAdapter.consumeVerificationValue(identifier): atomically consume a verification row keyed by identifier. The first concurrent caller receives the row; later racers receivenull. Backed by a newDBAdapter.consumeOneprimitive implemented natively per adapter (memory, mongo, drizzle, kysely, prisma), with atransaction(findMany + delete)factory fallback.SecondaryStorage.getAndDeleteis added as an optional companion; Redis ships it via an atomic Lua get-and-delete operation for compatibility with Redis versions before 6.2.#9162
a26333bThanks @ping-maxwell! - fix: cleanup sessions when admin, anonymous, or SCIM deletes a user#9573
99a254aThanks @gustavovalverde! - fix(device-authorization): require verify-time ownership claim for approve/denyPending device codes were not bound to the user who entered the code on the verification page until approval, leaving a window where any authenticated user could approve or deny another user's pending code by knowing the
user_code.GET /devicenow claims the pending row for the calling session, andPOST /device/approveandPOST /device/denyrequire the calling session to match the claimed owner. Custom verification pages must be served to an authenticated session for the flow to succeed.#8948
ee93485Thanks @ping-maxwell! - fix: add error code to change-email-disabled#9572
5f09d56Thanks @gustavovalverde! - Fix race condition in themagic-linkplugin's verify handler that allowed two concurrent requests to mint two sessions from the same single-use token. The handler now consumes the verification row atomically viainternalAdapter.consumeVerificationValue, so a given magic link mints at most one session regardless of concurrency. TheallowedAttemptsoption is retained for backward compatibility but no longer multiplies successful redemptions; tokens are single-use. The second-redeem error code changes fromATTEMPTS_EXCEEDEDtoINVALID_TOKEN(the token no longer exists after consumption).b4bc65aThanks @gustavovalverde! - Fix race condition in the OAuth authorization-code grant: two concurrent token-exchange requests sharing the samecodecould both pass the find step before either delete completed and each mint an independent access/refresh/id token set. Theauthorization_codehandler in@better-auth/oauth-provider, plus the legacyoidc-providerandmcpplugins inbetter-auth, now consume the verification row atomically viainternalAdapter.consumeVerificationValue. The first caller mints tokens; concurrent racers receiveinvalid_grant(RFC 6749 §5.2). Malformed-verification-value branches in@better-auth/oauth-providerpreviously returned a project-specificinvalid_verificationcode; those are nowinvalid_grantso spec-compliant clients can branch on the standard code.#9578
da7e50bThanks @gustavovalverde! -handleOAuthUserInfo(used by every social provider, generic-oauth, oauth-proxy, SSO OIDC and SAML, and idToken sign-in) implicitly linked a returning OAuth identity into a local user row whenever the IdP'semail_verifiedclaim was true or the provider was trusted. The local row's ownemailVerifiedflag was read only to flip it after linking, never as a precondition.POST /sign-up/emailcreates rows withemailVerified: falsefor any caller, so an attacker who pre-registered a victim's email at the application could wait for the legitimate user's first OAuth sign-in: the IdP's verified claim was treated as ownership proof, and the victim's IdP identity was linked into the attacker-owned row.The implicit-link gate now requires
dbUser.user.emailVerified === truein addition to the provider trust check by default. A newaccount.accountLinking.requireLocalEmailVerifiedoption (defaulttrue) is the public surface for this gate. Apps whose users sign up via OAuth without verifying their email locally can opt back into the legacy behavior withaccount: { accountLinking: { requireLocalEmailVerified: false } }; understand the takeover risk before doing so. The option is@deprecated; a FIXME at each gate site points at the next-minor follow-up onnextthat drops the option and makes the gate unconditional.The
one-tapplugin honored its own copy of the gate and was updated identically:requireLocalEmailVerifiedandaccountLinking.disableImplicitLinkingboth apply on/one-tap/callback. Theemail_verifiedclaim from the Google ID token is now normalized viatoBooleanso a string"false"is treated as falsy.Test fixtures across
admin,oidc-provider,mcp,generic-oauth,last-login-method, andoauth-providersuites now mark usersemailVerified: truevia adatabaseHooks.user.create.beforehook (or thedisableTestUseropt-in on the oauth-provider RP) so the suites continue to exercise their role/flow logic rather than the new gate.#9507
a1c9f3cThanks @GautamBytes! - Preserve exact access-control role statement types so predefined organization roles expose only their configured permissions in TypeScript.#9577
23094a6Thanks @gustavovalverde! - The organization plugin's invitation recipient endpoints (acceptInvitation,rejectInvitation,getInvitation,listUserInvitations) treatedinvitation.email.toLowerCase() === session.user.email.toLowerCase()as proof that the calling user owned the invited address. A session-authenticated user whose email matched but was never verified passed the gate, so anyone who could pre-register an unverified account at a victim's email could accept invitations addressed to that email. TherequireEmailVerificationOnInvitationopt-in option closed the gap only when explicitly enabled and did not protectgetInvitationorlistUserInvitationsat all.The gate is now applied on all four recipient endpoints and the
requireEmailVerificationOnInvitationoption default flips fromfalsetotrueso existing apps are secure by default. Apps that intentionally accept invitations from unverified accounts can keep the legacy permissive behavior withorganization({ requireEmailVerificationOnInvitation: false }), but they should understand the takeover risk before doing so. Server-side calls tolistUserInvitationswithctx.query.emailand no session continue to bypass the gate (the caller is trusted).The option is
@deprecated. The next-minor release onnextremoves it entirely and makes the gate unconditional.#9548
142b86cThanks @dipan-ck! - anonymous plugin now correctly calls onLinkAccount when email verification triggers auto sign-in#9576
1f2ff42Thanks @gustavovalverde! - fix(oidc-provider, mcp): authenticate confidential clients on refresh_token grant and harden secret comparisonRefresh-token grants on the legacy
oidc-providerandmcpplugins now require the registeredclient_secretfrom confidential clients, matching theauthorization_codepath. Public clients (wherecode_verifiersubstitutes for the secret on the auth-code grant) continue to skip secret validation. Secret comparisons across both plugins now use constant-time equality. The/mcp/tokenendpoint no longer emits a wildcard CORSAccess-Control-Allow-Origin: *header.These plugins are deprecated in favor of
@better-auth/oauth-provider, which is unaffected. New deployments should adopt the replacement; this patch keeps existing deployments protected while migrating.#9575
699b09aThanks @gustavovalverde! - fix(oidc-provider, mcp): drop"none"from advertised signing algorithms, defaultallowPlainCodeChallengeMethodtofalse, and reject missing PKCE methodThe legacy
oidc-providerandmcpplugins now follow OAuth 2.1 (RFC 9700) on three protocol gates:id_token_signing_alg_values_supported(oidc-provider, mcp) andresource_signing_alg_values_supported(mcp) no longer include"none". Relying parties that negotiate from this list will no longer be steered toward unsigned tokens.allowPlainCodeChallengeMethoddefaults tofalse. Callers who needplainPKCE must opt in explicitly.code_challenge_methodto"plain"before the allowlist check. A request that providescode_challengewithoutcode_challenge_methodis now rejected withinvalid_request; the inverse case (code_challenge_methodwithoutcode_challenge) is also rejected so no inconsistent PKCE state is persisted on the authorization code record.Non-breaking for callers who never relied on
"none"advertisement or the plain default. Callers who explicitly setallowPlainCodeChallengeMethod: truekeepplainon the allowlist and retain the legacy "missing method defaults to plain" behavior for backward compatibility, so existing integrations that opted into plain PKCE continue to work. The next-minor onnextwill drop both theplainallowlist entry and this fallback; until then, the option is the single explicit knob for legacy behavior. Migrate to@better-auth/oauth-providerfor the canonical, spec-aligned implementation.Updated dependencies [
0cbddb8,c6918ec,da7e50b,b0ef96f,e21d744]:WiseLibs/better-sqlite3 (better-sqlite3)
v12.10.0Compare Source
What's Changed
Full Changelog: WiseLibs/better-sqlite3@v12.9.1...v12.10.0
vercel/turborepo (turbo)
v2.9.14: Turborepo v2.9.14Compare Source
High:
Low:
What's Changed
Changelog
pull_requestfor PR title linting by @anthonyshew in #12787New Contributors
Full Changelog: vercel/turborepo@v2.9.12...v2.9.14
vitejs/vite (vite)
v8.0.13Compare Source
Features
onEnd(#22357) (47071ce)Bug Fixes
write=false(#22328) (158e8ae)name/originalFileNamein syntheticassetFileNamescall (#22439) (8e59c97)isBundledper environment (#22257) (a576326)Miscellaneous Chores
vuejs/language-tools (vue-tsc)
v3.3.0Compare Source
language-core
v-ifbranch fragments when collecting single root nodes - Thanks to @KazariEX!SfcAPIs toIR- Thanks to @KazariEX!language-service
html.customData(#5910) - Thanks to @Bomberus!=""only for plain boolean props completion edits - Thanks to @KazariEX!typescript-plugin
vscode
extraFileExtensionsin tsserverconfigurerequest payload (#6048) - Thanks to @KazariEX!v3.2.9Compare Source
language-core
vscode
workspace
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.