build(deps): bump the npm-minor-patch group with 6 updates by dependabot[bot] · Pull Request #13 · OpenMeshTAK/openmeshtak

dependabot · 2026-10-30T12:44:44Z

Bumps the npm-minor-patch group with 6 updates:

Package	From	To
@better-auth/passkey	`1.7.11`	`1.7.12`
@better-auth/prisma-adapter	`1.7.11`	`1.7.12`
better-auth	`1.7.11`	`1.7.12`
dotenv	`18.0.8`	`18.0.9`
auth	`1.7.11`	`1.7.12`
typescript-eslint	`8.71.2`	`8.72.0`

Updates @better-auth/passkey from 1.7.11 to 1.7.12

Release notes

Sourced from @better-auth/passkey's releases.

v1.7.12

[!IMPORTANT] Action required

If you use ID token sign-in with a provider that has no clientId, set clientId to every client ID your apps sign in with. (#11931)

better-auth

Bug Fixes

Fixed the JWT plugin to verify JWTs and session cookie-cache JWTs with the stored key's algorithm instead of the token header's, and to warn when signing or verifying a JWT without an issuer or audience (#11925)

Fixed OAuth callbacks completed through the OAuth proxy to run the same checks as the standard OAuth callback, including issuer and ID token nonce validation (#11930)

Fixed auth.api.getSession() to keep the original database error as error.cause when the session lookup fails (#11924)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

Fixed mapProfileToUser failing to typecheck under exactOptionalPropertyTypes when it returns undefined for name, email, or image (#11918)

Fixed ID token sign-in to reject tokens when the provider has no client ID, since their audience cannot be checked (#11931)

Fixed a custom Facebook getUserInfo to no longer receive client-submitted access tokens issued to another Facebook app, and ID tokens missing exp or iat are now rejected (#11919)

Restored the Twitch and Paybin ID token handling from before 1.7.11, which made account info fail once the ID token stored at sign-in expired (#11920)

Added a cause option as a third argument to APIError.from() to keep the underlying error for server-side callers without exposing it in the response (#11924)

For detailed changes, see CHANGELOG

@better-auth/mcp

Bug Fixes

Fixed requireMcpAuth to accept only OAuth access tokens and reject session JWTs from the JWT plugin, even when they share the issuer and audience (#11934)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

Fixed OIDC SSO sign-in to reject ID tokens missing exp or iat and providers with an empty client ID, matching social sign-in (#11935)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@alpcanaydin, @bytaesu

... (truncated)

Changelog

Sourced from @better-auth/passkey's changelog.

1.7.12

Commits

f4260a9 chore: release v1.7.12 (#11922)
See full diff in compare view

Updates @better-auth/prisma-adapter from 1.7.11 to 1.7.12

Release notes

Sourced from @better-auth/prisma-adapter's releases.

v1.7.12

[!IMPORTANT] Action required

If you use ID token sign-in with a provider that has no clientId, set clientId to every client ID your apps sign in with. (#11931)

better-auth

Bug Fixes

Fixed the JWT plugin to verify JWTs and session cookie-cache JWTs with the stored key's algorithm instead of the token header's, and to warn when signing or verifying a JWT without an issuer or audience (#11925)

Fixed OAuth callbacks completed through the OAuth proxy to run the same checks as the standard OAuth callback, including issuer and ID token nonce validation (#11930)

Fixed auth.api.getSession() to keep the original database error as error.cause when the session lookup fails (#11924)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

Fixed mapProfileToUser failing to typecheck under exactOptionalPropertyTypes when it returns undefined for name, email, or image (#11918)

Fixed ID token sign-in to reject tokens when the provider has no client ID, since their audience cannot be checked (#11931)

Fixed a custom Facebook getUserInfo to no longer receive client-submitted access tokens issued to another Facebook app, and ID tokens missing exp or iat are now rejected (#11919)

Restored the Twitch and Paybin ID token handling from before 1.7.11, which made account info fail once the ID token stored at sign-in expired (#11920)

Added a cause option as a third argument to APIError.from() to keep the underlying error for server-side callers without exposing it in the response (#11924)

For detailed changes, see CHANGELOG

@better-auth/mcp

Bug Fixes

Fixed requireMcpAuth to accept only OAuth access tokens and reject session JWTs from the JWT plugin, even when they share the issuer and audience (#11934)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

Fixed OIDC SSO sign-in to reject ID tokens missing exp or iat and providers with an empty client ID, matching social sign-in (#11935)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@alpcanaydin, @bytaesu

... (truncated)

Changelog

Sourced from @better-auth/prisma-adapter's changelog.

1.7.12

Commits

f4260a9 chore: release v1.7.12 (#11922)
See full diff in compare view

Updates better-auth from 1.7.11 to 1.7.12

Release notes

Sourced from better-auth's releases.

v1.7.12

[!IMPORTANT] Action required

If you use ID token sign-in with a provider that has no clientId, set clientId to every client ID your apps sign in with. (#11931)

better-auth

Bug Fixes

Fixed the JWT plugin to verify JWTs and session cookie-cache JWTs with the stored key's algorithm instead of the token header's, and to warn when signing or verifying a JWT without an issuer or audience (#11925)

Fixed OAuth callbacks completed through the OAuth proxy to run the same checks as the standard OAuth callback, including issuer and ID token nonce validation (#11930)

Fixed auth.api.getSession() to keep the original database error as error.cause when the session lookup fails (#11924)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

Fixed mapProfileToUser failing to typecheck under exactOptionalPropertyTypes when it returns undefined for name, email, or image (#11918)

Fixed ID token sign-in to reject tokens when the provider has no client ID, since their audience cannot be checked (#11931)

Fixed a custom Facebook getUserInfo to no longer receive client-submitted access tokens issued to another Facebook app, and ID tokens missing exp or iat are now rejected (#11919)

Restored the Twitch and Paybin ID token handling from before 1.7.11, which made account info fail once the ID token stored at sign-in expired (#11920)

Added a cause option as a third argument to APIError.from() to keep the underlying error for server-side callers without exposing it in the response (#11924)

For detailed changes, see CHANGELOG

@better-auth/mcp

Bug Fixes

Fixed requireMcpAuth to accept only OAuth access tokens and reject session JWTs from the JWT plugin, even when they share the issuer and audience (#11934)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

Fixed OIDC SSO sign-in to reject ID tokens missing exp or iat and providers with an empty client ID, matching social sign-in (#11935)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@alpcanaydin, @bytaesu

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.12

Patch Changes

#11925 fb48619 Thanks @bytaesu! - The JWT plugin now verifies JWTs and session cookie-cache JWTs with the algorithm of the stored key instead of the one named in the token header, and logs a warning when it signs or verifies a JWT without an issuer or audience.

#11924 681aa5c Thanks @bytaesu! - auth.api.getSession() now keeps the original database error as error.cause when the session lookup fails, so server code can tell a transient failure from a bug.

#11930 b18e3b8 Thanks @bytaesu! - OAuth callbacks completed through the OAuth proxy now run the same checks as the standard OAuth callback, including issuer and ID token nonce validation.

Updated dependencies [681aa5c, 4bc78ba, 876608d, 083a743, 492134a]:

@better-auth/core@1.7.12

@better-auth/drizzle-adapter@1.7.12

@better-auth/kysely-adapter@1.7.12

@better-auth/memory-adapter@1.7.12

@better-auth/mongo-adapter@1.7.12

@better-auth/prisma-adapter@1.7.12

@better-auth/telemetry@1.7.12

Commits

f4260a9 chore: release v1.7.12 (#11922)
b18e3b8 fix(oauth-proxy): run the standard callback checks on proxied callbacks (#11930)
fb48619 fix(jwt): verify tokens with the stored key's algorithm (#11925)
681aa5c fix(session): keep the cause of session lookup failures (#11924)
See full diff in compare view

Updates dotenv from 18.0.8 to 18.0.9

Changelog

Sourced from dotenv's changelog.

18.0.9 (2026-10-14)

Changed

Permit DOTENV_PATH being empty string with the CLI (#1076)

Commits

8d1ab85 18.0.9
59a40ce changelog
88228bd Merge pull request #1076 from Enesuygurs/fix/cli-empty-dotenv-path
bc6ef94 fix(cli): load the default .env when DOTENV_PATH is empty
6d6e6c5 Merge pull request #1075 from kory-kaai/test/fast-parser-branch-coverage
10218f1 test(parse-fast): cover the size-dependent and export-prefix branches
See full diff in compare view

Updates auth from 1.7.11 to 1.7.12

Release notes

Sourced from auth's releases.

v1.7.12

[!IMPORTANT] Action required

If you use ID token sign-in with a provider that has no clientId, set clientId to every client ID your apps sign in with. (#11931)

better-auth

Bug Fixes

Fixed the JWT plugin to verify JWTs and session cookie-cache JWTs with the stored key's algorithm instead of the token header's, and to warn when signing or verifying a JWT without an issuer or audience (#11925)

Fixed OAuth callbacks completed through the OAuth proxy to run the same checks as the standard OAuth callback, including issuer and ID token nonce validation (#11930)

Fixed auth.api.getSession() to keep the original database error as error.cause when the session lookup fails (#11924)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

Fixed mapProfileToUser failing to typecheck under exactOptionalPropertyTypes when it returns undefined for name, email, or image (#11918)

Fixed ID token sign-in to reject tokens when the provider has no client ID, since their audience cannot be checked (#11931)

Fixed a custom Facebook getUserInfo to no longer receive client-submitted access tokens issued to another Facebook app, and ID tokens missing exp or iat are now rejected (#11919)

Restored the Twitch and Paybin ID token handling from before 1.7.11, which made account info fail once the ID token stored at sign-in expired (#11920)

Added a cause option as a third argument to APIError.from() to keep the underlying error for server-side callers without exposing it in the response (#11924)

For detailed changes, see CHANGELOG

@better-auth/mcp

Bug Fixes

Fixed requireMcpAuth to accept only OAuth access tokens and reject session JWTs from the JWT plugin, even when they share the issuer and audience (#11934)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

Fixed OIDC SSO sign-in to reject ID tokens missing exp or iat and providers with an empty client ID, matching social sign-in (#11935)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@alpcanaydin, @bytaesu

... (truncated)

Changelog

Sourced from auth's changelog.

1.7.12

Patch Changes

Updated dependencies [681aa5c, 4bc78ba, 876608d, fb48619, 681aa5c, 083a743, b18e3b8, 492134a]:

@better-auth/core@1.7.12

better-auth@1.7.12

@better-auth/telemetry@1.7.12

Commits

f4260a9 chore: release v1.7.12 (#11922)
See full diff in compare view

Updates typescript-eslint from 8.71.2 to 8.72.0

Release notes

Sourced from typescript-eslint's releases.

v8.72.0

8.72.0 (2026-10-19)

🚀 Features

eslint-plugin: lazy load rules (#13010)

eslint-plugin: [await-thenable] add allowMixedPromiseArrays option (#12992)

typescript-estree: error on abstract keyword that precedes export (#13019)

🩹 Fixes

ast-spec: add JSXFragment to JSXAttribute['value'] (#13051)

eslint-plugin: [prefer-readonly-parameter-types] check where allowed type aliases are declared (#13016)

eslint-plugin: [no-deprecated] report deprecated properties in object literals (#12704)

eslint-plugin: use isTypeLiteralType instead of type.isLiteral() to include bigint literals on TS < 5.0 (#13053)

eslint-plugin: [require-array-sort-compare] check tuples (#13058)

eslint-plugin: [require-array-sort-compare] ignore extra this type argument on TS < 5.1 (#13055)

type-utils: discriminateAnyType crashes when calling getAwaitedType on awaited type in TS < 5.0 (#13054)

typescript-estree: include leading and trailing comments & whitespace in Program range (#12991)

❤️ Thank You

Evyatar Daud @StyleShit

Junichiro Kasuya @jksy

Mitch Fultz @fitchmultz

Shaan GS @ShaanGS

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.72.0 (2026-10-19)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

a4c2603 chore(release): publish 8.72.0
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the npm-minor-patch group with 6 updates: | Package | From | To | | --- | --- | --- | | [@better-auth/passkey](https://github.com/better-auth/better-auth/tree/HEAD/packages/passkey) | `1.7.11` | `1.7.12` | | [@better-auth/prisma-adapter](https://github.com/better-auth/better-auth/tree/HEAD/packages/prisma-adapter) | `1.7.11` | `1.7.12` | | [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.11` | `1.7.12` | | [dotenv](https://github.com/motdotla/dotenv) | `18.0.8` | `18.0.9` | | [auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/cli) | `1.7.11` | `1.7.12` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.71.2` | `8.72.0` | Updates `@better-auth/passkey` from 1.7.11 to 1.7.12 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/passkey/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.12/packages/passkey) Updates `@better-auth/prisma-adapter` from 1.7.11 to 1.7.12 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/prisma-adapter/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.12/packages/prisma-adapter) Updates `better-auth` from 1.7.11 to 1.7.12 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.12/packages/better-auth) Updates `dotenv` from 18.0.8 to 18.0.9 - [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md) - [Commits](motdotla/dotenv@v18.0.8...v18.0.9) Updates `auth` from 1.7.11 to 1.7.12 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/cli/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.12/packages/cli) Updates `typescript-eslint` from 8.71.2 to 8.72.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.0/packages/typescript-eslint) --- updated-dependencies: - dependency-name: "@better-auth/passkey" dependency-version: 1.7.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: "@better-auth/prisma-adapter" dependency-version: 1.7.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: better-auth dependency-version: 1.7.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: dotenv dependency-version: 18.0.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: auth dependency-version: 1.7.12 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: typescript-eslint dependency-version: 8.72.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 30, 2026

build(deps): accept the caniuse-lite 1.0.30001820 data update

5f7320a

spkesDE merged commit b724ac6 into main Oct 30, 2026
4 checks passed

spkesDE deleted the dependabot/npm_and_yarn/npm-minor-patch-9a389d3771 branch October 30, 2026 13:57

Navigation Menu

Repository navigation

build(deps): bump the npm-minor-patch group with 6 updates - #13

build(deps): bump the npm-minor-patch group with 6 updates#13
spkesDE merged 2 commits into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-9a389d3771

dependabot Bot commented on behalf of github Oct 30, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 30, 2026

v1.7.12

better-auth

Bug Fixes

@better-auth/core

Bug Fixes

@better-auth/mcp

Bug Fixes

@better-auth/sso

Bug Fixes

Contributors

1.7.12

v1.7.12

better-auth

Bug Fixes

@better-auth/core

Bug Fixes

@better-auth/mcp

Bug Fixes

@better-auth/sso

Bug Fixes

Contributors

1.7.12

v1.7.12

better-auth

Bug Fixes

@better-auth/core

Bug Fixes

@better-auth/mcp

Bug Fixes

@better-auth/sso

Bug Fixes

Contributors

1.7.12

Patch Changes

18.0.9 (2026-10-14)

Changed

v1.7.12

better-auth

Bug Fixes

@better-auth/core

Bug Fixes

@better-auth/mcp

Bug Fixes

@better-auth/sso

Bug Fixes

Contributors

1.7.12

Patch Changes

v8.72.0

8.72.0 (2026-10-19)

🚀 Features

🩹 Fixes

❤️ Thank You

8.72.0 (2026-10-19)

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

`better-auth`

`@better-auth/core`

`@better-auth/mcp`

`@better-auth/sso`

`better-auth`

`@better-auth/core`

`@better-auth/mcp`

`@better-auth/sso`

`better-auth`

`@better-auth/core`

`@better-auth/mcp`

`@better-auth/sso`

`better-auth`

`@better-auth/core`

`@better-auth/mcp`

`@better-auth/sso`