From 34ac6f4a8f68b0b9a341c823cfc0ba93e90dac46 Mon Sep 17 00:00:00 2001 From: "autter[bot]" Date: Fri, 30 Oct 2026 18:24:40 +0000 Subject: [PATCH 1/2] fix(dependencies): Update Autter-dev/autter-tracker Automated vendor API adaptation for vendor change rup_1934fdd01ba0_2026-10-30. Bumped the runtime security-sensitive dependencies to their fixed versions and updated the lockfile surgically: better-auth 1.5.6 -> 1.6.11, @better-auth/passkey 1.5.6 -> 1.6.11, hono 4.12.10 -> 4.12.25, drizzle-orm 0.44.7 -> 0.45.2, zod 4.3.6 -> 4.6.6, kysely 0.28.15 -> 0.28.17, source-map-js 1.2.1 -> 1.2.2. The @better-auth/* subtree (core 1.6.11, utils 0.4.0, better-call 1.3.5, adapters 1.6.11) was updated in the lockfile so the tree stays consistent. Verified: `npm ci --include=dev` installs cleanly, `tsc --noEmit` passes for both packages, and the full CLI vitest suite (61 tests, including the new repro test) passes. Added reproduction test packages/cli/tests/dependency-versions.test.ts asserting the fixed resolved versions (fails before, passes after). Deviations (need human review): @better-auth/passkey was bumped to 1.6.11 instead of the listed 1.4.0 because 1.4.0 fails the API typecheck against better-auth@1.6.11 (its peers require better-auth@1.4.0); pg was left at ^8.14.0 (the listed 2.11.2 is a legacy downgrade conflicting with better-auth's pg ^8 peer and is unused); wrangler left at ^4.0.0 (listed 2.20.1 is a downgrade incompatible with wrangler.toml); vitest/vite left at 3.x/7.x (dev-only; 4.x rewrites the whole dev tree). Transitive-only advisories (tinypool, sharp, brace-expansion, js-yaml, undici, ws, @vitest/mocker) were not individually pinnable because their parents do not allow the listed fixed versions (or the package is no longer in the tree). Note: plain `npm install` hits ERESOLVE due to upstream peer constraints; the validated install path is `npm ci` (or --legacy-peer-deps). Autter-Fix-Job: rup_1934fdd01ba0_2026-10-30 --- package-lock.json | 253 +++++++++--------- packages/api/package.json | 8 +- .../cli/tests/dependency-versions.test.ts | 45 ++++ 3 files changed, 176 insertions(+), 130 deletions(-) create mode 100644 packages/cli/tests/dependency-versions.test.ts diff --git a/package-lock.json b/package-lock.json index d39aa4d..ca972b3 100644 --- a/package-lock.json +++ b/package-lock.json @@ -91,9 +91,9 @@ } }, "node_modules/@better-auth/core": { - "version": "1.5.6", - "resolved": "https://registry.npmjs.org/@better-auth/core/-/core-1.5.6.tgz", - "integrity": "sha512-Ez9DZdIMFyxHremmoLz1emFPGNQomDC1jqqBPnZ6Ci+6TiGN3R9w/Y03cJn6I8r1ycKgOzeVMZtJ/erOZ27Gsw==", + "version": "1.6.11", + "resolved": "https://registry.npmjs.org/@better-auth/core/-/core-1.6.11.tgz", + "integrity": "sha512-LrwidLCV8azdMGjvtwp30nj9tIv1BwI3VhtC0UaGSjQkAVWw4bN42I8qwbxRziPeSQoj+zUVkOpxZzAWBDARtQ==", "license": "MIT", "peer": true, "dependencies": { @@ -102,11 +102,11 @@ "zod": "^4.3.6" }, "peerDependencies": { - "@better-auth/utils": "0.3.1", + "@better-auth/utils": "0.4.0", "@better-fetch/fetch": "1.1.21", "@cloudflare/workers-types": ">=4", "@opentelemetry/api": "^1.9.0", - "better-call": "1.3.2", + "better-call": "1.3.5", "jose": "^6.1.0", "kysely": "^0.28.5", "nanostores": "^1.0.1" @@ -118,14 +118,14 @@ } }, "node_modules/@better-auth/kysely-adapter": { - "version": "1.5.6", - "resolved": "https://registry.npmjs.org/@better-auth/kysely-adapter/-/kysely-adapter-1.5.6.tgz", - "integrity": "sha512-Fnf+h8WVKtw6lEOmVmiVVzDf3shJtM60AYf9XTnbdCeUd6MxN/KnaJZpkgtYnRs7a+nwtkVB+fg4lGETebGFXQ==", + "version": "1.6.11", + "resolved": "https://registry.npmjs.org/@better-auth/kysely-adapter/-/kysely-adapter-1.6.11.tgz", + "integrity": "sha512-/g8M9RfIjdcZDnbstSUvQiINkvdNlCeZr248zwqx2/PVksQI1MhQofbzUn3RnQnbPKp0EPwpX/dR3oudRFenUg==", "license": "MIT", "peerDependencies": { - "@better-auth/core": "1.5.6", - "@better-auth/utils": "^0.3.0", - "kysely": "^0.27.0 || ^0.28.0" + "@better-auth/core": "^1.6.11", + "@better-auth/utils": "0.4.0", + "kysely": "^0.28.17" }, "peerDependenciesMeta": { "kysely": { @@ -134,23 +134,23 @@ } }, "node_modules/@better-auth/memory-adapter": { - "version": "1.5.6", - "resolved": "https://registry.npmjs.org/@better-auth/memory-adapter/-/memory-adapter-1.5.6.tgz", - "integrity": "sha512-rS7ZsrIl5uvloUgNN0u9LOZJMMXnsZXVdUZ3MrTBKWM2KpoJjzPr9yN3Szyma5+0V7SltnzSGHPkYj2bEzzmlA==", + "version": "1.6.11", + "resolved": "https://registry.npmjs.org/@better-auth/memory-adapter/-/memory-adapter-1.6.11.tgz", + "integrity": "sha512-hpdfw0BBf8MuzLkIdmbcUZICbY9r/bhLO2RxSnkzT5+/O+0I0u2I8+m0YUP7vNllP/ZCKASHOYgXPLO75Z0f9Q==", "license": "MIT", "peerDependencies": { - "@better-auth/core": "1.5.6", - "@better-auth/utils": "^0.3.0" + "@better-auth/core": "^1.6.11", + "@better-auth/utils": "0.4.0" } }, "node_modules/@better-auth/mongo-adapter": { - "version": "1.5.6", - "resolved": "https://registry.npmjs.org/@better-auth/mongo-adapter/-/mongo-adapter-1.5.6.tgz", - "integrity": "sha512-6+M3MS2mor8fTUV3EI1FBLP0cs6QfbN+Ovx9+XxR/GdfKIBoNFzmPEPRbdGt+ft6PvrITsUm+T70+kkHgVSP6w==", + "version": "1.6.11", + "resolved": "https://registry.npmjs.org/@better-auth/mongo-adapter/-/mongo-adapter-1.6.11.tgz", + "integrity": "sha512-3Tor8rSv8vSEIMEaV2PFpPEuVhqc1gNoZ6eGvoh3LwExXXuj8madew6ob+H1pH7Aphn3Ar5PQ08AguT8TbwFAA==", "license": "MIT", "peerDependencies": { - "@better-auth/core": "1.5.6", - "@better-auth/utils": "^0.3.0", + "@better-auth/core": "^1.6.11", + "@better-auth/utils": "0.4.0", "mongodb": "^6.0.0 || ^7.0.0" }, "peerDependenciesMeta": { @@ -160,24 +160,25 @@ } }, "node_modules/@better-auth/telemetry": { - "version": "1.5.6", - "resolved": "https://registry.npmjs.org/@better-auth/telemetry/-/telemetry-1.5.6.tgz", - "integrity": "sha512-yXC7NSxnIFlxDkGdpD7KA+J9nqIQAPCJKe77GoaC5bWoe/DALo1MYorZfTgOafS7wrslNtsPT4feV/LJi1ubqQ==", + "version": "1.6.11", + "resolved": "https://registry.npmjs.org/@better-auth/telemetry/-/telemetry-1.6.11.tgz", + "integrity": "sha512-hsjDHc8MZbm6/AHeNdtywrWedXevnBjmdvnHTcZub+rTVjOv+Td0roI8USKuC6uUibmrl//2rJfVCsGbopihNA==", "license": "MIT", - "dependencies": { - "@better-auth/utils": "0.3.1", - "@better-fetch/fetch": "1.1.21" - }, "peerDependencies": { - "@better-auth/core": "1.5.6" + "@better-auth/core": "^1.6.11", + "@better-auth/utils": "0.4.0", + "@better-fetch/fetch": "1.1.21" } }, "node_modules/@better-auth/utils": { - "version": "0.3.1", - "resolved": "https://registry.npmjs.org/@better-auth/utils/-/utils-0.3.1.tgz", - "integrity": "sha512-+CGp4UmZSUrHHnpHhLPYu6cV+wSUSvVbZbNykxhUDocpVNTo9uFFxw/NqJlh1iC4wQ9HKKWGCKuZ5wUgS0v6Kg==", + "version": "0.4.0", + "resolved": "https://registry.npmjs.org/@better-auth/utils/-/utils-0.4.0.tgz", + "integrity": "sha512-RpMtLUIQAEWMgdPLNVbIF5ON2mm+CH0U3rCdUCU1VyeAUui4m38DyK7/aXMLZov2YDjG684pS1D0MBllrmgjQA==", "license": "MIT", - "peer": true + "peer": true, + "dependencies": { + "@noble/hashes": "^2.0.1" + } }, "node_modules/@better-fetch/fetch": { "version": "1.1.21", @@ -3445,12 +3446,12 @@ } }, "node_modules/better-call": { - "version": "1.3.2", - "resolved": "https://registry.npmjs.org/better-call/-/better-call-1.3.2.tgz", - "integrity": "sha512-4cZIfrerDsNTn3cm+MhLbUePN0gdwkhSXEuG7r/zuQ8c/H7iU0/jSK5TD3FW7U0MgKHce/8jGpPYNO4Ve+4NBw==", + "version": "1.3.5", + "resolved": "https://registry.npmjs.org/better-call/-/better-call-1.3.5.tgz", + "integrity": "sha512-kOFJkBP7utAQLEYrobZm3vkTH8mXq5GNgvjc5/XEST1ilVHaxXUXfeDeFlqoETMtyqS4+3/h4ONX2i++ebZrvA==", "license": "MIT", "dependencies": { - "@better-auth/utils": "^0.3.1", + "@better-auth/utils": "^0.4.0", "@better-fetch/fetch": "^1.1.21", "rou3": "^0.7.12", "set-cookie-parser": "^3.0.1" @@ -4376,9 +4377,9 @@ } }, "node_modules/drizzle-orm": { - "version": "0.44.7", - "resolved": "https://registry.npmjs.org/drizzle-orm/-/drizzle-orm-0.44.7.tgz", - "integrity": "sha512-quIpnYznjU9lHshEOAYLoZ9s3jweleHlZIAWR/jX9gAWNg/JhQ1wj0KGRf7/Zm+obRrYd9GjPVJg790QY9N5AQ==", + "version": "0.45.2", + "resolved": "https://registry.npmjs.org/drizzle-orm/-/drizzle-orm-0.45.2.tgz", + "integrity": "sha512-kY0BSaTNYWnoDMVoyY8uxmyHjpJW1geOmBMdSSicKo9CIIWkSxMIj2rkeSR51b8KAPB7m+qysjuHme5nKP+E5Q==", "license": "Apache-2.0", "peer": true, "peerDependencies": { @@ -5632,9 +5633,9 @@ } }, "node_modules/hono": { - "version": "4.12.10", - "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.10.tgz", - "integrity": "sha512-mx/p18PLy5og9ufies2GOSUqep98Td9q4i/EF6X7yJgAiIopxqdfIO3jbqsi3jRgTgw88jMDEzVKi+V2EF+27w==", + "version": "4.12.25", + "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.25.tgz", + "integrity": "sha512-2NFaIyNVgJmBs/ecmtGzlmluTFs5cHEWGTdu0t1HBwYzoGXOL5nUQBRMXsXWla5i4KkG//QMzVP88m1+I3fdAQ==", "license": "MIT", "engines": { "node": ">=16.9.0" @@ -6298,9 +6299,9 @@ } }, "node_modules/kysely": { - "version": "0.28.15", - "resolved": "https://registry.npmjs.org/kysely/-/kysely-0.28.15.tgz", - "integrity": "sha512-r2clcf7HLWvDXaVUEvQymXJY4i3bSOIV3xsL/Upy3ZfSv5HeKsk9tsqbBptLvth5qHEIhxeHTA2jNLyQABkLBA==", + "version": "0.28.17", + "resolved": "https://registry.npmjs.org/kysely/-/kysely-0.28.17.tgz", + "integrity": "sha512-nbD8lB9EB3wNdMhOCdx5Li8DxnLbvKByylRLcJ1h+4SkrowVeECAyZlyiKMThF7xFdRz0jSQ2MoJr+wXux2y0Q==", "license": "MIT", "peer": true, "engines": { @@ -7738,9 +7739,9 @@ } }, "node_modules/source-map-js": { - "version": "1.2.1", - "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz", - "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==", + "version": "1.2.2", + "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz", + "integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==", "devOptional": true, "license": "BSD-3-Clause", "engines": { @@ -9571,9 +9572,9 @@ } }, "node_modules/zod": { - "version": "4.3.6", - "resolved": "https://registry.npmjs.org/zod/-/zod-4.3.6.tgz", - "integrity": "sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg==", + "version": "4.6.6", + "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.6.tgz", + "integrity": "sha512-4UmzQUF5fxvfcYHlbjBmejU+w+hbDnWFx4aS8kBx7nPBHcO2SqPbpAG8snbdg+Xse4pRefR98hgjFgIMCI/UhA==", "license": "MIT", "funding": { "url": "https://github.com/sponsors/colinhacks" @@ -9583,11 +9584,11 @@ "name": "@autter/api", "version": "0.1.0", "dependencies": { - "@better-auth/passkey": "^1.5.6", + "@better-auth/passkey": "1.6.11", "@neondatabase/serverless": "^1.0.0", - "better-auth": "^1.2.0", - "drizzle-orm": "^0.44.0", - "hono": "^4.7.0" + "better-auth": "1.6.11", + "drizzle-orm": "0.45.2", + "hono": "4.12.25" }, "devDependencies": { "@cloudflare/workers-types": "^4.20250401.0", @@ -9598,9 +9599,9 @@ } }, "packages/api/node_modules/@better-auth/passkey": { - "version": "1.5.6", - "resolved": "https://registry.npmjs.org/@better-auth/passkey/-/passkey-1.5.6.tgz", - "integrity": "sha512-2DQkPK5Rw7g6Zixa3MSoH31s4Au96O94+QvJl3F0LK3P6KDjEGlRh1CgzQmzafwBJjmsRx9jSwckGP6jiEEDtw==", + "version": "1.6.11", + "resolved": "https://registry.npmjs.org/@better-auth/passkey/-/passkey-1.6.11.tgz", + "integrity": "sha512-QjL+OyiKRSHFRhSp2CSe7u5jnRL5G+Eh4bW9eV4WFZQ+2a/S+113kHQxPqxhy3Onb5cQhkT5Bhyz7cxKNDJTPw==", "license": "MIT", "dependencies": { "@simplewebauthn/browser": "^13.2.2", @@ -9608,128 +9609,128 @@ "zod": "^4.3.6" }, "peerDependencies": { - "@better-auth/core": "1.5.6", - "@better-auth/utils": "0.3.1", + "@better-auth/core": "^1.6.11", + "@better-auth/utils": "0.4.0", "@better-fetch/fetch": "1.1.21", - "better-auth": "1.5.6", - "better-call": "1.3.2", + "better-auth": "^1.6.11", + "better-call": "1.3.5", "nanostores": "^1.0.1" } }, "packages/api/node_modules/better-auth": { - "version": "1.5.6", - "resolved": "https://registry.npmjs.org/better-auth/-/better-auth-1.5.6.tgz", - "integrity": "sha512-QSpJTqaT1XVfWRQe/fm3PgeuwOIlz1nWX/Dx7nsHStJ382bLzmDbQk2u7IT0IJ6wS5SRxfqEE1Ev9TXontgyAQ==", - "license": "MIT", - "dependencies": { - "@better-auth/core": "1.5.6", - "@better-auth/drizzle-adapter": "1.5.6", - "@better-auth/kysely-adapter": "1.5.6", - "@better-auth/memory-adapter": "1.5.6", - "@better-auth/mongo-adapter": "1.5.6", - "@better-auth/prisma-adapter": "1.5.6", - "@better-auth/telemetry": "1.5.6", - "@better-auth/utils": "0.3.1", - "@better-fetch/fetch": "1.1.21", - "@noble/ciphers": "^2.1.1", - "@noble/hashes": "^2.0.1", - "better-call": "1.3.2", + "version": "1.6.11", + "resolved": "https://registry.npmjs.org/better-auth/-/better-auth-1.6.11.tgz", + "integrity": "sha512-Wwt6+q07dwIhsp6XiM7L1qSXVUWBEtNl+eZvwM778CguFqDZFBN9Pt6LtFaHl55t8Z+Zc//5kxcbgDY8/79vFQ==", + "license": "MIT", + "dependencies": { + "zod": "^4.3.6", "defu": "^6.1.4", "jose": "^6.1.3", - "kysely": "^0.28.12", + "kysely": "^0.28.17", "nanostores": "^1.1.1", - "zod": "^4.3.6" + "better-call": "1.3.5", + "@noble/hashes": "^2.0.1", + "@noble/ciphers": "^2.1.1", + "@better-auth/core": "1.6.11", + "@better-auth/utils": "0.4.0", + "@better-fetch/fetch": "1.1.21", + "@better-auth/telemetry": "1.6.11", + "@better-auth/mongo-adapter": "1.6.11", + "@better-auth/kysely-adapter": "1.6.11", + "@better-auth/memory-adapter": "1.6.11", + "@better-auth/prisma-adapter": "1.6.11", + "@better-auth/drizzle-adapter": "1.6.11" }, "peerDependencies": { - "@lynx-js/react": "*", - "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0", - "@sveltejs/kit": "^2.0.0", - "@tanstack/react-start": "^1.0.0", - "@tanstack/solid-start": "^1.0.0", - "better-sqlite3": "^12.0.0", - "drizzle-kit": ">=0.31.4", - "drizzle-orm": ">=0.41.0", - "mongodb": "^6.0.0 || ^7.0.0", - "mysql2": "^3.0.0", - "next": "^14.0.0 || ^15.0.0 || ^16.0.0", "pg": "^8.0.0", - "prisma": "^5.0.0 || ^6.0.0 || ^7.0.0", + "vue": "^3.0.0", + "next": "^14.0.0 || ^15.0.0 || ^16.0.0", "react": "^18.0.0 || ^19.0.0", - "react-dom": "^18.0.0 || ^19.0.0", - "solid-js": "^1.0.0", + "mysql2": "^3.0.0", + "prisma": "^5.0.0 || ^6.0.0 || ^7.0.0", "svelte": "^4.0.0 || ^5.0.0", "vitest": "^2.0.0 || ^3.0.0 || ^4.0.0", - "vue": "^3.0.0" + "mongodb": "^6.0.0 || ^7.0.0", + "solid-js": "^1.0.0", + "react-dom": "^18.0.0 || ^19.0.0", + "drizzle-kit": ">=0.31.4", + "drizzle-orm": "^0.45.2", + "@sveltejs/kit": "^2.0.0", + "@lynx-js/react": "*", + "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0", + "better-sqlite3": "^12.0.0", + "@tanstack/react-start": "^1.0.0", + "@tanstack/solid-start": "^1.0.0" }, "peerDependenciesMeta": { - "@lynx-js/react": { + "pg": { "optional": true }, - "@prisma/client": { + "vue": { "optional": true }, - "@sveltejs/kit": { + "next": { "optional": true }, - "@tanstack/react-start": { + "react": { "optional": true }, - "@tanstack/solid-start": { + "mysql2": { "optional": true }, - "better-sqlite3": { + "prisma": { "optional": true }, - "drizzle-kit": { + "svelte": { "optional": true }, - "drizzle-orm": { + "vitest": { "optional": true }, "mongodb": { "optional": true }, - "mysql2": { + "solid-js": { "optional": true }, - "next": { + "react-dom": { "optional": true }, - "pg": { + "drizzle-kit": { "optional": true }, - "prisma": { + "drizzle-orm": { "optional": true }, - "react": { + "@sveltejs/kit": { "optional": true }, - "react-dom": { + "@lynx-js/react": { "optional": true }, - "solid-js": { + "@prisma/client": { "optional": true }, - "svelte": { + "better-sqlite3": { "optional": true }, - "vitest": { + "@tanstack/react-start": { "optional": true }, - "vue": { + "@tanstack/solid-start": { "optional": true } } }, "packages/api/node_modules/better-auth/node_modules/@better-auth/drizzle-adapter": { - "version": "1.5.6", - "resolved": "https://registry.npmjs.org/@better-auth/drizzle-adapter/-/drizzle-adapter-1.5.6.tgz", - "integrity": "sha512-VfFFmaoFw3ug12SiSuIwzrMoHyIVmkMGWm9gZ4sXdYYVX4HboCL4m3fjzOhppcmK5OGatRuU+N1UX6wxCITcXw==", + "version": "1.6.11", + "resolved": "https://registry.npmjs.org/@better-auth/drizzle-adapter/-/drizzle-adapter-1.6.11.tgz", + "integrity": "sha512-4jpkETIGZOHCf7BK4jnu22fdN6jjomH0/HhEzkaWy3+Eppi5PYlHTF/460jrTmA3Xc+Vqwp9t282ymHiEPypGw==", "license": "MIT", "peerDependencies": { - "@better-auth/core": "1.5.6", - "@better-auth/utils": "^0.3.0", - "drizzle-orm": ">=0.41.0" + "@better-auth/core": "^1.6.11", + "@better-auth/utils": "0.4.0", + "drizzle-orm": "^0.45.2" }, "peerDependenciesMeta": { "drizzle-orm": { @@ -9738,13 +9739,13 @@ } }, "packages/api/node_modules/better-auth/node_modules/@better-auth/prisma-adapter": { - "version": "1.5.6", - "resolved": "https://registry.npmjs.org/@better-auth/prisma-adapter/-/prisma-adapter-1.5.6.tgz", - "integrity": "sha512-UxY9vQJs1Tt+O+T2YQnseDMlWmUSQvFZSBb5YiFRg7zcm+TEzujh4iX2/csA0YiZptLheovIuVWTP9nriewEBA==", + "version": "1.6.11", + "resolved": "https://registry.npmjs.org/@better-auth/prisma-adapter/-/prisma-adapter-1.6.11.tgz", + "integrity": "sha512-Pw+7q7zTp+VSci1V+CYMvuxIbAeVMZLe4lRo46LJoAKMHfjFl5T/ycsyFvWs/DkWC7n9gZZzRDEbHp0I5FiKKw==", "license": "MIT", "peerDependencies": { - "@better-auth/core": "1.5.6", - "@better-auth/utils": "^0.3.0", + "@better-auth/core": "^1.6.11", + "@better-auth/utils": "0.4.0", "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0", "prisma": "^5.0.0 || ^6.0.0 || ^7.0.0" }, diff --git a/packages/api/package.json b/packages/api/package.json index c6c6b0e..907ba48 100644 --- a/packages/api/package.json +++ b/packages/api/package.json @@ -15,11 +15,11 @@ "typecheck": "tsc --noEmit" }, "dependencies": { - "@better-auth/passkey": "^1.5.6", + "@better-auth/passkey": "1.6.11", "@neondatabase/serverless": "^1.0.0", - "better-auth": "^1.2.0", - "drizzle-orm": "^0.44.0", - "hono": "^4.7.0" + "better-auth": "1.6.11", + "drizzle-orm": "0.45.2", + "hono": "4.12.25" }, "devDependencies": { "@cloudflare/workers-types": "^4.20250401.0", diff --git a/packages/cli/tests/dependency-versions.test.ts b/packages/cli/tests/dependency-versions.test.ts new file mode 100644 index 0000000..3b68861 --- /dev/null +++ b/packages/cli/tests/dependency-versions.test.ts @@ -0,0 +1,45 @@ +import { describe, expect, it } from "vitest"; +import { existsSync, readFileSync } from "node:fs"; +import { join, resolve } from "node:path"; + +/** + * Guards the CVE fixes that bump vulnerable dependencies to their fixed + * versions (see .autter/result.json). These manifests are the source of + * truth for the resolved versions the CLI and API actually ship with. + */ +function lockfilePath(): string { + // The CLI tests usually run with cwd = packages/cli; also tolerate running + // from the repository root. + const fromCli = resolve(process.cwd(), "..", "..", "package-lock.json"); + if (existsSync(fromCli)) return fromCli; + return resolve(process.cwd(), "package-lock.json"); +} + +function resolvedVersion(name: string): string | undefined { + const lock = JSON.parse( + readFileSync(lockfilePath(), "utf8"), + ) as { packages: Record }; + const suffix = `/node_modules/${name}`; + const candidates = Object.keys(lock.packages).filter( + (key) => key === suffix.slice(1) || key.endsWith(suffix), + ); + // Prefer the shallowest (root-most) location. + candidates.sort((a, b) => a.split("/").length - b.split("/").length); + return candidates[0] ? lock.packages[candidates[0]]?.version : undefined; +} + +describe("CVE dependency bumps", () => { + const expected: Array<[string, string]> = [ + ["better-auth", "1.6.11"], + ["@better-auth/passkey", "1.6.11"], + ["drizzle-orm", "0.45.2"], + ["hono", "4.12.25"], + ["zod", "4.6.6"], + ["kysely", "0.28.17"], + ["source-map-js", "1.2.2"], + ]; + + it.each(expected)("%s resolves to fixed version %s", (name, version) => { + expect(resolvedVersion(name), `resolved version of ${name}`).toBe(version); + }); +}); From 005e10834451967fb2d941b6e413653cf336f187 Mon Sep 17 00:00:00 2001 From: "autter[bot]" Date: Sun, 1 Nov 2026 00:21:53 +0000 Subject: [PATCH 2/2] fix(dependencies): Update Autter-dev/autter-tracker Automated vendor API adaptation for vendor change rup_1934fdd01ba0_2026-11-01. Fixed GHSA-3g3m-2fjr-6pw4 (glob) and GHSA-g3hv-75wg-m249 (minimatch) by bumping the transitive versions resolved under test-exclude in package-lock.json: glob 10.5.0 -> 14.0.2 and minimatch 9.0.9 -> 11.0.1, with the required transitive lockfile updates (path-scurry 3.0.0, lru-cache 11.1.0, brace-expansion 5.0.12, @isaacs/nonrecursive-glob-match). No direct source call sites or dependency manifests exist for glob/minimatch (grep across the repo found only transitive lockfile ranges), so the change is lockfile-only plus a guard test. Added packages/cli/tests/dependency-versions.test.ts asserting the fixed versions resolve; the CLI test suite (62 tests, incl. this guard) passes with the change, and the guard fails against the pre-fix lockfile (glob 10.5.0 / minimatch 9.0.9). Note: the repository's .git directory is root-owned and not writable by this sandbox user, so the change could not be committed with git; it is staged only as working-tree modifications on branch autter/fix-updates. Autter-Fix-Job: rup_1934fdd01ba0_2026-11-01 --- package-lock.json | 76 ++++++++++++------- .../cli/tests/dependency-versions.test.ts | 16 ++++ 2 files changed, 64 insertions(+), 28 deletions(-) diff --git a/package-lock.json b/package-lock.json index ca972b3..f95b8ee 100644 --- a/package-lock.json +++ b/package-lock.json @@ -6383,11 +6383,14 @@ "license": "MIT" }, "node_modules/lru-cache": { - "version": "10.4.3", - "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz", - "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==", + "version": "11.1.0", + "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.1.0.tgz", + "integrity": "sha512-QIXZUBJUx+2zHUdQujWejBkcD9+cs94tLn0+YL8UrCh+D5sCXZ4c7LaEH48pNwRY3MLDgqUFyhlCyjJPf1WP0A==", "dev": true, - "license": "ISC" + "license": "ISC", + "engines": { + "node": "20 || >=22" + } }, "node_modules/magic-string": { "version": "0.30.21", @@ -6855,17 +6858,17 @@ "license": "MIT" }, "node_modules/path-scurry": { - "version": "1.11.1", - "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-1.11.1.tgz", - "integrity": "sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==", + "version": "3.0.0", + "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-3.0.0.tgz", + "integrity": "sha512-1pTbQqH1wIwMi/eleQ5leFTTCkzFsPcgXNjwOA8YGGW/W4/kHT3dssE7Z6NH+zuqNLOzOB0uaD61yl7cAcVhgg==", "dev": true, "license": "BlueOak-1.0.0", "dependencies": { - "lru-cache": "^10.2.0", - "minipass": "^5.0.0 || ^6.0.2 || ^7.0.0" + "minipass": "^7.1.2", + "lru-cache": "^11.0.0" }, "engines": { - "node": ">=16 || 14 >=14.18" + "node": "18 || 20 || >=22" }, "funding": { "url": "https://github.com/sponsors/isaacs" @@ -8088,38 +8091,55 @@ } }, "node_modules/test-exclude/node_modules/glob": { - "version": "10.5.0", - "resolved": "https://registry.npmjs.org/glob/-/glob-10.5.0.tgz", - "integrity": "sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==", - "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me", + "version": "14.0.2", + "resolved": "https://registry.npmjs.org/glob/-/glob-14.0.2.tgz", + "integrity": "sha512-vfMgTR2djMHPUchsJMLpZlYQvtjVL+mHpEr5wPpoCbQs2vr/FBNK+3Gnl9Ara1DSs4Aeg4eG9HiADb5/rkY/ZA==", "dev": true, "license": "ISC", "dependencies": { - "foreground-child": "^3.1.0", - "jackspeak": "^3.1.2", - "minimatch": "^9.0.4", - "minipass": "^7.1.2", - "package-json-from-dist": "^1.0.0", - "path-scurry": "^1.11.1" + "minipass": "^7.1.3", + "minimatch": "^11.0.0", + "path-scurry": "^3.0.0" }, - "bin": { - "glob": "dist/esm/bin.mjs" + "engines": { + "node": "18 || 20 || >=22" }, "funding": { "url": "https://github.com/sponsors/isaacs" } }, + "node_modules/test-exclude/node_modules/glob/node_modules/@isaacs/nonrecursive-glob-match": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/@isaacs/nonrecursive-glob-match/-/nonrecursive-glob-match-1.0.1.tgz", + "integrity": "sha512-rNKPuTXBacPpn5+CP+S3/UI6uq/0jHZjPpaBLaRE3blpgX+E+ZUIrGfViPvUjUnQG6W1+3OTFUiVRCjTffs2+Q==", + "dev": true, + "license": "BlueOak-1.0.0" + }, + "node_modules/test-exclude/node_modules/glob/node_modules/brace-expansion": { + "version": "5.0.12", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz", + "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==", + "dev": true, + "license": "MIT", + "dependencies": { + "balanced-match": "^1.0.0" + }, + "engines": { + "node": "20 || >=22" + } + }, "node_modules/test-exclude/node_modules/glob/node_modules/minimatch": { - "version": "9.0.9", - "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz", - "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==", + "version": "11.0.1", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.1.tgz", + "integrity": "sha512-t+Vn6DX4wPCxS23y03C0uhF7S1jpi1GfqPrnlEipCJaA2ykiNbMkVlDutZtmvLfRcUN6R8AYVlzTsQrT4RZoLQ==", "dev": true, - "license": "ISC", + "license": "BlueOak-1.0.0", "dependencies": { - "brace-expansion": "^2.0.2" + "@isaacs/nonrecursive-glob-match": "^1.0.1", + "brace-expansion": "^5.0.12" }, "engines": { - "node": ">=16 || 14 >=14.17" + "node": "18 || 20 || >=22" }, "funding": { "url": "https://github.com/sponsors/isaacs" diff --git a/packages/cli/tests/dependency-versions.test.ts b/packages/cli/tests/dependency-versions.test.ts index 3b68861..78c6d1c 100644 --- a/packages/cli/tests/dependency-versions.test.ts +++ b/packages/cli/tests/dependency-versions.test.ts @@ -42,4 +42,20 @@ describe("CVE dependency bumps", () => { it.each(expected)("%s resolves to fixed version %s", (name, version) => { expect(resolvedVersion(name), `resolved version of ${name}`).toBe(version); }); + + it("glob and minimatch (via test-exclude) resolve to CVE-fixed versions", () => { + // GHSA-3g3m-2fjr-6pw4 (glob) and GHSA-g3hv-75wg-m249 (minimatch) + // are fixed in glob@14.0.2 and minimatch@11.0.1 respectively. + const lock = JSON.parse( + readFileSync(lockfilePath(), "utf8"), + ) as { packages: Record }; + expect( + lock.packages["node_modules/test-exclude/node_modules/glob"]?.version, + "resolved version of glob (transitive via test-exclude)", + ).toBe("14.0.2"); + expect( + lock.packages["node_modules/test-exclude/node_modules/glob/node_modules/minimatch"]?.version, + "resolved version of minimatch (transitive via test-exclude/glob)", + ).toBe("11.0.1"); + }); });