isyuricunha/website
Watch
1
0
Fork
You've already forked website
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore(deps): bump the all-patch-minor group across 1 directory with 12 updates #128

Closed
dependabot[bot] wants to merge 1 commit from dependabot/npm_and_yarn/all-patch-minor-03e242fb7b into main
pull from: dependabot/npm_and_yarn/all-patch-minor-03e242fb7b
merge into: isyuricunha:main
Conversation 3 Commits 1 Files changed 13 +936 -1256
dependabot[bot] commented 2026-05-14 07:49:27 +00:00 (Migrated from github.com)

Bumps the all-patch-minor group with 12 updates in the / directory:

Package From To
@types/node 25.6.0 25.7.0
next 16.2.4 16.2.6
react 19.2.5 19.2.6
react-dom 19.2.5 19.2.6
zod 4.3.5 4.4.3
@trpc/client 11.16.0 11.17.0
@trpc/react-query 11.16.0 11.17.0
@trpc/server 11.16.0 11.17.0
better-auth 1.6.5 1.6.11
drizzle-kit 0.31.6 0.31.10
react-email 6.0.0 6.1.4
prettier-plugin-tailwindcss 0.7.4 0.8.0

Updates @types/node from 25.6.0 to 25.7.0

Commits

Updates next from 16.2.4 to 16.2.6

Release notes

Sourced from next's releases.

v16.2.6

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

Moderate:

Low:

Core Changes

  • fix: preserve HTTP access fallbacks during prerender recovery (#92231)
  • Fix fallback route params case in app-page handler (#91737)
  • Fix invalid HTML response for route-level RSC requests in deployment adapter (#91541)
  • Patch setHeader for direct route handlers (#93101)
  • Include deployment id in cacheHandlers keys (#93453)
  • Fix double-encoding of URL pathname parts in client param parsing (#93491)

v16.2.5

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

... (truncated)

Commits
  • ee6e79b v16.2.6
  • afa053d Turbopack: Match proxy matchers with webpack implementation (#93594)
  • 97a154e Turbopack: Fix middleware matcher suffix (#93590)
  • 83899bc [backport] Disable build caches for production/staging/force-preview deploys ...
  • 7b222b9 [backport][test] Pin package manager to patch versions (#93595)
  • a8dc24f [backport] Turbopack: more strict vergen setup (#93587)
  • 766148f v16.2.5
  • 0dd9483 fix: add explicit checks for RSC header (#83) (#98)
  • d166096 fix proxy matching for segment prefetch URLs (#89) (#96)
  • 9d50c0b Strip next-resume header from incoming requests (#92)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.


Updates react from 19.2.5 to 19.2.6

Release notes

Sourced from react's releases.

19.2.6 (May 6th, 2026)

React Server Components

Commits

Updates react-dom from 19.2.5 to 19.2.6

Release notes

Sourced from react-dom's releases.

19.2.6 (May 6th, 2026)

React Server Components

Commits

Updates zod from 4.3.5 to 4.4.3

Release notes

Sourced from zod's releases.

v4.4.3

Commits:

  • 4c2fa95ce3f3390fbc522324e406b4e9e89b88f9 docs: use Zernio primary wordmark for gold sponsor logo
  • 2aeec83eb135e3a83756e973ef44845fc5a455d2 docs: prune lapsed gold sponsors and rebalance logo sizing
  • 7391be88ac1ee5cd02057f5ccc012a1f5df4efd0 docs: prune lapsed silver/bronze sponsors and add active ones
  • 2c703322a21b4e2b12f33f49ea8430c451a68b4f docs: normalize bronze sponsor logos to github avatar pattern
  • 9195250cab0e7950efe39c3926d6c203b4b0a170 docs: remove Mintlify from bronze sponsors (churned)
  • b8dffe9e62f17e6571e6249d05cc5102b54d94e4 docs: remove Numeric and Speakeasy (2+ missed monthly cycles)
  • 1cab69383fcdeae2a366d5e2a2fc4d8fc765d168 fix(v4): restore catch handling for absent object keys (#5937) (#5939)
  • c2be4f819064eed62c7c350a2d399b5faecd15f8 fix(v4): generalize optin/fallback to transform; restore preprocess on absent keys (#5941)
  • f3c9ec03ba7a28ae72d25cc295f38674bee0f559 4.4.3
  • 1fb56a5c18c27102dbc92260a4007c7732a0ccca docs: document release procedure in AGENTS.md

v4.4.2

Commits:

  • 0c62df0ea19fd05abdf90473e9eef7eea530fab2 Clean up docs navigation and stale labels (#5901)
  • 20cc794895cc8604fe0c87d83a5d1c3f89fad0ac chore: add security policy and refresh tooling deps
  • 6fbe07b0177efdd1bf1c0b05160e70d7a0702337 fix(docs): heading anchor links now include the hash so it doesnt scoll all the way up, follows navbar logic (#5791)
  • 4bbed1b1c73eca4ce9e59b1189ed236aa6c8b5bd Tighten discriminated union option typing
  • bbac3e567e7fccfaaf7cdc97f1ce30c295e2c908 Update PR guidance for agents
  • cf0dc942a32805c292fff59ade20a7ace980735a Merge remote-tracking branch 'origin/main' into fix-discriminated-union-key-constraint
  • 292c894a5fd2aa42e527900b83d8d7a3009a709c docs: add Zernio gold sponsor
  • 1fc9f311c28dcf80d0bb5a36b177086cbc3d8eca docs: document codec inversion
  • 1373c85da9aeff704a9762d27bc58699618aefb7 docs: remove AI disclosure guidance
  • e20d02b473c08e3a4e557bc610b1b5fac079b649 chore: ignore triage notes
  • e58ea4d91b1dfe8194b73508203213cbc7e9c936 docs: test Zod Mini tab code heights
  • 905761a5d127e8d5dd2ebb3bc88c75cb0b8149ff docs: document preprocess input type narrowing
  • bf64bac850d4dee2b7dde7e64909d5d796d32043 chore: tighten test guidance in AGENTS.md
  • 8ec4e73f4c4693b6361ad591be40fb41eb8a9f95 chore: update play.ts scratch
  • 02c2baf7d0d615872fa4528a8020603b71211702 Make z.preprocess defer optionality to inner schema (#5929)
  • 88015df8e25c44fb5385eb3ef28935119cd5edea fix(docs): drop deprecated baseUrl from tsconfig
  • c59d4474e3b4cad1b323462186cf607178ce8267 4.4.2

v4.4.1

Commits:

  • 481f7be4238c83ed58183f921b2646f340a91c6a ci: gate release publishing on full test workflow
  • 95ccab423aec720b2523c3a64cdc7e3204537cc7 test(v3): restore optional undefined expectations
  • cede2c63739a5823d6aa5093d291e9a111da943d fix(v4): reject tuple holes before required defaults (#5900)
  • edd0bf0f5ada4a8dc581c259407d7bbad0a71ea7 release: 4.4.1
  • 180d83d1dbe6a59260710cc8637a3dea2281ee56 docs: remove Jazz featured sponsor

v4.4.0

4.4.0

This is a minor release with a wide set of correctness and soundness fixes. Some fixes intentionally make Zod stricter, so code that depended on previously accepted invalid or ambiguous inputs may need small updates.

Potentially breaking bug fixes

... (truncated)

Commits
  • 1fb56a5 docs: document release procedure in AGENTS.md
  • f3c9ec0 4.4.3
  • c2be4f8 fix(v4): generalize optin/fallback to transform; restore preprocess on absent...
  • 1cab693 fix(v4): restore catch handling for absent object keys (#5937) (#5939)
  • b8dffe9 docs: remove Numeric and Speakeasy (2+ missed monthly cycles)
  • 9195250 docs: remove Mintlify from bronze sponsors (churned)
  • 2c70332 docs: normalize bronze sponsor logos to github avatar pattern
  • 7391be8 docs: prune lapsed silver/bronze sponsors and add active ones
  • 2aeec83 docs: prune lapsed gold sponsors and rebalance logo sizing
  • 4c2fa95 docs: use Zernio primary wordmark for gold sponsor logo
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for zod since your current version.


Updates @trpc/client from 11.16.0 to 11.17.0

Release notes

Sourced from @​trpc/client's releases.

v11.17.0

What's Changed

New Contributors

Full Changelog: https://github.com/trpc/trpc/compare/v11.16.0...v11.17.0

Commits

Updates @trpc/react-query from 11.16.0 to 11.17.0

Release notes

Sourced from @​trpc/react-query's releases.

v11.17.0

What's Changed

New Contributors

Full Changelog: https://github.com/trpc/trpc/compare/v11.16.0...v11.17.0

Commits

Updates @trpc/server from 11.16.0 to 11.17.0

Release notes

Sourced from @​trpc/server's releases.

v11.17.0

What's Changed

New Contributors

Full Changelog: https://github.com/trpc/trpc/compare/v11.16.0...v11.17.0

Commits
  • 23c723c v11.17.0
  • 2c5b6a8 fix(server): handle React 19 proxy coercion in createInnerProxy (#7336)
  • 7ba14fd chore(deps): update dependency @​oxc-project/runtime to v0.123.0 (#7311)
  • 48c5158 fix(deps): update dependency @​tanstack/intent to ^0.0.27 (#7309)
  • d3c4051 feat: Add subscription inferrence helpers (#7303)
  • 2b8a4f8 fix(server): unwrap error from cause for streaming onError (#7286)
  • 59f2cdb chore: Review stale skills (v11.16.0) (#7295)
  • See full diff in compare view

Updates better-auth from 1.6.5 to 1.6.11

Release notes

Sourced from better-auth's releases.

v1.6.11

better-auth

Bug Fixes

  • Added an error code to the change-email-disabled response to help clients identify the rejection reason (#8948)
  • Fixed access-control role statement types so predefined organization roles expose only their configured permissions in TypeScript (#9507)
  • Fixed the anonymous plugin to correctly call onLinkAccount when email verification triggers auto sign-in (#9548)
  • Fixed device authorization to bind pending codes to the verifying session, preventing any authenticated user from approving or denying another user's device code (#9573)
  • Fixed a race condition in the magic-link plugin that allowed concurrent requests to mint multiple sessions from the same single-use token (#9572)
  • Fixed the oidc-provider and mcp plugins to require client_secret for confidential clients on refresh token grants and use constant-time secret comparison (#9576)
  • Hardened oidc-provider and mcp plugins to follow OAuth 2.1: removed "none" from advertised signing algorithms, defaulted plain PKCE off, and rejected incomplete PKCE parameters (#9575)
  • Fixed an invitation takeover vulnerability by enabling requireEmailVerificationOnInvitation by default and extending the verification gate to getInvitation and listUserInvitations (#9577)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

  • Fixed a race condition in the OAuth authorization-code grant that allowed concurrent token-exchange requests to mint multiple token sets from the same authorization code
  • Fixed a race condition in OAuth refresh-token rotation that allowed concurrent requests to fork refresh token families, and added a unique constraint on oauthRefreshToken.token
  • Fixed OAuth account linking to require a verified local email before linking an OAuth identity to a local account (#9578)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Fixed an invalid import list in the instrumentation module (#9582)
  • Widened advanced.ipAddress.ipv6Subnet to accept any valid IPv6 prefix length (0-128) instead of a narrow set of values (#9545)

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

  • Fixed session cleanup to run when admin, anonymous, or SCIM operations delete a user (#9162)
  • Fixed generateSCIMToken to reject providerId values that collide with built-in account providers, preventing tokens from authenticating against unintended accounts (#9579)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

  • Fixed SSO provider registration to require an org admin or owner role, preventing any organization member from registering providers (#9220)
  • Fixed an SSRF vulnerability by validating user-supplied OIDC endpoint URLs against a public-routable host allowlist at provider registration and update (#9574)

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.6.11

Patch Changes

  • #9568 0cbddb8 Thanks @​gustavovalverde! - Add internalAdapter.consumeVerificationValue(identifier): atomically consume a verification row keyed by identifier. The first concurrent caller receives the row; later racers receive null. Backed by a new DBAdapter.consumeOne primitive implemented natively per adapter (memory, mongo, drizzle, kysely, prisma), with a transaction(findMany + delete) factory fallback. SecondaryStorage.getAndDelete is added as an optional companion; Redis ships it via an atomic Lua get-and-delete operation for compatibility with Redis versions before 6.2.

  • #9162 a26333b Thanks @​ping-maxwell! - fix: cleanup sessions when admin, anonymous, or SCIM deletes a user

  • #9573 99a254a Thanks @​gustavovalverde! - fix(device-authorization): require verify-time ownership claim for approve/deny

    Pending device codes were not bound to the user who entered the code on the verification page until approval, leaving a window where any authenticated user could approve or deny another user's pending code by knowing the user_code. GET /device now claims the pending row for the calling session, and POST /device/approve and POST /device/deny require the calling session to match the claimed owner. Custom verification pages must be served to an authenticated session for the flow to succeed.

  • #8948 ee93485 Thanks @​ping-maxwell! - fix: add error code to change-email-disabled

  • #9572 5f09d56 Thanks @​gustavovalverde! - Fix race condition in the magic-link plugin's verify handler that allowed two concurrent requests to mint two sessions from the same single-use token. The handler now consumes the verification row atomically via internalAdapter.consumeVerificationValue, so a given magic link mints at most one session regardless of concurrency. The allowedAttempts option is retained for backward compatibility but no longer multiplies successful redemptions; tokens are single-use. The second-redeem error code changes from ATTEMPTS_EXCEEDED to INVALID_TOKEN (the token no longer exists after consumption).

  • b4bc65a Thanks @​gustavovalverde! - Fix race condition in the OAuth authorization-code grant: two concurrent token-exchange requests sharing the same code could both pass the find step before either delete completed and each mint an independent access/refresh/id token set. The authorization_code handler in @better-auth/oauth-provider, plus the legacy oidc-provider and mcp plugins in better-auth, now consume the verification row atomically via internalAdapter.consumeVerificationValue. The first caller mints tokens; concurrent racers receive invalid_grant (RFC 6749 §5.2). Malformed-verification-value branches in @better-auth/oauth-provider previously returned a project-specific invalid_verification code; those are now invalid_grant so spec-compliant clients can branch on the standard code.

  • #9578 da7e50b Thanks @​gustavovalverde! - handleOAuthUserInfo (used by every social provider, generic-oauth, oauth-proxy, SSO OIDC and SAML, and idToken sign-in) implicitly linked a returning OAuth identity into a local user row whenever the IdP's email_verified claim was true or the provider was trusted. The local row's own emailVerified flag was read only to flip it after linking, never as a precondition. POST /sign-up/email creates rows with emailVerified: false for any caller, so an attacker who pre-registered a victim's email at the application could wait for the legitimate user's first OAuth sign-in: the IdP's verified claim was treated as ownership proof, and the victim's IdP identity was linked into the attacker-owned row.

    The implicit-link gate now requires dbUser.user.emailVerified === true in addition to the provider trust check by default. A new account.accountLinking.requireLocalEmailVerified option (default true) is the public surface for this gate. Apps whose users sign up via OAuth without verifying their email locally can opt back into the legacy behavior with account: { accountLinking: { requireLocalEmailVerified: false } }; understand the takeover risk before doing so. The option is @deprecated; a FIXME at each gate site points at the next-minor follow-up on next that drops the option and makes the gate unconditional.

    The one-tap plugin honored its own copy of the gate and was updated identically: requireLocalEmailVerified and accountLinking.disableImplicitLinking both apply on /one-tap/callback. The email_verified claim from the Google ID token is now normalized via toBoolean so a string "false" is treated as falsy.

    Test fixtures across admin, oidc-provider, mcp, generic-oauth, last-login-method, and oauth-provider suites now mark users emailVerified: true via a databaseHooks.user.create.before hook (or the disableTestUser opt-in on the oauth-provider RP) so the suites continue to exercise their role/flow logic rather than the new gate.

  • #9507 a1c9f3c Thanks @​GautamBytes! - Preserve exact access-control role statement types so predefined organization roles expose only their configured permissions in TypeScript.

  • #9577 23094a6 Thanks @​gustavovalverde! - The organization plugin's invitation recipient endpoints (acceptInvitation, rejectInvitation, getInvitation, listUserInvitations) treated invitation.email.toLowerCase() === session.user.email.toLowerCase() as proof that the calling user owned the invited address. A session-authenticated user whose email matched but was never verified passed the gate, so anyone who could pre-register an unverified account at a victim's email could accept invitations addressed to that email. The requireEmailVerificationOnInvitation opt-in option closed the gap only when explicitly enabled and did not protect getInvitation or listUserInvitations at all.

    The gate is now applied on all four recipient endpoints and the requireEmailVerificationOnInvitation option default flips from false to true so existing apps are secure by default. Apps that intentionally accept invitations from unverified accounts can keep the legacy permissive behavior with organization({ requireEmailVerificationOnInvitation: false }), but they should understand the takeover risk before doing so. Server-side calls to listUserInvitations with ctx.query.email and no session continue to bypass the gate (the caller is trusted).

    The option is @deprecated. The next-minor release on next removes it entirely and makes the gate unconditional.

  • #9548 142b86c Thanks @​dipan-ck! - anonymous plugin now correctly calls onLinkAccount when email verification triggers auto sign-in

  • #9576 1f2ff42 Thanks @​gustavovalverde! - fix(oidc-provider, mcp): authenticate confidential clients on refresh_token grant and harden secret comparison

    Refresh-token grants on the legacy oidc-provider and mcp plugins now require the registered client_secret from confidential clients, matching the authorization_code path. Public clients (where code_verifier substitutes for the secret on the auth-code grant) continue to skip secret validation. Secret comparisons across both plugins now use constant-time equality. The /mcp/token endpoint no longer emits a wildcard CORS Access-Control-Allow-Origin: * header.

    These plugins are deprecated in favor of @better-auth/oauth-provider, which is unaffected. New deployments should adopt the replacement; this patch keeps existing deployments protected while migrating.

  • #9575 699b09a Thanks @​gustavovalverde! - fix(oidc-provider, mcp): drop "none" from advertised signing algorithms, default allowPlainCodeChallengeMethod to false, and reject missing PKCE method

    The legacy oidc-provider and mcp plugins now follow OAuth 2.1 (RFC 9700) on three protocol gates:

    • id_token_signing_alg_values_supported (oidc-provider, mcp) and resource_signing_alg_values_supported (mcp) no longer include "none". Relying parties that negotiate from this list will no longer be steered toward unsigned tokens.
    • allowPlainCodeChallengeMethod defaults to false. Callers who need plain PKCE must opt in explicitly.
    • Under the secure default the authorize endpoint no longer silently rewrites a missing code_challenge_method to "plain" before the allowlist check. A request that provides code_challenge without code_challenge_method is now rejected with invalid_request; the inverse case (code_challenge_method without code_challenge) is also rejected so no inconsistent PKCE state is persisted on the authorization code record.

    Non-breaking for callers who never relied on "none" advertisement or the plain default. Callers who explicitly set allowPlainCodeChallengeMethod: true keep plain on the allowlist and retain the legacy "missing method defaults to plain" behavior for backward compatibility, so existing integrations that opted into plain PKCE continue to work. The next-minor on next will drop both the plain allowlist entry and this fallback; until then, the option is the single explicit knob for legacy behavior. Migrate to @better-auth/oauth-provider for the canonical, spec-aligned implementation.

... (truncated)

Commits
  • f41514e chore: release v1.6.11 (#9532)
  • 699b09a fix(oidc-provider, mcp): drop "none" alg, default plain PKCE off, reject miss...
  • b4bc65a Merge commit from fork
  • a1c9f3c fix(access): preserve exact role statement types (#9507)
  • da7e50b fix(oauth): block OAuth linking to unverified local accounts (#9578)
  • 23094a6 fix(organization): default-on requireEmailVerificationOnInvitation & extend...
  • 1f2ff42 fix(oidc-provider, mcp): authenticate confidential clients on refresh_token g...
  • 5f09d56 fix(magic-link): consume verification token atomically on verify (#9572)
  • 99a254a fix(device-authorization): bind approval to verifier session (#9573)
  • 0cbddb8 refactor(db): rename claimOne adapter primitive to consumeOne (#9568)
  • Additional commits viewable in compare view

Updates drizzle-kit from 0.31.6 to 0.31.10

Release notes

Sourced from drizzle-kit's releases.

[email protected]

  • Updated to [email protected] - native bun stringWidth, stripANSI support, errors for non-TTY environments
  • We've migrated away from esbuild-register to tsx loader, it will now allow to use drizzle-kit seamlessly with both ESM and CJS modules
  • We've also added native Bun and Deno launch support, which will not trigger tsx loader and utilise native bun and deno imports capabilities and faster startup times

[email protected]

  • drizzle-kit api improvements for D1 connections

[email protected]

Bug fixes

  • Fixed algorythm => algorithm typo.
  • Fixed external dependencies in build configuration.
Commits
  • 4aa6ecf Kit updates (#5490)
  • e8e6edf feat(drizzle-kit): support d1 via binding (#5302)
  • a086f59 Fixed pg-native Pool detection in node-postgres transactions breaking in envi...
  • c445637 Merge pull request #5095 from drizzle-team/main-workflows
  • e7b3aaa Merge branch 'main' into main-workflows
  • 0d885a5 refactor: Update condition for run-feature job to improve clarity and functio...
  • 45a1ffb Merge pull request #5087 from drizzle-team/main-workflows
  • 6357645 chore: Comment out NEON_HTTP_CONNECTION_STRING requirement in release workflows
  • 53dec98 refactor: Simplify release router workflow by removing unnecessary switch job...
  • ce88a18 Merge remote-tracking branch 'origin/ext-deps-kit' into main-workflows
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for drizzle-kit since your current version.


Updates react-email from 6.0.0 to 6.1.4

Release notes

Sourced from react-email's releases.

[email protected]

Patch Changes

  • 1c386ce: Avoid spamming each spinner frame as a new line on non-TTY streams (CI logs, pipes, dumb terminals). The spinner now logs each status text once instead of redrawing animated frames when the output is not a TTY.
  • ad6a9de: - deprecate packageManager CLI option for email build, only supporting npm
    • ensure email build dependency installation includes dev dependencies

[email protected]

No release notes provided.

[email protected]

Patch Changes

  • 3c62bd0: fix divider with extra borders around other corners

[email protected]

Patch ChangesDescription has been truncated

Bumps the all-patch-minor group with 12 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.6.0` | `25.7.0` | | [next](https://github.com/vercel/next.js) | `16.2.4` | `16.2.6` | | [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `19.2.5` | `19.2.6` | | [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `19.2.5` | `19.2.6` | | [zod](https://github.com/colinhacks/zod) | `4.3.5` | `4.4.3` | | [@trpc/client](https://github.com/trpc/trpc/tree/HEAD/packages/client) | `11.16.0` | `11.17.0` | | [@trpc/react-query](https://github.com/trpc/trpc/tree/HEAD/packages/react) | `11.16.0` | `11.17.0` | | [@trpc/server](https://github.com/trpc/trpc/tree/HEAD/packages/server) | `11.16.0` | `11.17.0` | | [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.6.5` | `1.6.11` | | [drizzle-kit](https://github.com/drizzle-team/drizzle-orm) | `0.31.6` | `0.31.10` | | [react-email](https://github.com/resend/react-email/tree/HEAD/packages/react-email) | `6.0.0` | `6.1.4` | | [prettier-plugin-tailwindcss](https://github.com/tailwindlabs/prettier-plugin-tailwindcss) | `0.7.4` | `0.8.0` | Updates `@types/node` from 25.6.0 to 25.7.0 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare view</a></li> </ul> </details> <br /> Updates `next` from 16.2.4 to 16.2.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v16.2.6</h2> <blockquote> <p>[!NOTE] This release contains security fixes and backported bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Security Fixes</h3> <p>The following advisories have been addressed:</p> <p><strong>High:</strong></p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj">GHSA-8h8q-6873-q5fj: Denial of Service with Server Components</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f">GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6">GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - <strong>Incomplete Fix Follow-Up</strong></a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx">GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv">GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r">GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-36qx-fr4f-26g5">GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n</a></li> </ul> <p><strong>Moderate:</strong></p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-ffhc-5mcf-pf4q">GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-gx5p-jg67-6x7h">GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh">GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-wfc6-r584-vfw7">GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses</a></li> </ul> <p><strong>Low:</strong></p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-vfv6-92ff-j949">GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-3g8h-86w9-wvmq">GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned</a></li> </ul> <h3>Core Changes</h3> <ul> <li>fix: preserve HTTP access fallbacks during prerender recovery (<a href="https://redirect.github.com/vercel/next.js/issues/92231">#92231</a>)</li> <li>Fix fallback route params case in app-page handler (<a href="https://redirect.github.com/vercel/next.js/issues/91737">#91737</a>)</li> <li>Fix invalid HTML response for route-level RSC requests in deployment adapter (<a href="https://redirect.github.com/vercel/next.js/issues/91541">#91541</a>)</li> <li>Patch setHeader for direct route handlers (<a href="https://redirect.github.com/vercel/next.js/issues/93101">#93101</a>)</li> <li>Include deployment id in <code>cacheHandlers</code> keys (<a href="https://redirect.github.com/vercel/next.js/issues/93453">#93453</a>)</li> <li>Fix double-encoding of URL pathname parts in client param parsing (<a href="https://redirect.github.com/vercel/next.js/issues/93491">#93491</a>)</li> </ul> <h2>v16.2.5</h2> <blockquote> <p>[!NOTE] This release contains security fixes and backported bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Security Fixes</h3> <p>The following advisories have been addressed:</p> <p><strong>High:</strong></p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj">GHSA-8h8q-6873-q5fj: Denial of Service with Server Components</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f">GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx">GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv">GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r">GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/ee6e79b1792a4d401ddf2480f40a83549fe8e722"><code>ee6e79b</code></a> v16.2.6</li> <li><a href="https://github.com/vercel/next.js/commit/afa053d9eb9c2a68c7eba43e84fe6bed8babcd45"><code>afa053d</code></a> Turbopack: Match proxy matchers with webpack implementation (<a href="https://redirect.github.com/vercel/next.js/issues/93594">#93594</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/97a154e5bbee0cb1ac3fb8aa4db66ac36e796e3d"><code>97a154e</code></a> Turbopack: Fix middleware matcher suffix (<a href="https://redirect.github.com/vercel/next.js/issues/93590">#93590</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/83899bc89103d4df1479e065c7c1e09d4698a7b6"><code>83899bc</code></a> [backport] Disable build caches for production/staging/force-preview deploys ...</li> <li><a href="https://github.com/vercel/next.js/commit/7b222b90954d607fc28a34e9b360a9b1636bc206"><code>7b222b9</code></a> [backport][test] Pin package manager to patch versions (<a href="https://redirect.github.com/vercel/next.js/issues/93595">#93595</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/a8dc24f1fe23d4a22d24fac734837f7c824138f7"><code>a8dc24f</code></a> [backport] Turbopack: more strict vergen setup (<a href="https://redirect.github.com/vercel/next.js/issues/93587">#93587</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/766148f9cd48c0e218acafcd0f15defc14871bf4"><code>766148f</code></a> v16.2.5</li> <li><a href="https://github.com/vercel/next.js/commit/0dd94836a8b43209fcfefa448c141683c22c1a27"><code>0dd9483</code></a> fix: add explicit checks for RSC header (<a href="https://redirect.github.com/vercel/next.js/issues/83">#83</a>) (<a href="https://redirect.github.com/vercel/next.js/issues/98">#98</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/d166096c399c4fc4e09cd2d1bf26dca6579a855d"><code>d166096</code></a> fix proxy matching for segment prefetch URLs (<a href="https://redirect.github.com/vercel/next.js/issues/89">#89</a>) (<a href="https://redirect.github.com/vercel/next.js/issues/96">#96</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/9d50c0b7190f59c470308578e12882788819f14c"><code>9d50c0b</code></a> Strip next-resume header from incoming requests (<a href="https://redirect.github.com/vercel/next.js/issues/92">#92</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vercel/next.js/compare/v16.2.4...v16.2.6">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for next since your current version.</p> </details> <br /> Updates `react` from 19.2.5 to 19.2.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/facebook/react/releases">react's releases</a>.</em></p> <blockquote> <h2>19.2.6 (May 6th, 2026)</h2> <h2>React Server Components</h2> <ul> <li>Type hardening and performance improvements (<a href="https://redirect.github.com/facebook/react/pull/36425">#36425</a> by <a href="https://github.com/eps1lon"><code>@​eps1lon</code></a> and <a href="https://github.com/unstubbable"><code>@​unstubbable</code></a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/facebook/react/commit/eaf3e95ca92be7a23d3c9cc8ffd6f199a40be401"><code>eaf3e95</code></a> Version 19.2.6</li> <li>See full diff in <a href="https://github.com/facebook/react/commits/v19.2.6/packages/react">compare view</a></li> </ul> </details> <br /> Updates `react-dom` from 19.2.5 to 19.2.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/facebook/react/releases">react-dom's releases</a>.</em></p> <blockquote> <h2>19.2.6 (May 6th, 2026)</h2> <h2>React Server Components</h2> <ul> <li>Type hardening and performance improvements (<a href="https://redirect.github.com/facebook/react/pull/36425">#36425</a> by <a href="https://github.com/eps1lon"><code>@​eps1lon</code></a> and <a href="https://github.com/unstubbable"><code>@​unstubbable</code></a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/facebook/react/commit/eaf3e95ca92be7a23d3c9cc8ffd6f199a40be401"><code>eaf3e95</code></a> Version 19.2.6</li> <li>See full diff in <a href="https://github.com/facebook/react/commits/v19.2.6/packages/react-dom">compare view</a></li> </ul> </details> <br /> Updates `zod` from 4.3.5 to 4.4.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/colinhacks/zod/releases">zod's releases</a>.</em></p> <blockquote> <h2>v4.4.3</h2> <h2>Commits:</h2> <ul> <li>4c2fa95ce3f3390fbc522324e406b4e9e89b88f9 docs: use Zernio primary wordmark for gold sponsor logo</li> <li>2aeec83eb135e3a83756e973ef44845fc5a455d2 docs: prune lapsed gold sponsors and rebalance logo sizing</li> <li>7391be88ac1ee5cd02057f5ccc012a1f5df4efd0 docs: prune lapsed silver/bronze sponsors and add active ones</li> <li>2c703322a21b4e2b12f33f49ea8430c451a68b4f docs: normalize bronze sponsor logos to github avatar pattern</li> <li>9195250cab0e7950efe39c3926d6c203b4b0a170 docs: remove Mintlify from bronze sponsors (churned)</li> <li>b8dffe9e62f17e6571e6249d05cc5102b54d94e4 docs: remove Numeric and Speakeasy (2+ missed monthly cycles)</li> <li>1cab69383fcdeae2a366d5e2a2fc4d8fc765d168 fix(v4): restore catch handling for absent object keys (<a href="https://redirect.github.com/colinhacks/zod/issues/5937">#5937</a>) (<a href="https://redirect.github.com/colinhacks/zod/issues/5939">#5939</a>)</li> <li>c2be4f819064eed62c7c350a2d399b5faecd15f8 fix(v4): generalize optin/fallback to transform; restore preprocess on absent keys (<a href="https://redirect.github.com/colinhacks/zod/issues/5941">#5941</a>)</li> <li>f3c9ec03ba7a28ae72d25cc295f38674bee0f559 4.4.3</li> <li>1fb56a5c18c27102dbc92260a4007c7732a0ccca docs: document release procedure in AGENTS.md</li> </ul> <h2>v4.4.2</h2> <h2>Commits:</h2> <ul> <li>0c62df0ea19fd05abdf90473e9eef7eea530fab2 Clean up docs navigation and stale labels (<a href="https://redirect.github.com/colinhacks/zod/issues/5901">#5901</a>)</li> <li>20cc794895cc8604fe0c87d83a5d1c3f89fad0ac chore: add security policy and refresh tooling deps</li> <li>6fbe07b0177efdd1bf1c0b05160e70d7a0702337 fix(docs): heading anchor links now include the hash so it doesnt scoll all the way up, follows navbar logic (<a href="https://redirect.github.com/colinhacks/zod/issues/5791">#5791</a>)</li> <li>4bbed1b1c73eca4ce9e59b1189ed236aa6c8b5bd Tighten discriminated union option typing</li> <li>bbac3e567e7fccfaaf7cdc97f1ce30c295e2c908 Update PR guidance for agents</li> <li>cf0dc942a32805c292fff59ade20a7ace980735a Merge remote-tracking branch 'origin/main' into fix-discriminated-union-key-constraint</li> <li>292c894a5fd2aa42e527900b83d8d7a3009a709c docs: add Zernio gold sponsor</li> <li>1fc9f311c28dcf80d0bb5a36b177086cbc3d8eca docs: document codec inversion</li> <li>1373c85da9aeff704a9762d27bc58699618aefb7 docs: remove AI disclosure guidance</li> <li>e20d02b473c08e3a4e557bc610b1b5fac079b649 chore: ignore triage notes</li> <li>e58ea4d91b1dfe8194b73508203213cbc7e9c936 docs: test Zod Mini tab code heights</li> <li>905761a5d127e8d5dd2ebb3bc88c75cb0b8149ff docs: document preprocess input type narrowing</li> <li>bf64bac850d4dee2b7dde7e64909d5d796d32043 chore: tighten test guidance in AGENTS.md</li> <li>8ec4e73f4c4693b6361ad591be40fb41eb8a9f95 chore: update play.ts scratch</li> <li>02c2baf7d0d615872fa4528a8020603b71211702 Make z.preprocess defer optionality to inner schema (<a href="https://redirect.github.com/colinhacks/zod/issues/5929">#5929</a>)</li> <li>88015df8e25c44fb5385eb3ef28935119cd5edea fix(docs): drop deprecated <code>baseUrl</code> from tsconfig</li> <li>c59d4474e3b4cad1b323462186cf607178ce8267 4.4.2</li> </ul> <h2>v4.4.1</h2> <h2>Commits:</h2> <ul> <li>481f7be4238c83ed58183f921b2646f340a91c6a ci: gate release publishing on full test workflow</li> <li>95ccab423aec720b2523c3a64cdc7e3204537cc7 test(v3): restore optional undefined expectations</li> <li>cede2c63739a5823d6aa5093d291e9a111da943d fix(v4): reject tuple holes before required defaults (<a href="https://redirect.github.com/colinhacks/zod/issues/5900">#5900</a>)</li> <li>edd0bf0f5ada4a8dc581c259407d7bbad0a71ea7 release: 4.4.1</li> <li>180d83d1dbe6a59260710cc8637a3dea2281ee56 docs: remove Jazz featured sponsor</li> </ul> <h2>v4.4.0</h2> <h2>4.4.0</h2> <p>This is a minor release with a wide set of correctness and soundness fixes. Some fixes intentionally make Zod stricter, so code that depended on previously accepted invalid or ambiguous inputs may need small updates.</p> <h2>Potentially breaking bug fixes</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/colinhacks/zod/commit/1fb56a5c18c27102dbc92260a4007c7732a0ccca"><code>1fb56a5</code></a> docs: document release procedure in AGENTS.md</li> <li><a href="https://github.com/colinhacks/zod/commit/f3c9ec03ba7a28ae72d25cc295f38674bee0f559"><code>f3c9ec0</code></a> 4.4.3</li> <li><a href="https://github.com/colinhacks/zod/commit/c2be4f819064eed62c7c350a2d399b5faecd15f8"><code>c2be4f8</code></a> fix(v4): generalize optin/fallback to transform; restore preprocess on absent...</li> <li><a href="https://github.com/colinhacks/zod/commit/1cab69383fcdeae2a366d5e2a2fc4d8fc765d168"><code>1cab693</code></a> fix(v4): restore catch handling for absent object keys (<a href="https://redirect.github.com/colinhacks/zod/issues/5937">#5937</a>) (<a href="https://redirect.github.com/colinhacks/zod/issues/5939">#5939</a>)</li> <li><a href="https://github.com/colinhacks/zod/commit/b8dffe9e62f17e6571e6249d05cc5102b54d94e4"><code>b8dffe9</code></a> docs: remove Numeric and Speakeasy (2+ missed monthly cycles)</li> <li><a href="https://github.com/colinhacks/zod/commit/9195250cab0e7950efe39c3926d6c203b4b0a170"><code>9195250</code></a> docs: remove Mintlify from bronze sponsors (churned)</li> <li><a href="https://github.com/colinhacks/zod/commit/2c703322a21b4e2b12f33f49ea8430c451a68b4f"><code>2c70332</code></a> docs: normalize bronze sponsor logos to github avatar pattern</li> <li><a href="https://github.com/colinhacks/zod/commit/7391be88ac1ee5cd02057f5ccc012a1f5df4efd0"><code>7391be8</code></a> docs: prune lapsed silver/bronze sponsors and add active ones</li> <li><a href="https://github.com/colinhacks/zod/commit/2aeec83eb135e3a83756e973ef44845fc5a455d2"><code>2aeec83</code></a> docs: prune lapsed gold sponsors and rebalance logo sizing</li> <li><a href="https://github.com/colinhacks/zod/commit/4c2fa95ce3f3390fbc522324e406b4e9e89b88f9"><code>4c2fa95</code></a> docs: use Zernio primary wordmark for gold sponsor logo</li> <li>Additional commits viewable in <a href="https://github.com/colinhacks/zod/compare/v4.3.5...v4.4.3">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for zod since your current version.</p> </details> <br /> Updates `@trpc/client` from 11.16.0 to 11.17.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/trpc/trpc/releases">@​trpc/client's releases</a>.</em></p> <blockquote> <h2>v11.17.0</h2> <h2>What's Changed</h2> <ul> <li>chore(deps): bump next from 15.5.10 to 15.5.14 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/trpc/trpc/pull/7268">trpc/trpc#7268</a></li> <li>chore: Review stale skills (v11.16.0) by <a href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot] in <a href="https://redirect.github.com/trpc/trpc/pull/7295">trpc/trpc#7295</a></li> <li>fix(server): unwrap error from cause for streaming onError by <a href="https://github.com/zirkelc"><code>@​zirkelc</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7286">trpc/trpc#7286</a></li> <li>chore: Add cache checks for openapi router fixtures by <a href="https://github.com/Nick-Lucas"><code>@​Nick-Lucas</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7296">trpc/trpc#7296</a></li> <li>chore: Update Hey API for new type imports by <a href="https://github.com/Nick-Lucas"><code>@​Nick-Lucas</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7298">trpc/trpc#7298</a></li> <li>docs: Add oasdiff docs to openapi by <a href="https://github.com/Nick-Lucas"><code>@​Nick-Lucas</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7299">trpc/trpc#7299</a></li> <li>feat: Add subscription inferrence helpers by <a href="https://github.com/Nick-Lucas"><code>@​Nick-Lucas</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7303">trpc/trpc#7303</a></li> <li>fix(www): Add accessible text to links without discernible text by <a href="https://github.com/cyphercodes"><code>@​cyphercodes</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7302">trpc/trpc#7302</a></li> <li>fix(deps): update dependency <code>@​tanstack/intent</code> to ^0.0.27 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/trpc/trpc/pull/7309">trpc/trpc#7309</a></li> <li>fix(deps): update dependency srvx to v0.11.14 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/trpc/trpc/pull/7310">trpc/trpc#7310</a></li> <li>chore(deps): update dependency <code>@​oxc-project/runtime</code> to v0.123.0 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/trpc/trpc/pull/7311">trpc/trpc#7311</a></li> <li>fix(deps): update dependency <code>@​clack/prompts</code> to v1.2.0 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/trpc/trpc/pull/7312">trpc/trpc#7312</a></li> <li>chore(deps): bump fastify from 5.8.1 to 5.8.3 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/trpc/trpc/pull/7288">trpc/trpc#7288</a></li> <li>chore(deps): update codecov/codecov-action action to v6 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/trpc/trpc/pull/7313">trpc/trpc#7313</a></li> <li>fix(deps): update dependency eslint-plugin-unicorn to v64 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/trpc/trpc/pull/7314">trpc/trpc#7314</a></li> <li>fix(deps): update dependency undici to v8 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/trpc/trpc/pull/7316">trpc/trpc#7316</a></li> <li>chore(monorepo): remove versions from private workspaces by <a href="https://github.com/KATT"><code>@​KATT</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7306">trpc/trpc#7306</a></li> <li>fix(server): handle React 19 proxy coercion in createInnerProxy by <a href="https://github.com/DORI2001"><code>@​DORI2001</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7336">trpc/trpc#7336</a></li> <li>docs: add trpc-studio to awesome-trpc extensions by <a href="https://github.com/sayefdeen"><code>@​sayefdeen</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7340">trpc/trpc#7340</a></li> <li>chore: upgrade pnpm to 10.33.1 by <a href="https://github.com/KATT"><code>@​KATT</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7350">trpc/trpc#7350</a></li> <li>build: upgrade drizzle in next-sse-chat example by <a href="https://github.com/KATT"><code>@​KATT</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7351">trpc/trpc#7351</a></li> <li>chore(www): Add Legora to website logos by <a href="https://github.com/KATT"><code>@​KATT</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7358">trpc/trpc#7358</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/cyphercodes"><code>@​cyphercodes</code></a> made their first contribution in <a href="https://redirect.github.com/trpc/trpc/pull/7302">trpc/trpc#7302</a></li> <li><a href="https://github.com/DORI2001"><code>@​DORI2001</code></a> made their first contribution in <a href="https://redirect.github.com/trpc/trpc/pull/7336">trpc/trpc#7336</a></li> <li><a href="https://github.com/sayefdeen"><code>@​sayefdeen</code></a> made their first contribution in <a href="https://redirect.github.com/trpc/trpc/pull/7340">trpc/trpc#7340</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/trpc/trpc/compare/v11.16.0...v11.17.0">https://github.com/trpc/trpc/compare/v11.16.0...v11.17.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/trpc/trpc/commit/23c723cfeaf07da28a52a5c35c3dcccf96a47578"><code>23c723c</code></a> v11.17.0</li> <li><a href="https://github.com/trpc/trpc/commit/cb17317f15654ee7bce1d34f737fee64a8babb43"><code>cb17317</code></a> fix(deps): update dependency undici to v8 (<a href="https://github.com/trpc/trpc/tree/HEAD/packages/client/issues/7316">#7316</a>)</li> <li><a href="https://github.com/trpc/trpc/commit/48c51585463c03c95db9d0ea97447c4ca6c68134"><code>48c5158</code></a> fix(deps): update dependency <code>@​tanstack/intent</code> to ^0.0.27 (<a href="https://github.com/trpc/trpc/tree/HEAD/packages/client/issues/7309">#7309</a>)</li> <li><a href="https://github.com/trpc/trpc/commit/59f2cdb3c58310733b06d3b2e16c94065fe0a9c3"><code>59f2cdb</code></a> chore: Review stale skills (v11.16.0) (<a href="https://github.com/trpc/trpc/tree/HEAD/packages/client/issues/7295">#7295</a>)</li> <li>See full diff in <a href="https://github.com/trpc/trpc/commits/v11.17.0/packages/client">compare view</a></li> </ul> </details> <br /> Updates `@trpc/react-query` from 11.16.0 to 11.17.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/trpc/trpc/releases">@​trpc/react-query's releases</a>.</em></p> <blockquote> <h2>v11.17.0</h2> <h2>What's Changed</h2> <ul> <li>chore(deps): bump next from 15.5.10 to 15.5.14 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/trpc/trpc/pull/7268">trpc/trpc#7268</a></li> <li>chore: Review stale skills (v11.16.0) by <a href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot] in <a href="https://redirect.github.com/trpc/trpc/pull/7295">trpc/trpc#7295</a></li> <li>fix(server): unwrap error from cause for streaming onError by <a href="https://github.com/zirkelc"><code>@​zirkelc</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7286">trpc/trpc#7286</a></li> <li>chore: Add cache checks for openapi router fixtures by <a href="https://github.com/Nick-Lucas"><code>@​Nick-Lucas</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7296">trpc/trpc#7296</a></li> <li>chore: Update Hey API for new type imports by <a href="https://github.com/Nick-Lucas"><code>@​Nick-Lucas</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7298">trpc/trpc#7298</a></li> <li>docs: Add oasdiff docs to openapi by <a href="https://github.com/Nick-Lucas"><code>@​Nick-Lucas</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7299">trpc/trpc#7299</a></li> <li>feat: Add subscription inferrence helpers by <a href="https://github.com/Nick-Lucas"><code>@​Nick-Lucas</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7303">trpc/trpc#7303</a></li> <li>fix(www): Add accessible text to links without discernible text by <a href="https://github.com/cyphercodes"><code>@​cyphercodes</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7302">trpc/trpc#7302</a></li> <li>fix(deps): update dependency <code>@​tanstack/intent</code> to ^0.0.27 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/trpc/trpc/pull/7309">trpc/trpc#7309</a></li> <li>fix(deps): update dependency srvx to v0.11.14 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/trpc/trpc/pull/7310">trpc/trpc#7310</a></li> <li>chore(deps): update dependency <code>@​oxc-project/runtime</code> to v0.123.0 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/trpc/trpc/pull/7311">trpc/trpc#7311</a></li> <li>fix(deps): update dependency <code>@​clack/prompts</code> to v1.2.0 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/trpc/trpc/pull/7312">trpc/trpc#7312</a></li> <li>chore(deps): bump fastify from 5.8.1 to 5.8.3 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/trpc/trpc/pull/7288">trpc/trpc#7288</a></li> <li>chore(deps): update codecov/codecov-action action to v6 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/trpc/trpc/pull/7313">trpc/trpc#7313</a></li> <li>fix(deps): update dependency eslint-plugin-unicorn to v64 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/trpc/trpc/pull/7314">trpc/trpc#7314</a></li> <li>fix(deps): update dependency undici to v8 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/trpc/trpc/pull/7316">trpc/trpc#7316</a></li> <li>chore(monorepo): remove versions from private workspaces by <a href="https://github.com/KATT"><code>@​KATT</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7306">trpc/trpc#7306</a></li> <li>fix(server): handle React 19 proxy coercion in createInnerProxy by <a href="https://github.com/DORI2001"><code>@​DORI2001</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7336">trpc/trpc#7336</a></li> <li>docs: add trpc-studio to awesome-trpc extensions by <a href="https://github.com/sayefdeen"><code>@​sayefdeen</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7340">trpc/trpc#7340</a></li> <li>chore: upgrade pnpm to 10.33.1 by <a href="https://github.com/KATT"><code>@​KATT</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7350">trpc/trpc#7350</a></li> <li>build: upgrade drizzle in next-sse-chat example by <a href="https://github.com/KATT"><code>@​KATT</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7351">trpc/trpc#7351</a></li> <li>chore(www): Add Legora to website logos by <a href="https://github.com/KATT"><code>@​KATT</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7358">trpc/trpc#7358</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/cyphercodes"><code>@​cyphercodes</code></a> made their first contribution in <a href="https://redirect.github.com/trpc/trpc/pull/7302">trpc/trpc#7302</a></li> <li><a href="https://github.com/DORI2001"><code>@​DORI2001</code></a> made their first contribution in <a href="https://redirect.github.com/trpc/trpc/pull/7336">trpc/trpc#7336</a></li> <li><a href="https://github.com/sayefdeen"><code>@​sayefdeen</code></a> made their first contribution in <a href="https://redirect.github.com/trpc/trpc/pull/7340">trpc/trpc#7340</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/trpc/trpc/compare/v11.16.0...v11.17.0">https://github.com/trpc/trpc/compare/v11.16.0...v11.17.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/trpc/trpc/commits/v11.17.0/packages/react">compare view</a></li> </ul> </details> <br /> Updates `@trpc/server` from 11.16.0 to 11.17.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/trpc/trpc/releases">@​trpc/server's releases</a>.</em></p> <blockquote> <h2>v11.17.0</h2> <h2>What's Changed</h2> <ul> <li>chore(deps): bump next from 15.5.10 to 15.5.14 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/trpc/trpc/pull/7268">trpc/trpc#7268</a></li> <li>chore: Review stale skills (v11.16.0) by <a href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot] in <a href="https://redirect.github.com/trpc/trpc/pull/7295">trpc/trpc#7295</a></li> <li>fix(server): unwrap error from cause for streaming onError by <a href="https://github.com/zirkelc"><code>@​zirkelc</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7286">trpc/trpc#7286</a></li> <li>chore: Add cache checks for openapi router fixtures by <a href="https://github.com/Nick-Lucas"><code>@​Nick-Lucas</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7296">trpc/trpc#7296</a></li> <li>chore: Update Hey API for new type imports by <a href="https://github.com/Nick-Lucas"><code>@​Nick-Lucas</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7298">trpc/trpc#7298</a></li> <li>docs: Add oasdiff docs to openapi by <a href="https://github.com/Nick-Lucas"><code>@​Nick-Lucas</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7299">trpc/trpc#7299</a></li> <li>feat: Add subscription inferrence helpers by <a href="https://github.com/Nick-Lucas"><code>@​Nick-Lucas</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7303">trpc/trpc#7303</a></li> <li>fix(www): Add accessible text to links without discernible text by <a href="https://github.com/cyphercodes"><code>@​cyphercodes</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7302">trpc/trpc#7302</a></li> <li>fix(deps): update dependency <code>@​tanstack/intent</code> to ^0.0.27 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/trpc/trpc/pull/7309">trpc/trpc#7309</a></li> <li>fix(deps): update dependency srvx to v0.11.14 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/trpc/trpc/pull/7310">trpc/trpc#7310</a></li> <li>chore(deps): update dependency <code>@​oxc-project/runtime</code> to v0.123.0 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/trpc/trpc/pull/7311">trpc/trpc#7311</a></li> <li>fix(deps): update dependency <code>@​clack/prompts</code> to v1.2.0 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/trpc/trpc/pull/7312">trpc/trpc#7312</a></li> <li>chore(deps): bump fastify from 5.8.1 to 5.8.3 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/trpc/trpc/pull/7288">trpc/trpc#7288</a></li> <li>chore(deps): update codecov/codecov-action action to v6 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/trpc/trpc/pull/7313">trpc/trpc#7313</a></li> <li>fix(deps): update dependency eslint-plugin-unicorn to v64 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/trpc/trpc/pull/7314">trpc/trpc#7314</a></li> <li>fix(deps): update dependency undici to v8 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/trpc/trpc/pull/7316">trpc/trpc#7316</a></li> <li>chore(monorepo): remove versions from private workspaces by <a href="https://github.com/KATT"><code>@​KATT</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7306">trpc/trpc#7306</a></li> <li>fix(server): handle React 19 proxy coercion in createInnerProxy by <a href="https://github.com/DORI2001"><code>@​DORI2001</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7336">trpc/trpc#7336</a></li> <li>docs: add trpc-studio to awesome-trpc extensions by <a href="https://github.com/sayefdeen"><code>@​sayefdeen</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7340">trpc/trpc#7340</a></li> <li>chore: upgrade pnpm to 10.33.1 by <a href="https://github.com/KATT"><code>@​KATT</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7350">trpc/trpc#7350</a></li> <li>build: upgrade drizzle in next-sse-chat example by <a href="https://github.com/KATT"><code>@​KATT</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7351">trpc/trpc#7351</a></li> <li>chore(www): Add Legora to website logos by <a href="https://github.com/KATT"><code>@​KATT</code></a> in <a href="https://redirect.github.com/trpc/trpc/pull/7358">trpc/trpc#7358</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/cyphercodes"><code>@​cyphercodes</code></a> made their first contribution in <a href="https://redirect.github.com/trpc/trpc/pull/7302">trpc/trpc#7302</a></li> <li><a href="https://github.com/DORI2001"><code>@​DORI2001</code></a> made their first contribution in <a href="https://redirect.github.com/trpc/trpc/pull/7336">trpc/trpc#7336</a></li> <li><a href="https://github.com/sayefdeen"><code>@​sayefdeen</code></a> made their first contribution in <a href="https://redirect.github.com/trpc/trpc/pull/7340">trpc/trpc#7340</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/trpc/trpc/compare/v11.16.0...v11.17.0">https://github.com/trpc/trpc/compare/v11.16.0...v11.17.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/trpc/trpc/commit/23c723cfeaf07da28a52a5c35c3dcccf96a47578"><code>23c723c</code></a> v11.17.0</li> <li><a href="https://github.com/trpc/trpc/commit/2c5b6a8c6366c005508c0f481ad3ae344653a6f8"><code>2c5b6a8</code></a> fix(server): handle React 19 proxy coercion in createInnerProxy (<a href="https://github.com/trpc/trpc/tree/HEAD/packages/server/issues/7336">#7336</a>)</li> <li><a href="https://github.com/trpc/trpc/commit/7ba14fdb6c351d93747bc883c5c61af22702aadb"><code>7ba14fd</code></a> chore(deps): update dependency <code>@​oxc-project/runtime</code> to v0.123.0 (<a href="https://github.com/trpc/trpc/tree/HEAD/packages/server/issues/7311">#7311</a>)</li> <li><a href="https://github.com/trpc/trpc/commit/48c51585463c03c95db9d0ea97447c4ca6c68134"><code>48c5158</code></a> fix(deps): update dependency <code>@​tanstack/intent</code> to ^0.0.27 (<a href="https://github.com/trpc/trpc/tree/HEAD/packages/server/issues/7309">#7309</a>)</li> <li><a href="https://github.com/trpc/trpc/commit/d3c4051f03d0ca1f31177cadc10adff21c9048b8"><code>d3c4051</code></a> feat: Add subscription inferrence helpers (<a href="https://github.com/trpc/trpc/tree/HEAD/packages/server/issues/7303">#7303</a>)</li> <li><a href="https://github.com/trpc/trpc/commit/2b8a4f826d3b22829343cebd9b23e163dfeecd09"><code>2b8a4f8</code></a> fix(server): unwrap error from cause for streaming onError (<a href="https://github.com/trpc/trpc/tree/HEAD/packages/server/issues/7286">#7286</a>)</li> <li><a href="https://github.com/trpc/trpc/commit/59f2cdb3c58310733b06d3b2e16c94065fe0a9c3"><code>59f2cdb</code></a> chore: Review stale skills (v11.16.0) (<a href="https://github.com/trpc/trpc/tree/HEAD/packages/server/issues/7295">#7295</a>)</li> <li>See full diff in <a href="https://github.com/trpc/trpc/commits/v11.17.0/packages/server">compare view</a></li> </ul> </details> <br /> Updates `better-auth` from 1.6.5 to 1.6.11 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/better-auth/better-auth/releases">better-auth's releases</a>.</em></p> <blockquote> <h2>v1.6.11</h2> <h2><code>better-auth</code></h2> <h3>Bug Fixes</h3> <ul> <li>Added an error code to the <code>change-email-disabled</code> response to help clients identify the rejection reason (<a href="https://redirect.github.com/better-auth/better-auth/pull/8948">#8948</a>)</li> <li>Fixed access-control role statement types so predefined organization roles expose only their configured permissions in TypeScript (<a href="https://redirect.github.com/better-auth/better-auth/pull/9507">#9507</a>)</li> <li>Fixed the anonymous plugin to correctly call <code>onLinkAccount</code> when email verification triggers auto sign-in (<a href="https://redirect.github.com/better-auth/better-auth/pull/9548">#9548</a>)</li> <li>Fixed device authorization to bind pending codes to the verifying session, preventing any authenticated user from approving or denying another user's device code (<a href="https://redirect.github.com/better-auth/better-auth/pull/9573">#9573</a>)</li> <li>Fixed a race condition in the magic-link plugin that allowed concurrent requests to mint multiple sessions from the same single-use token (<a href="https://redirect.github.com/better-auth/better-auth/pull/9572">#9572</a>)</li> <li>Fixed the <code>oidc-provider</code> and <code>mcp</code> plugins to require <code>client_secret</code> for confidential clients on refresh token grants and use constant-time secret comparison (<a href="https://redirect.github.com/better-auth/better-auth/pull/9576">#9576</a>)</li> <li>Hardened <code>oidc-provider</code> and <code>mcp</code> plugins to follow OAuth 2.1: removed <code>&quot;none&quot;</code> from advertised signing algorithms, defaulted plain PKCE off, and rejected incomplete PKCE parameters (<a href="https://redirect.github.com/better-auth/better-auth/pull/9575">#9575</a>)</li> <li>Fixed an invitation takeover vulnerability by enabling <code>requireEmailVerificationOnInvitation</code> by default and extending the verification gate to <code>getInvitation</code> and <code>listUserInvitations</code> (<a href="https://redirect.github.com/better-auth/better-auth/pull/9577">#9577</a>)</li> </ul> <p>For detailed changes, see <a href="https://github.com/better-auth/better-auth/blob/f41514ef07cfafc5dbf463bd1500aee6575d88a7/packages/better-auth/CHANGELOG.md"><code>CHANGELOG</code></a></p> <h2><code>@better-auth/oauth-provider</code></h2> <h3>Bug Fixes</h3> <ul> <li>Fixed a race condition in the OAuth authorization-code grant that allowed concurrent token-exchange requests to mint multiple token sets from the same authorization code</li> <li>Fixed a race condition in OAuth refresh-token rotation that allowed concurrent requests to fork refresh token families, and added a <code>unique</code> constraint on <code>oauthRefreshToken.token</code></li> <li>Fixed OAuth account linking to require a verified local email before linking an OAuth identity to a local account (<a href="https://redirect.github.com/better-auth/better-auth/pull/9578">#9578</a>)</li> </ul> <p>For detailed changes, see <a href="https://github.com/better-auth/better-auth/blob/f41514ef07cfafc5dbf463bd1500aee6575d88a7/packages/oauth-provider/CHANGELOG.md"><code>CHANGELOG</code></a></p> <h2><code>@better-auth/core</code></h2> <h3>Bug Fixes</h3> <ul> <li>Fixed an invalid import list in the instrumentation module (<a href="https://redirect.github.com/better-auth/better-auth/pull/9582">#9582</a>)</li> <li>Widened <code>advanced.ipAddress.ipv6Subnet</code> to accept any valid IPv6 prefix length (0-128) instead of a narrow set of values (<a href="https://redirect.github.com/better-auth/better-auth/pull/9545">#9545</a>)</li> </ul> <p>For detailed changes, see <a href="https://github.com/better-auth/better-auth/blob/f41514ef07cfafc5dbf463bd1500aee6575d88a7/packages/core/CHANGELOG.md"><code>CHANGELOG</code></a></p> <h2><code>@better-auth/scim</code></h2> <h3>Bug Fixes</h3> <ul> <li>Fixed session cleanup to run when admin, anonymous, or SCIM operations delete a user (<a href="https://redirect.github.com/better-auth/better-auth/pull/9162">#9162</a>)</li> <li>Fixed <code>generateSCIMToken</code> to reject <code>providerId</code> values that collide with built-in account providers, preventing tokens from authenticating against unintended accounts (<a href="https://redirect.github.com/better-auth/better-auth/pull/9579">#9579</a>)</li> </ul> <p>For detailed changes, see <a href="https://github.com/better-auth/better-auth/blob/f41514ef07cfafc5dbf463bd1500aee6575d88a7/packages/scim/CHANGELOG.md"><code>CHANGELOG</code></a></p> <h2><code>@better-auth/sso</code></h2> <h3>Bug Fixes</h3> <ul> <li>Fixed SSO provider registration to require an org admin or owner role, preventing any organization member from registering providers (<a href="https://redirect.github.com/better-auth/better-auth/pull/9220">#9220</a>)</li> <li>Fixed an SSRF vulnerability by validating user-supplied OIDC endpoint URLs against a public-routable host allowlist at provider registration and update (<a href="https://redirect.github.com/better-auth/better-auth/pull/9574">#9574</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md">better-auth's changelog</a>.</em></p> <blockquote> <h2>1.6.11</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/9568">#9568</a> <a href="https://github.com/better-auth/better-auth/commit/0cbddb8fa4eb19fbca75e9822134f89b3604286a"><code>0cbddb8</code></a> Thanks <a href="https://github.com/gustavovalverde"><code>@​gustavovalverde</code></a>! - Add <code>internalAdapter.consumeVerificationValue(identifier)</code>: atomically consume a verification row keyed by identifier. The first concurrent caller receives the row; later racers receive <code>null</code>. Backed by a new <code>DBAdapter.consumeOne</code> primitive implemented natively per adapter (memory, mongo, drizzle, kysely, prisma), with a <code>transaction(findMany + delete)</code> factory fallback. <code>SecondaryStorage.getAndDelete</code> is added as an optional companion; Redis ships it via an atomic Lua get-and-delete operation for compatibility with Redis versions before 6.2.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/9162">#9162</a> <a href="https://github.com/better-auth/better-auth/commit/a26333b5fb1a044e76c18385441d3ecc2240ab70"><code>a26333b</code></a> Thanks <a href="https://github.com/ping-maxwell"><code>@​ping-maxwell</code></a>! - fix: cleanup sessions when admin, anonymous, or SCIM deletes a user</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/9573">#9573</a> <a href="https://github.com/better-auth/better-auth/commit/99a254a79b59d5a3f5ca2123260118cddb5beed7"><code>99a254a</code></a> Thanks <a href="https://github.com/gustavovalverde"><code>@​gustavovalverde</code></a>! - fix(device-authorization): require verify-time ownership claim for approve/deny</p> <p>Pending device codes were not bound to the user who entered the code on the verification page until approval, leaving a window where any authenticated user could approve or deny another user's pending code by knowing the <code>user_code</code>. <code>GET /device</code> now claims the pending row for the calling session, and <code>POST /device/approve</code> and <code>POST /device/deny</code> require the calling session to match the claimed owner. Custom verification pages must be served to an authenticated session for the flow to succeed.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/8948">#8948</a> <a href="https://github.com/better-auth/better-auth/commit/ee934854999390ee5ca73592fe205a470a810b83"><code>ee93485</code></a> Thanks <a href="https://github.com/ping-maxwell"><code>@​ping-maxwell</code></a>! - fix: add error code to change-email-disabled</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/9572">#9572</a> <a href="https://github.com/better-auth/better-auth/commit/5f09d566a64ac9a0499d9664ce700edbf0630cea"><code>5f09d56</code></a> Thanks <a href="https://github.com/gustavovalverde"><code>@​gustavovalverde</code></a>! - Fix race condition in the <code>magic-link</code> plugin's verify handler that allowed two concurrent requests to mint two sessions from the same single-use token. The handler now consumes the verification row atomically via <code>internalAdapter.consumeVerificationValue</code>, so a given magic link mints at most one session regardless of concurrency. The <code>allowedAttempts</code> option is retained for backward compatibility but no longer multiplies successful redemptions; tokens are single-use. The second-redeem error code changes from <code>ATTEMPTS_EXCEEDED</code> to <code>INVALID_TOKEN</code> (the token no longer exists after consumption).</p> </li> <li> <p><a href="https://github.com/better-auth/better-auth/commit/b4bc65a007784b2eb0efb459e5fa6fd8055d3ec9"><code>b4bc65a</code></a> Thanks <a href="https://github.com/gustavovalverde"><code>@​gustavovalverde</code></a>! - Fix race condition in the OAuth authorization-code grant: two concurrent token-exchange requests sharing the same <code>code</code> could both pass the find step before either delete completed and each mint an independent access/refresh/id token set. The <code>authorization_code</code> handler in <code>@better-auth/oauth-provider</code>, plus the legacy <code>oidc-provider</code> and <code>mcp</code> plugins in <code>better-auth</code>, now consume the verification row atomically via <code>internalAdapter.consumeVerificationValue</code>. The first caller mints tokens; concurrent racers receive <code>invalid_grant</code> (RFC 6749 §5.2). Malformed-verification-value branches in <code>@better-auth/oauth-provider</code> previously returned a project-specific <code>invalid_verification</code> code; those are now <code>invalid_grant</code> so spec-compliant clients can branch on the standard code.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/9578">#9578</a> <a href="https://github.com/better-auth/better-auth/commit/da7e50beee849c59a2ed1ec6b3a38cc6ab9fb563"><code>da7e50b</code></a> Thanks <a href="https://github.com/gustavovalverde"><code>@​gustavovalverde</code></a>! - <code>handleOAuthUserInfo</code> (used by every social provider, generic-oauth, oauth-proxy, SSO OIDC and SAML, and idToken sign-in) implicitly linked a returning OAuth identity into a local user row whenever the IdP's <code>email_verified</code> claim was true or the provider was trusted. The local row's own <code>emailVerified</code> flag was read only to flip it after linking, never as a precondition. <code>POST /sign-up/email</code> creates rows with <code>emailVerified: false</code> for any caller, so an attacker who pre-registered a victim's email at the application could wait for the legitimate user's first OAuth sign-in: the IdP's verified claim was treated as ownership proof, and the victim's IdP identity was linked into the attacker-owned row.</p> <p>The implicit-link gate now requires <code>dbUser.user.emailVerified === true</code> in addition to the provider trust check by default. A new <code>account.accountLinking.requireLocalEmailVerified</code> option (default <code>true</code>) is the public surface for this gate. Apps whose users sign up via OAuth without verifying their email locally can opt back into the legacy behavior with <code>account: { accountLinking: { requireLocalEmailVerified: false } }</code>; understand the takeover risk before doing so. The option is <code>@deprecated</code>; a FIXME at each gate site points at the next-minor follow-up on <code>next</code> that drops the option and makes the gate unconditional.</p> <p>The <code>one-tap</code> plugin honored its own copy of the gate and was updated identically: <code>requireLocalEmailVerified</code> and <code>accountLinking.disableImplicitLinking</code> both apply on <code>/one-tap/callback</code>. The <code>email_verified</code> claim from the Google ID token is now normalized via <code>toBoolean</code> so a string <code>&quot;false&quot;</code> is treated as falsy.</p> <p>Test fixtures across <code>admin</code>, <code>oidc-provider</code>, <code>mcp</code>, <code>generic-oauth</code>, <code>last-login-method</code>, and <code>oauth-provider</code> suites now mark users <code>emailVerified: true</code> via a <code>databaseHooks.user.create.before</code> hook (or the <code>disableTestUser</code> opt-in on the oauth-provider RP) so the suites continue to exercise their role/flow logic rather than the new gate.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/9507">#9507</a> <a href="https://github.com/better-auth/better-auth/commit/a1c9f3c08e7398e900e099839aa6dcc8d1d0b816"><code>a1c9f3c</code></a> Thanks <a href="https://github.com/GautamBytes"><code>@​GautamBytes</code></a>! - Preserve exact access-control role statement types so predefined organization roles expose only their configured permissions in TypeScript.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/9577">#9577</a> <a href="https://github.com/better-auth/better-auth/commit/23094a628f007f801be6d26e5b15dc5fc6fc4eb8"><code>23094a6</code></a> Thanks <a href="https://github.com/gustavovalverde"><code>@​gustavovalverde</code></a>! - The organization plugin's invitation recipient endpoints (<code>acceptInvitation</code>, <code>rejectInvitation</code>, <code>getInvitation</code>, <code>listUserInvitations</code>) treated <code>invitation.email.toLowerCase() === session.user.email.toLowerCase()</code> as proof that the calling user owned the invited address. A session-authenticated user whose email matched but was never verified passed the gate, so anyone who could pre-register an unverified account at a victim's email could accept invitations addressed to that email. The <code>requireEmailVerificationOnInvitation</code> opt-in option closed the gap only when explicitly enabled and did not protect <code>getInvitation</code> or <code>listUserInvitations</code> at all.</p> <p>The gate is now applied on all four recipient endpoints and the <code>requireEmailVerificationOnInvitation</code> option default flips from <code>false</code> to <code>true</code> so existing apps are secure by default. Apps that intentionally accept invitations from unverified accounts can keep the legacy permissive behavior with <code>organization({ requireEmailVerificationOnInvitation: false })</code>, but they should understand the takeover risk before doing so. Server-side calls to <code>listUserInvitations</code> with <code>ctx.query.email</code> and no session continue to bypass the gate (the caller is trusted).</p> <p>The option is <code>@deprecated</code>. The next-minor release on <code>next</code> removes it entirely and makes the gate unconditional.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/9548">#9548</a> <a href="https://github.com/better-auth/better-auth/commit/142b86c43d2e6b258236a298a31237e97f87d64d"><code>142b86c</code></a> Thanks <a href="https://github.com/dipan-ck"><code>@​dipan-ck</code></a>! - anonymous plugin now correctly calls onLinkAccount when email verification triggers auto sign-in</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/9576">#9576</a> <a href="https://github.com/better-auth/better-auth/commit/1f2ff4215c4affff0b140b0c0a712c0dde35659c"><code>1f2ff42</code></a> Thanks <a href="https://github.com/gustavovalverde"><code>@​gustavovalverde</code></a>! - fix(oidc-provider, mcp): authenticate confidential clients on refresh_token grant and harden secret comparison</p> <p>Refresh-token grants on the legacy <code>oidc-provider</code> and <code>mcp</code> plugins now require the registered <code>client_secret</code> from confidential clients, matching the <code>authorization_code</code> path. Public clients (where <code>code_verifier</code> substitutes for the secret on the auth-code grant) continue to skip secret validation. Secret comparisons across both plugins now use constant-time equality. The <code>/mcp/token</code> endpoint no longer emits a wildcard CORS <code>Access-Control-Allow-Origin: *</code> header.</p> <p>These plugins are deprecated in favor of <code>@better-auth/oauth-provider</code>, which is unaffected. New deployments should adopt the replacement; this patch keeps existing deployments protected while migrating.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/9575">#9575</a> <a href="https://github.com/better-auth/better-auth/commit/699b09a2064dcb7d37046b5a90626c0b6f57af90"><code>699b09a</code></a> Thanks <a href="https://github.com/gustavovalverde"><code>@​gustavovalverde</code></a>! - fix(oidc-provider, mcp): drop <code>&quot;none&quot;</code> from advertised signing algorithms, default <code>allowPlainCodeChallengeMethod</code> to <code>false</code>, and reject missing PKCE method</p> <p>The legacy <code>oidc-provider</code> and <code>mcp</code> plugins now follow OAuth 2.1 (RFC 9700) on three protocol gates:</p> <ul> <li><code>id_token_signing_alg_values_supported</code> (oidc-provider, mcp) and <code>resource_signing_alg_values_supported</code> (mcp) no longer include <code>&quot;none&quot;</code>. Relying parties that negotiate from this list will no longer be steered toward unsigned tokens.</li> <li><code>allowPlainCodeChallengeMethod</code> defaults to <code>false</code>. Callers who need <code>plain</code> PKCE must opt in explicitly.</li> <li>Under the secure default the authorize endpoint no longer silently rewrites a missing <code>code_challenge_method</code> to <code>&quot;plain&quot;</code> before the allowlist check. A request that provides <code>code_challenge</code> without <code>code_challenge_method</code> is now rejected with <code>invalid_request</code>; the inverse case (<code>code_challenge_method</code> without <code>code_challenge</code>) is also rejected so no inconsistent PKCE state is persisted on the authorization code record.</li> </ul> <p>Non-breaking for callers who never relied on <code>&quot;none&quot;</code> advertisement or the plain default. Callers who explicitly set <code>allowPlainCodeChallengeMethod: true</code> keep <code>plain</code> on the allowlist <strong>and</strong> retain the legacy &quot;missing method defaults to plain&quot; behavior for backward compatibility, so existing integrations that opted into plain PKCE continue to work. The next-minor on <code>next</code> will drop both the <code>plain</code> allowlist entry and this fallback; until then, the option is the single explicit knob for legacy behavior. Migrate to <code>@better-auth/oauth-provider</code> for the canonical, spec-aligned implementation.</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/better-auth/better-auth/commit/f41514ef07cfafc5dbf463bd1500aee6575d88a7"><code>f41514e</code></a> chore: release v1.6.11 (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/9532">#9532</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/699b09a2064dcb7d37046b5a90626c0b6f57af90"><code>699b09a</code></a> fix(oidc-provider, mcp): drop &quot;none&quot; alg, default plain PKCE off, reject miss...</li> <li><a href="https://github.com/better-auth/better-auth/commit/b4bc65a007784b2eb0efb459e5fa6fd8055d3ec9"><code>b4bc65a</code></a> Merge commit from fork</li> <li><a href="https://github.com/better-auth/better-auth/commit/a1c9f3c08e7398e900e099839aa6dcc8d1d0b816"><code>a1c9f3c</code></a> fix(access): preserve exact role statement types (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/9507">#9507</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/da7e50beee849c59a2ed1ec6b3a38cc6ab9fb563"><code>da7e50b</code></a> fix(oauth): block OAuth linking to unverified local accounts (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/9578">#9578</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/23094a628f007f801be6d26e5b15dc5fc6fc4eb8"><code>23094a6</code></a> fix(organization): default-on <code>requireEmailVerificationOnInvitation</code> &amp; extend...</li> <li><a href="https://github.com/better-auth/better-auth/commit/1f2ff4215c4affff0b140b0c0a712c0dde35659c"><code>1f2ff42</code></a> fix(oidc-provider, mcp): authenticate confidential clients on refresh_token g...</li> <li><a href="https://github.com/better-auth/better-auth/commit/5f09d566a64ac9a0499d9664ce700edbf0630cea"><code>5f09d56</code></a> fix(magic-link): consume verification token atomically on verify (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/9572">#9572</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/99a254a79b59d5a3f5ca2123260118cddb5beed7"><code>99a254a</code></a> fix(device-authorization): bind approval to verifier session (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/9573">#9573</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/0cbddb8fa4eb19fbca75e9822134f89b3604286a"><code>0cbddb8</code></a> refactor(db): rename <code>claimOne</code> adapter primitive to <code>consumeOne</code> (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/9568">#9568</a>)</li> <li>Additional commits viewable in <a href="https://github.com/better-auth/better-auth/commits/[email protected]/packages/better-auth">compare view</a></li> </ul> </details> <br /> Updates `drizzle-kit` from 0.31.6 to 0.31.10 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/drizzle-team/drizzle-orm/releases">drizzle-kit's releases</a>.</em></p> <blockquote> <h2>[email protected]</h2> <ul> <li>Updated to <code>[email protected]</code> - native bun <code>stringWidth</code>, <code>stripANSI</code> support, errors for non-TTY environments</li> <li>We've migrated away from <code>esbuild-register</code> to <code>tsx</code> loader, it will now allow to use <code>drizzle-kit</code> seamlessly with both <code>ESM</code> and <code>CJS</code> modules</li> <li>We've also added native <code>Bun</code> and <code>Deno</code> launch support, which will not trigger <code>tsx</code> loader and utilise native <code>bun</code> and <code>deno</code> imports capabilities and faster startup times</li> </ul> <h2>[email protected]</h2> <ul> <li>drizzle-kit api improvements for D1 connections</li> </ul> <h2>[email protected]</h2> <h3>Bug fixes</h3> <ul> <li>Fixed <code>algorythm</code> =&gt; <code>algorithm</code> typo.</li> <li>Fixed external dependencies in build configuration.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/drizzle-team/drizzle-orm/commit/4aa6ecfee4b4728dadf6f77f071a149878a3c6c0"><code>4aa6ecf</code></a> Kit updates (<a href="https://redirect.github.com/drizzle-team/drizzle-orm/issues/5490">#5490</a>)</li> <li><a href="https://github.com/drizzle-team/drizzle-orm/commit/e8e6edfef5ca69c6188d320388ad440265911057"><code>e8e6edf</code></a> feat(drizzle-kit): support d1 via binding (<a href="https://redirect.github.com/drizzle-team/drizzle-orm/issues/5302">#5302</a>)</li> <li><a href="https://github.com/drizzle-team/drizzle-orm/commit/a086f59fba7f46f3a077893ba912c99e91eaa760"><code>a086f59</code></a> Fixed pg-native Pool detection in node-postgres transactions breaking in envi...</li> <li><a href="https://github.com/drizzle-team/drizzle-orm/commit/c445637df39366bcf47b12601896ce851771c1c2"><code>c445637</code></a> Merge pull request <a href="https://redirect.github.com/drizzle-team/drizzle-orm/issues/5095">#5095</a> from drizzle-team/main-workflows</li> <li><a href="https://github.com/drizzle-team/drizzle-orm/commit/e7b3aaa26456b88cd23a7843ebc95b3bddde1ba4"><code>e7b3aaa</code></a> Merge branch 'main' into main-workflows</li> <li><a href="https://github.com/drizzle-team/drizzle-orm/commit/0d885a54ddafd8717f8610cf3d2899f3eef61e65"><code>0d885a5</code></a> refactor: Update condition for run-feature job to improve clarity and functio...</li> <li><a href="https://github.com/drizzle-team/drizzle-orm/commit/45a1ffbcbfdd96772d0aba7d9e43744db2dce471"><code>45a1ffb</code></a> Merge pull request <a href="https://redirect.github.com/drizzle-team/drizzle-orm/issues/5087">#5087</a> from drizzle-team/main-workflows</li> <li><a href="https://github.com/drizzle-team/drizzle-orm/commit/6357645bd33b1f444e1d081769dd4b71c3de31f8"><code>6357645</code></a> chore: Comment out NEON_HTTP_CONNECTION_STRING requirement in release workflows</li> <li><a href="https://github.com/drizzle-team/drizzle-orm/commit/53dec98a936f549d0cc2e668f19db3a2df842f51"><code>53dec98</code></a> refactor: Simplify release router workflow by removing unnecessary switch job...</li> <li><a href="https://github.com/drizzle-team/drizzle-orm/commit/ce88a181e03d8b9b3fd0b62c93cc1faa05b0e000"><code>ce88a18</code></a> Merge remote-tracking branch 'origin/ext-deps-kit' into main-workflows</li> <li>Additional commits viewable in <a href="https://github.com/drizzle-team/drizzle-orm/compare/[email protected]@0.31.10">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for drizzle-kit since your current version.</p> </details> <br /> Updates `react-email` from 6.0.0 to 6.1.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/resend/react-email/releases">react-email's releases</a>.</em></p> <blockquote> <h2>[email protected]</h2> <h3>Patch Changes</h3> <ul> <li>1c386ce: Avoid spamming each spinner frame as a new line on non-TTY streams (CI logs, pipes, dumb terminals). The spinner now logs each status text once instead of redrawing animated frames when the output is not a TTY.</li> <li>ad6a9de: - deprecate packageManager CLI option for <code>email build</code>, only supporting npm <ul> <li>ensure <code>email build</code> dependency installation includes dev dependencies</li> </ul> </li> </ul> <h2>[email protected]</h2> <p>No release notes provided.</p> <h2>[email protected]</h2> <h3>Patch Changes</h3> <ul> <li>3c62bd0: fix divider with extra borders around other corners</li> </ul> <h2>[email protected]</h2> <h3>Patch Changes</... _Description has been truncated_
isyuricunha (Migrated from github.com) reviewed 2026-05-14 07:49:27 +00:00
vercel[bot] commented 2026-05-14 07:49:31 +00:00 (Migrated from github.com)

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
website-web Error Error May 14, 2026 7:52am
[vc]: #/g3chfxxPo+2KnWUlmh62kXqy49zc6FUkKy0ZlMurb4=:eyJpc01vbm9yZXBvIjp0cnVlLCJ0eXBlIjoiZ2l0aHViIiwicHJvamVjdHMiOlt7Im5hbWUiOiJ3ZWJzaXRlLXdlYiIsInByb2plY3RJZCI6InByal9iNnJGaEFBUEhJWFI3M2Nlb2RFMHl2bEJ3MzgyIiwicm9vdERpcmVjdG9yeSI6ImFwcHMvd2ViIiwiaW5zcGVjdG9yVXJsIjoiaHR0cHM6Ly92ZXJjZWwuY29tL3l1cmktY3VuaGFzLXByb2plY3RzL3dlYnNpdGUtd2ViL0RWeVdmeVZCVk1mUUxmTFVyUmVwckt4RkxDdkciLCJwcmV2aWV3VXJsIjoiIiwibmV4dENvbW1pdFN0YXR1cyI6IkZBSUxFRCIsImxpdmVGZWVkYmFjayI6eyJyZXNvbHZlZCI6MCwidW5yZXNvbHZlZCI6MCwidG90YWwiOjAsImxpbmsiOiIifX1dfQ== The latest updates on your projects. Learn more about [Vercel for GitHub](https://vercel.link/github-learn-more). | Project | Deployment | Actions | Updated (UTC) | | :--- | :----- | :------ | :------ | | [website-web](https://vercel.com/yuri-cunhas-projects/website-web) | ![Error](https://vercel.com/static/status/error.svg) [Error](https://vercel.com/yuri-cunhas-projects/website-web/DVyWfyVBVMfQLfLUrReprKxFLCvG) | | May 14, 2026 7:52am |
dependabot[bot] commented 2026-05-17 06:32:31 +00:00 (Migrated from github.com)

Looks like these dependencies are updatable in another way, so this is no longer needed.

Looks like these dependencies are updatable in another way, so this is no longer needed.

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No reviewers
isyuricunha
Labels
Clear labels   
bug
Something isn't working

  
dependencies
Pull requests that update a dependency file

  
documentation
Improvements or additions to documentation

  
duplicate
This issue or pull request already exists

  
enhancement
New feature or request

  
github_actions
Pull requests that update GitHub Actions code

  
good first issue
Good for newcomers

  
help wanted
Extra attention is needed

  
invalid
This doesn't seem right

  
javascript
Pull requests that update javascript code

  
question
Further information is requested

  
severity: high
Impact/severity classification (audit)

  
severity: low
Impact/severity classification (audit)

  
severity: medium
Impact/severity classification (audit)

  
wontfix
This will not be worked on

No labels
bug
dependencies
documentation
duplicate
enhancement
github_actions
good first issue
help wanted
invalid
javascript
question
severity: high
severity: low
severity: medium
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
isyuricunha/website!128
No description provided.