fix(security): pin @better-auth/scim to 1.7.0-rc.1 (clears GHSA-j8v8-g9cx-5qf4 high) - #2710
Merged
Conversation
…-g9cx-5qf4 (high) pnpm audit --audit-level=high (the CI 'Validate Package Dependencies' gate) flags @better-auth/scim: account/provider takeover (GHSA-j8v8-g9cx-5qf4, high). plugin-auth depends on ^1.6.23 — the package's 'latest' dist-tag — but the advisory is patched ONLY in >=1.7.0-beta.4, and there is no stable patched release yet (latest = 1.6.23, newest overall = 1.7.0-rc.1). Pin to the newest pre-release (1.7.0-rc.1) via a pnpm-workspace override, the same mechanism already used for the esbuild / form-data / undici advisories. plugin-auth builds and its full suite (230 tests) passes against rc.1, so the SCIM API is compatible. Revert to a stable ^1.7.x line the moment one ships. This unblocks the audit gate for every open framework PR (main is on the same vulnerable 1.6.23 and now fails the gate too, post-disclosure). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
dependencies
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The CI
Validate Package Dependenciesgate (pnpm audit --audit-level=high) now fails on@better-auth/scim— GHSA-j8v8-g9cx-5qf4, account/provider takeover (high).plugin-authdepends on^1.6.23, which is the package'slatestdist-tag, somainis on the vulnerable line too and its audit gate fails post-disclosure. This blocks every open framework PR.The catch
The advisory is patched only in
>=1.7.0-beta.4— there is no stable patched release:So clearing the high advisory means moving to a pre-release. This PR is deliberately isolated so that trade-off is reviewed on its own.
Change
Pin
@better-auth/scimto1.7.0-rc.1(newest pre-release) via apnpm-workspace.yamloverride — the same mechanism already used for the esbuild / form-data / undici advisories.Verification
pnpm audit --audit-level=high→ high count 0 (was1 high; now2 low | 7 moderate, gate passes).@objectstack/plugin-authbuilds and its full suite (230 tests) passes against rc.1 — the SCIM API is compatible.Follow-up
Revert to a stable
^1.7.xline the moment one ships (latestmoves off 1.6.23).Reviewer decision: this accepts a SCIM release candidate as a production dependency to close a high CVE. If you'd rather keep 1.6.23 and allowlist the advisory instead, say so and I'll swap the approach.
🤖 Generated with Claude Code