chore(deps): bump the npm-deps group across 1 directory with 11 updates by dependabot[bot] · Pull Request #86 · codebar/auth

dependabot · 2026-10-03T10:28:49Z

Bumps the npm-deps group with 11 updates in the / directory:

Package	From	To
@better-auth/oauth-provider	`1.7.5`	`1.7.6`
better-auth	`1.7.5`	`1.7.6`
hono	`4.13.5`	`4.13.9`
@commitlint/cli	`21.2.2`	`21.2.3`
@commitlint/config-conventional	`21.2.2`	`21.2.3`
@playwright/test	`1.62.1`	`1.63.0`
eslint	`10.8.1`	`10.11.0`
globals	`17.11.0`	`17.12.0`
lint-staged	`17.3.0`	`17.6.0`
prettier	`3.9.6`	`3.9.9`
tap	`21.7.5`	`21.8.0`

Updates @better-auth/oauth-provider from 1.7.5 to 1.7.6

Release notes

Sourced from @better-auth/oauth-provider's releases.

v1.7.6

better-auth

Features

Added support for a bannedUserMessage function that receives the banned user, allowing sign-in errors to include details such as the ban reason. (#11325)

Added Vercel BotID as a captcha provider for protected authentication routes. (#11016)

Bug Fixes

Passwords over maxPasswordLength are now rejected with PASSWORD_TOO_LONG before hashing or verification. (#11324)

Fixed React hydration mismatches when session or plugin auth queries resolve before streamed components hydrate. (#11316)

Prevented older auth-query responses from overwriting newer results when requests overlap. (#11376)

Fixed model identity when a custom model name matches another schema key. (#11333)

Fixed schema validation for Cloudflare D1 when the Kysely dialect cannot introspect the database. (#11366)

Fixed social account linking through the OAuth Proxy plugin. (#11268)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

Fixed model identity when a custom model name matches another schema key. (#11333)

Fixed schema validation for SQLite-generated primary keys, including INTEGER PRIMARY KEY columns without AUTOINCREMENT. (#11374)

Fixed schema validation for Cloudflare D1 when the Kysely dialect cannot introspect the database. (#11366)

For detailed changes, see CHANGELOG

@better-auth/prisma-adapter

Bug Fixes

Fixed model identity when a custom model name matches another schema key. (#11333)

Fixed schema validation for capitalized custom Prisma model names. (#11319)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

Fixed model identity when a custom model name matches another schema key. (#11333)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

... (truncated)

Changelog

Sourced from @better-auth/oauth-provider's changelog.

1.7.6

Commits

229a02a chore: release v1.7.6 (#11322)
See full diff in compare view

Updates better-auth from 1.7.5 to 1.7.6

Release notes

Sourced from better-auth's releases.

v1.7.6

better-auth

Features

Added support for a bannedUserMessage function that receives the banned user, allowing sign-in errors to include details such as the ban reason. (#11325)

Added Vercel BotID as a captcha provider for protected authentication routes. (#11016)

Bug Fixes

Passwords over maxPasswordLength are now rejected with PASSWORD_TOO_LONG before hashing or verification. (#11324)

Fixed React hydration mismatches when session or plugin auth queries resolve before streamed components hydrate. (#11316)

Prevented older auth-query responses from overwriting newer results when requests overlap. (#11376)

Fixed model identity when a custom model name matches another schema key. (#11333)

Fixed schema validation for Cloudflare D1 when the Kysely dialect cannot introspect the database. (#11366)

Fixed social account linking through the OAuth Proxy plugin. (#11268)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

Fixed model identity when a custom model name matches another schema key. (#11333)

Fixed schema validation for SQLite-generated primary keys, including INTEGER PRIMARY KEY columns without AUTOINCREMENT. (#11374)

Fixed schema validation for Cloudflare D1 when the Kysely dialect cannot introspect the database. (#11366)

For detailed changes, see CHANGELOG

@better-auth/prisma-adapter

Bug Fixes

Fixed model identity when a custom model name matches another schema key. (#11333)

Fixed schema validation for capitalized custom Prisma model names. (#11319)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

Fixed model identity when a custom model name matches another schema key. (#11333)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.6

Patch Changes

#11325 af88385 Thanks @Wadiou! - Admin plugin bannedUserMessage can now be a function that receives the banned user, so sign-in errors can include details such as the ban reason.

#11268 2fa501c Thanks @bytaesu! - Support linking social accounts through the OAuth Proxy plugin.

#11366 d41e2ca Thanks @bytaesu! - Use targeted PRAGMA queries when a Kysely dialect cannot introspect Cloudflare D1.

#11016 3d0efa3 Thanks @davbrito! - Support Vercel BotID checks on protected authentication routes in Vercel-hosted applications.

#11333 631ac29 Thanks @bytaesu! - Preserve logical model identity when a custom model name matches another schema key.

#11324 8853419 Thanks @XXMOHAMED012! - Passwords longer than maxPasswordLength are now rejected with PASSWORD_TOO_LONG before hashing on sign-in (email, username, phone number), verify-password, change-password (currentPassword), delete-user, the two-factor endpoints that take a password, and admin create-user, matching what sign-up and password reset already did.

#11316 2ee1545 Thanks @Smidge! - Fix React hydration mismatches when a session or plugin auth query resolves before a streamed component hydrates. Preserve the server-rendered pending state during hydration, then update to the current client state without changing ordinary or computed plugin stores.

#11376 fc45d08 Thanks @bytaesu! - Prevent older auth-query responses from replacing newer results when requests overlap.

Updated dependencies [41b7dc1, d41e2ca, 631ac29, 2b13e01]:

@better-auth/prisma-adapter@1.7.6

@better-auth/kysely-adapter@1.7.6

@better-auth/core@1.7.6

@better-auth/drizzle-adapter@1.7.6

@better-auth/memory-adapter@1.7.6

@better-auth/mongo-adapter@1.7.6

@better-auth/telemetry@1.7.6

Commits

229a02a chore: release v1.7.6 (#11322)
dcaa5a7 feat(cli): add check command for schema validation (#11314)
fc45d08 fix(client): prevent stale query overwrites (#11376)
8853419 fix: enforce maxPasswordLength before hashing on password verification endpoi...
2fa501c fix(oauth-proxy): support social account linking (#11268)
3d0efa3 feat(captcha): add Vercel BotID provider (#11016)
af88385 feat(admin): allow bannedUserMessage to be a function of the banned user (#11...
2ee1545 fix(client): preserve auth query snapshots during hydration (#11316)
0362d62 test(oauth): cover stateless implicit linking across instances (#11298)
See full diff in compare view

Updates hono from 4.13.5 to 4.13.9

Release notes

Sourced from hono's releases.

v4.13.9

What's Changed

fix(jsx): replace Suspense and ErrorBoundary content across newlines in honojs/hono#5380

fix(accepts): match media types and language tags case-insensitively in honojs/hono#5376

fix(linear-router): don't match an empty path segment as a param in honojs/hono#5373

fix(pretty-json): don't break responses with unparseable JSON bodies in honojs/hono#5377

fix(jwt): throw JwtTokenInvalid when the signature is not valid base64url in honojs/hono#5379

fix(aws-lambda): treat binary +xml archive media types as binary in honojs/hono#5424

fix(aws-lambda): preserve empty query parameters in honojs/hono#5292

fix(lambda-edge): sync content type detection with aws-lambda in honojs/hono#5426

fix(lambda-edge): fail with a descriptive error on a malformed event in honojs/hono#5358

Full Changelog: honojs/hono@v4.13.8...v4.13.9

v4.13.8

What's Changed

docs: fix typos in code comments and link third-party middleware section in honojs/hono#5343

perf(jsx/dom): reduce lookup work for large keyed updates in honojs/hono#5340

fix(aws-lambda): respect backpressure when streaming the response body in honojs/hono#5351

fix(accepts, language): skip accept entries with quality 0 when matching in honojs/hono#5311

fix(accept): treat the q parameter name as case-insensitive in honojs/hono#5349

fix(accept): clamp a negative q to 0, not 1 in honojs/hono#5357

fix(request): keep the request media type when reusing a cached body in honojs/hono#5366

docs(combine): fix except() JSDoc param and add missing @returns in honojs/hono#5346

perf(jsx/dom): optimize matching-head child lookup during reconciliation in honojs/hono#5329

Full Changelog: honojs/hono@v4.13.7...v4.13.8

v4.13.7

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

What's Changed

fix(client): keep a param value of "index" in $url() and $path() in honojs/hono#5297

fix(client): normalize root WebSocket URLs in honojs/hono#5291

fix(types): allow symbol keys in Context get and set fallbacks in honojs/hono#5300

chore: bump editorconfig-checker in honojs/hono#5336

refactor(on-handler): use forEach for consistent handler iteration in honojs/hono#5326

Full Changelog: honojs/hono@v4.13.5...v4.13.6

Commits

7c3b0df 4.13.9
6cadf75 fix(lambda-edge): fail with a descriptive error on a malformed event (#5358)
de310ac fix(lambda-edge): sync content type detection with aws-lambda (#5426)
28e8572 fix(aws-lambda): preserve empty query parameters (#5292)
0d86899 fix(aws-lambda): treat binary +xml archive media types as binary (#5424)
52febbc fix(jwt): throw JwtTokenInvalid when the signature is not valid base64url (#5...
f950277 fix(pretty-json): don't break responses with unparseable JSON bodies (#5377)
00ee875 fix(linear-router): don't match an empty path segment as a param (#5373)
f5a5346 fix(accepts): match media types and language tags case-insensitively (#5376)
cb5bea3 fix(jsx): replace Suspense and ErrorBoundary content across newlines (#5380)
Additional commits viewable in compare view

Updates @commitlint/cli from 21.2.2 to 21.2.3

Release notes

Sourced from @commitlint/cli's releases.

v21.2.3

21.2.3 (2026-09-19)

Bug Fixes

fix(types): correct breaking-change-exclamation-mark rule config type by @lazerg in conventional-changelog/commitlint#4954

fix(config-nx-scopes): read scopes from the nx project graph by @dylanpulver in conventional-changelog/commitlint#4957

fix(lint): trim trailing whitespace off the message handed to ignore matchers by @dylanpulver in conventional-changelog/commitlint#4960

fix(load): detect dynamic await support on node majors above 20 by @dylanpulver in conventional-changelog/commitlint#4961

fix(rules): report the case that matched in case rule failure messages by @dylanpulver in conventional-changelog/commitlint#4962

fix(load): run the parser factory of scoped conventional-changelog presets by @maximilliangrand in conventional-changelog/commitlint#4968

Refactor

refactor(load): drop the node version check gating cosmiconfig loaders by @dylanpulver in conventional-changelog/commitlint#4972

Chore, ci, build, etc.

build: install pnpm via npm instead of corepack by @escapedcat in conventional-changelog/commitlint#4948

build: retire the docker compose dev environment by @escapedcat in conventional-changelog/commitlint#4949

build: verify pnpm tarball against the packageManager sha512 pin by @escapedcat in conventional-changelog/commitlint#4952

ci: stabilize Windows CI by raising Vitest default timeout by @escapedcat with @Copilot in conventional-changelog/commitlint#4959

docs: drop the Node 24 config-loading workaround note by @escapedcat in conventional-changelog/commitlint#4976

chore: move pnpm settings from .npmrc to pnpm-workspace.yaml by @escapedcat in conventional-changelog/commitlint#4977

chore: swap pnpm resolutionMode time-based for minimumReleaseAge by @escapedcat in conventional-changelog/commitlint#4984

New Contributors

@lazerg made their first contribution in conventional-changelog/commitlint#4954

@escapedcat with @Copilot made their first contribution in conventional-changelog/commitlint#4959

@dylanpulver made their first contribution in conventional-changelog/commitlint#4957

@maximilliangrand made their first contribution in conventional-changelog/commitlint#4968

Full Changelog: conventional-changelog/commitlint@v21.2.2...v21.2.3

Changelog

Sourced from @commitlint/cli's changelog.

21.2.3 (2026-09-19)

Bug Fixes

lint: trim trailing whitespace off the message handed to ignore matchers (#4960) (a6f279b)

Commits

95d4056 v21.2.3
a6f279b fix(lint): trim trailing whitespace off the message handed to ignore matchers...
See full diff in compare view

Updates @commitlint/config-conventional from 21.2.2 to 21.2.3

Release notes

Sourced from @commitlint/config-conventional's releases.

v21.2.3

21.2.3 (2026-09-19)

Bug Fixes

fix(types): correct breaking-change-exclamation-mark rule config type by @lazerg in conventional-changelog/commitlint#4954

fix(config-nx-scopes): read scopes from the nx project graph by @dylanpulver in conventional-changelog/commitlint#4957

fix(lint): trim trailing whitespace off the message handed to ignore matchers by @dylanpulver in conventional-changelog/commitlint#4960

fix(load): detect dynamic await support on node majors above 20 by @dylanpulver in conventional-changelog/commitlint#4961

fix(rules): report the case that matched in case rule failure messages by @dylanpulver in conventional-changelog/commitlint#4962

fix(load): run the parser factory of scoped conventional-changelog presets by @maximilliangrand in conventional-changelog/commitlint#4968

Refactor

refactor(load): drop the node version check gating cosmiconfig loaders by @dylanpulver in conventional-changelog/commitlint#4972

Chore, ci, build, etc.

build: install pnpm via npm instead of corepack by @escapedcat in conventional-changelog/commitlint#4948

build: retire the docker compose dev environment by @escapedcat in conventional-changelog/commitlint#4949

build: verify pnpm tarball against the packageManager sha512 pin by @escapedcat in conventional-changelog/commitlint#4952

ci: stabilize Windows CI by raising Vitest default timeout by @escapedcat with @Copilot in conventional-changelog/commitlint#4959

docs: drop the Node 24 config-loading workaround note by @escapedcat in conventional-changelog/commitlint#4976

chore: move pnpm settings from .npmrc to pnpm-workspace.yaml by @escapedcat in conventional-changelog/commitlint#4977

chore: swap pnpm resolutionMode time-based for minimumReleaseAge by @escapedcat in conventional-changelog/commitlint#4984

New Contributors

@lazerg made their first contribution in conventional-changelog/commitlint#4954

@escapedcat with @Copilot made their first contribution in conventional-changelog/commitlint#4959

@dylanpulver made their first contribution in conventional-changelog/commitlint#4957

@maximilliangrand made their first contribution in conventional-changelog/commitlint#4968

Full Changelog: conventional-changelog/commitlint@v21.2.2...v21.2.3

Changelog

Sourced from @commitlint/config-conventional's changelog.

21.2.3 (2026-09-19)

Bug Fixes

rules: report the case that matched in case rule failure messages (#4962) (9f5f7bc)

Commits

95d4056 v21.2.3
9f5f7bc fix(rules): report the case that matched in case rule failure messages (#4962)
See full diff in compare view

Updates @playwright/test from 1.62.1 to 1.63.0

Release notes

Sourced from @playwright/test's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:
test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});
A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:
// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();
The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:
await page.locator('button').visible().click();
🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:
await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });
Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits

1b025d7 chore: mark v1.63.0 (#42569)
0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
13dbf10 cherry-pick(#42552): docs: release notes for v1.63
e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
2b7a5f2 test: response.body() for content-encoding:identity (#42537)
648a67c fix(mcp): create parent directories for explicitly named files (#42540)
7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
52900a1 devops: restore npm publishing from GitHub Actions (#42550)
8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
Additional commits viewable in compare view

Updates eslint from 10.8.1 to 10.11.0

Release notes

Sourced from eslint's releases.

v10.11.0

Features

d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#21271) (Pavel)

397b3b8 feat: report unsafe labeled continue in no-unsafe-finally rule (#21316) (electrohyun)

d3dd47f feat: only exempt new-cap built-ins that reference the global (#21290) (sethamus)

Bug Fixes

22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#21311) (xbinaryx)

b684bb1 fix: make TimePass.parse optional in types and docs (#21313) (ntnyq)

26d11bc fix: don't report __proto__ properties in object-shorthand (#21310) (xbinaryx)

Documentation

9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#21312) (bytedoe)

6c789ff docs: Update README (GitHub Actions Bot)

5997825 docs: clarify preserve-caught-error known limitation (#21294) (Akinyemi Toluwalase)

Chores

520dd77 perf: Implement fast paths in critical areas (#21210) (Nicholas C. Zakas)

92086c8 test: update EMFILE error generation for Node.js 26.9.0 compatibility (#21330) (Francesco Trotta)

9ac7eb6 chore: update github/codeql-action action to v4.38.0 (#21331) (renovate[bot])

24310e3 chore: update ecosystem plugins (#21324) (ESLint Bot)

45ad79e ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (#21318) (dependabot[bot])

ac74e37 chore: Add AGENTS.md with AI disclosure requirements (#21221) (Nicholas C. Zakas)

c832660 chore: Upgrade Stylelint to the latest version in docs (#21245) (Jung Hyeon Jun)

f9f88fc chore: update ecosystem plugins (#21308) (ESLint Bot)

fc81076 ci: add more types integration tests (#20395) (Nitin Kumar)

v10.10.0

Features

264b434 feat: add d and v flags to no-unexpected-multiline (#21305) (Gihyeon Jeong / 정기현)

c6cc6c5 feat: check Object.prototype property names in new-cap (#21269) (crimsonjay0)

5661fa6 feat: no-extra-bind false negatives with class fields and static blocks (#21260) (synthex-byte)

Bug Fixes

bb47dc6 fix: update dependency file-entry-cache to v11 (#20801) (Milos Djermanovic)

427ac0a fix: use format strings in debug calls (#21247) (Francesco Trotta)

9d81532 fix: support __proto__ in /* exported */ comments (#21261) (sethamus)

87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282) (김채영)

8e2cb14 fix: new-cap false positive for UTC calls with properties: false (#21275) (Pixel)

9f4a364 fix: Ignore static imports in no-unreachable (#21276) (Taha Kotil)

Documentation

2417cad docs: Update README (GitHub Actions Bot)

9cecb8a docs: document \c control letter escapes in no-control-regex (#21286) (한국)

8724829 docs: update compat table links (#21263) (fnx)

5634542 docs: Clarify eqeqeq suggestion behavior (#21256) (Müslüm Yılmaz)

Chores

b3d876b chore: disable npm audit in ecosystem tests (#21306) (Francesco Trotta)

1696682 ci: restore EMFILE test on Node.js 26 (#21297) (Marry (Subin Yang))

... (truncated)

Commits

3c0b7c6 10.11.0
321f0a7 Build: changelog update for 10.11.0
520dd77 perf: Implement fast paths in critical areas (#21210)
9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#21312)
92086c8 test: update EMFILE error generation for Node.js 26.9.0 compatibility (#21330)
9ac7eb6 chore: update github/codeql-action action to v4.38.0 (#21331)
22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#21311)
24310e3 chore: update ecosystem plugins (#21324)
d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#21...
45ad79e ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (#21318)
Additional commits viewable in compare view

Updates globals from 17.11.0 to 17.12.0

Release notes

Sourced from globals's releases.

v17.12.0

Update globals (2026-09-01) (#353) 50a2119

Add __webpack_layer__ global (#351) 779a11a

sindresorhus/globals@v17.11.0...v17.12.0

Commits

98008c3 17.12.0
50a2119 Update globals (2026-09-01) (#353)
779a11a Add __webpack_layer__ global (#351)
See full diff in compare view

Updates lint-staged from 17.3.0 to 17.6.0

Release notes

Sourced from lint-staged's releases.

v17.6.0

Minor Changes
#1850 938d3f4 - Task functions like { title, task } can now use a logger function log() to emit output while the task runs. By default, the output will only be visible if the task fails, unless the --verbose option was used. Additionally, when the task rejects, the error will be shown in the output.
import { defineConfig } from 'lint-staged/config'
export default defineConfig({
'*': {
title: 'Fail if PDF files are committed',
task: async (filepaths, { log }) => {
const pdfFiles = filepaths.filter((f) => f.toLowerCase().endsWith('.pdf'))
if (pdfFiles.length > 0) {
log('PDF files should not be committed: %s', pdfFiles)
throw new Error('Failed')
}
},
},
})
#1854 30562bc - lint-staged now stages changes to all tracked files modified by tasks, including files that weren’t originally staged or didn’t match the configured globs. This can happen when your task has side-effects, or it's a function that ignores the staged files like () => "prettier --write .".

If you have unstaged changes in a file and the task also edits that file, your unstaged changes will be staged too. Use --hide-unstaged to hide your changes while tasks run.
Patch Changes
#1860 4296532 - The assignment of staged files to lint-staged configuration files (when using multiple, for example in a monorepo) has been rewritten to be more efficient. As a reminder, each staged file is assigned to exactly one configuration (the closest one), even if that config doesn't match the file in its globs.
#1861 c45f28a - Fix running parallel tasks for a single glob, when tasks are created by a function. Nesting one level of arrays inside an array of tasks will result in the inner tasks running in parallel. This behavior should now be consistent when creating tasks using functions. In the following example eslint and prettier will run in parallel (for all files, when any JS files are staged):
import { defineConfig } from 'lint-staged/config'
export default defineConfig({
'*.js': () => [['eslint --max-warnings=0 .', 'prettier --list-different .']],
})
#1859 f0ea69d - Various performance improvements from skipping redundant internal Git calls.

#1856 69d7d17 - Partially staged changes are hidden in a uniquely-named patch file to avoid multiple invocations of lint-staged overwriting it. This makes it safer to run lint-staged in multiple worktrees at the same time.
v17.5.1

Patch Changes

#1852 bfcca94 - Fix TypeScript issue TS1254 from defineConfig() by changing the signature from const to a function:

A 'const' initializer in an ambient context must be a string or numeric literal or literal enum reference.

... (truncated)

Changelog

Sourced from lint-staged's changelog.

17.6.0

Minor Changes

#1850 938d3f4 - Task functions like { title, task } can now use a logger function log() to emit output while the task runs. By default, the output will only be visible if the task fails, unless the --verbose option was used. Additionally, when the task rejects, the erro...
Description has been truncated

Bumps the npm-deps group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@better-auth/oauth-provider](https://github.com/better-auth/better-auth/tree/HEAD/packages/oauth-provider) | `1.7.5` | `1.7.6` | | [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.5` | `1.7.6` | | [hono](https://github.com/honojs/hono) | `4.13.5` | `4.13.9` | | [@commitlint/cli](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/cli) | `21.2.2` | `21.2.3` | | [@commitlint/config-conventional](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/config-conventional) | `21.2.2` | `21.2.3` | | [@playwright/test](https://github.com/microsoft/playwright) | `1.62.1` | `1.63.0` | | [eslint](https://github.com/eslint/eslint) | `10.8.1` | `10.11.0` | | [globals](https://github.com/sindresorhus/globals) | `17.11.0` | `17.12.0` | | [lint-staged](https://github.com/lint-staged/lint-staged) | `17.3.0` | `17.6.0` | | [prettier](https://github.com/prettier/prettier) | `3.9.6` | `3.9.9` | | [tap](https://github.com/tapjs/tapjs) | `21.7.5` | `21.8.0` | Updates `@better-auth/oauth-provider` from 1.7.5 to 1.7.6 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/oauth-provider/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.6/packages/oauth-provider) Updates `better-auth` from 1.7.5 to 1.7.6 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.6/packages/better-auth) Updates `hono` from 4.13.5 to 4.13.9 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.13.5...v4.13.9) Updates `@commitlint/cli` from 21.2.2 to 21.2.3 - [Release notes](https://github.com/conventional-changelog/commitlint/releases) - [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/cli/CHANGELOG.md) - [Commits](https://github.com/conventional-changelog/commitlint/commits/v21.2.3/@commitlint/cli) Updates `@commitlint/config-conventional` from 21.2.2 to 21.2.3 - [Release notes](https://github.com/conventional-changelog/commitlint/releases) - [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/config-conventional/CHANGELOG.md) - [Commits](https://github.com/conventional-changelog/commitlint/commits/v21.2.3/@commitlint/config-conventional) Updates `@playwright/test` from 1.62.1 to 1.63.0 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.62.1...v1.63.0) Updates `eslint` from 10.8.1 to 10.11.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.8.1...v10.11.0) Updates `globals` from 17.11.0 to 17.12.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](sindresorhus/globals@v17.11.0...v17.12.0) Updates `lint-staged` from 17.3.0 to 17.6.0 - [Release notes](https://github.com/lint-staged/lint-staged/releases) - [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md) - [Commits](lint-staged/lint-staged@v17.3.0...v17.6.0) Updates `prettier` from 3.9.6 to 3.9.9 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.9.6...3.9.9) Updates `tap` from 21.7.5 to 21.8.0 - [Release notes](https://github.com/tapjs/tapjs/releases) - [Commits](https://github.com/tapjs/tapjs/compare/tap@21.7.5...tap@21.8.0) --- updated-dependencies: - dependency-name: "@better-auth/oauth-provider" dependency-version: 1.7.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-deps - dependency-name: better-auth dependency-version: 1.7.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-deps - dependency-name: hono dependency-version: 4.13.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-deps - dependency-name: "@commitlint/cli" dependency-version: 21.2.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-deps - dependency-name: "@commitlint/config-conventional" dependency-version: 21.2.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-deps - dependency-name: "@playwright/test" dependency-version: 1.63.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: eslint dependency-version: 10.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: globals dependency-version: 17.12.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: lint-staged dependency-version: 17.6.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: prettier dependency-version: 3.9.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-deps - dependency-name: tap dependency-version: 21.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-deps ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 3, 2026

Navigation Menu

chore(deps): bump the npm-deps group across 1 directory with 11 updates - #86

chore(deps): bump the npm-deps group across 1 directory with 11 updates#86
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-deps-f608e77090

dependabot Bot commented on behalf of github Oct 3, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 3, 2026

v1.7.6

better-auth

Features

Bug Fixes

@better-auth/kysely-adapter

Bug Fixes

@better-auth/prisma-adapter

Bug Fixes

@better-auth/core

Bug Fixes

@better-auth/drizzle-adapter

Bug Fixes

1.7.6

v1.7.6

better-auth

Features

Bug Fixes

@better-auth/kysely-adapter

Bug Fixes

@better-auth/prisma-adapter

Bug Fixes

@better-auth/core

Bug Fixes

@better-auth/drizzle-adapter

Bug Fixes

1.7.6

Patch Changes

v4.13.9

What's Changed

v4.13.8

What's Changed

v4.13.7

Security fixes

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

v4.13.6

What's Changed

v21.2.3

21.2.3 (2026-09-19)

Bug Fixes

Refactor

Chore, ci, build, etc.

New Contributors

21.2.3 (2026-09-19)

Bug Fixes

v21.2.3

21.2.3 (2026-09-19)

Bug Fixes

Refactor

Chore, ci, build, etc.

New Contributors

21.2.3 (2026-09-19)

Bug Fixes

v1.63.0

🔒 Test locks

🪟 Locate across frames

👁️ Visible-only locators

🧾 Step params and subtitles

v10.11.0

Features

Bug Fixes

Documentation

Chores

v10.10.0

Features

Bug Fixes

Documentation

Chores

v17.12.0

v17.6.0

Minor Changes

Patch Changes

v17.5.1

Patch Changes

17.6.0

Minor Changes

Uh oh!

This branch has not been deployed

Reviewers

`better-auth`

`@better-auth/kysely-adapter`

`@better-auth/prisma-adapter`

`@better-auth/core`

`@better-auth/drizzle-adapter`

`better-auth`

`@better-auth/kysely-adapter`

`@better-auth/prisma-adapter`

`@better-auth/core`

`@better-auth/drizzle-adapter`

`hono/jsx` renders plain strings unescaped in boundary components, leading to XSS