chore(deps)(deps): bump the minor-and-patch group across 1 directory with 37 updates by dependabot[bot] · Pull Request #92 · archmaxai/archmax

dependabot · 2026-08-24T04:26:04Z

Bumps the minor-and-patch group with 37 updates in the / directory:

Package	From	To
@vitest/coverage-v8	`4.1.10`	`4.1.11`
esbuild	`0.28.1`	`0.28.2`
turbo	`2.10.5`	`2.10.11`
vitest	`4.1.10`	`4.1.11`
@hono/node-server	`2.0.10`	`2.1.1`
@langchain/core	`1.2.3`	`1.2.9`
@langchain/openai	`1.5.5`	`1.5.10`
better-auth	`1.6.23`	`1.7.1`
deepagents	`1.11.1`	`1.13.0`
hono	`4.12.31`	`4.13.3`
mongoose	`9.7.4`	`9.9.3`
tsx	`4.23.1`	`4.23.12`
@astrojs/starlight	`0.41.3`	`0.41.7`
@playwright/test	`1.61.1`	`1.62.1`
@dagrejs/dagre	`3.0.0`	`3.1.1`
@tanstack/react-query	`5.101.2`	`5.101.4`
@tanstack/react-router	`1.170.18`	`1.170.31`
@xyflow/react	`12.11.2`	`12.11.3`
lucide-react	`1.25.0`	`1.33.0`
react	`19.2.7`	`19.2.8`
@types/react	`19.2.17`	`19.2.18`
react-dom	`19.2.7`	`19.2.8`
@types/react-dom	`19.2.3`	`19.2.4`
recharts	`3.9.2`	`3.10.1`
sonner	`2.0.7`	`2.0.8`
@tanstack/router-plugin	`1.168.23`	`1.168.34`
@vitejs/plugin-react	`6.0.3`	`6.1.0`
postcss	`8.5.20`	`8.5.26`
vite	`8.1.5`	`8.2.2`
@langchain/anthropic	`1.5.1`	`1.5.8`
isomorphic-git	`1.38.9`	`1.41.7`
langchain	`1.5.3`	`1.5.10`
@radix-ui/react-label	`2.1.12`	`2.1.15`
@radix-ui/react-separator	`1.1.12`	`1.1.15`
@radix-ui/react-slot	`1.3.0`	`1.3.3`
@radix-ui/react-tooltip	`1.2.13`	`1.2.16`
radix-ui	`1.6.3`	`1.6.7`

Updates @vitest/coverage-v8 from 4.1.10 to 4.1.11

Release notes

Sourced from @vitest/coverage-v8's releases.

v4.1.11

🐞 Bug Fixes

Revive global concurrency limit for test lifecycle [backport to v4] - by @sheremet-va and @hi-ogawa in vitest-dev/vitest#10992 (5146d)

browser:

Encode iframeId in tester iframe URL [backport to v4] - by @sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)

Trigger playwright/chromium gc on lower disk availability [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)

mocker:

Restrict redirect mocks to the fs allowlist [backport to v4] - by @sheremet-va in vitest-dev/vitest#10974 (fe5a1)

View changes on GitHub

Commits

9bd8d46 chore: release v4.1.11 (#10995)
See full diff in compare view

Updates esbuild from 0.28.1 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2
Fix tree shaking bug due to TypeScript import alias (#4507)

This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:
import Base from './dep.js';
import Alias = Base.SomeType;
Fix CSS minification bug involving & (#4497)

This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:
/* Original code */
.a .b {
 & .b:not(& .c) {
 color: red;
 }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}
This should match yes but not no. The old output incorrectly matched both.
Avoid overwriting input files without --allow-overwrite (#4484)

For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

Fix incorrect code generated when using top-level await (#4498)

Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.
Fix a minification bug with lowered logical assignment operators (#4508)

This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:
// Original code
function foo() {
 let x
 bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.2
Fix tree shaking bug due to TypeScript import alias (#4507)

This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:
import Base from './dep.js';
import Alias = Base.SomeType;
Fix CSS minification bug involving & (#4497)

This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:
/* Original code */
.a .b {
 & .b:not(& .c) {
 color: red;
 }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}
This should match yes but not no. The old output incorrectly matched both.
Avoid overwriting input files without --allow-overwrite (#4484)

For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

Fix incorrect code generated when using top-level await (#4498)

Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.
Fix a minification bug with lowered logical assignment operators (#4508)

This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:
// Original code
function foo() {
 let x

... (truncated)

Commits

609683d publish 0.28.2 to npm
11b1fe4 add to release notes
ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
04627b6 fix #4498: async TLA checks need a worklist
5c15177 disable gopls in the go folder
fc2ee9b css: adjust parser to allow --foo: {...}
209db54 release notes for css nesting bugfix
c625d31 fix #4497: preserve nested ampersands during minification (#4500)
34474e2 better isolation of current part in js parser
07f6e8c fix #4507: import assignment tree-shaking bug
Additional commits viewable in compare view

Updates turbo from 2.10.5 to 2.10.11

Release notes

Sourced from turbo's releases.

Turborepo v2.10.11

What's Changed

Changelog

chore: Release Turborepo 2.10.10 by @github-actions[bot] in vercel/turborepo#13741

fix: Automatically approve release workflows by @anthonyshew in vercel/turborepo#13743

chore: Release Turborepo 2.10.11-canary.1 by @github-actions[bot] in vercel/turborepo#13744

fix: Avoid repeated strict entrypoint traversal by @anthonyshew in vercel/turborepo#13745

chore: Release Turborepo 2.10.11-canary.2 by @github-actions[bot] in vercel/turborepo#13747

feat: Cache native uv tool tasks by @anthonyshew in vercel/turborepo#13748

chore: Release Turborepo 2.10.11-canary.3 by @github-actions[bot] in vercel/turborepo#13749

fix: Isolate concurrent generator config bundles by @anthonyshew in vercel/turborepo#13750

chore: Forbid release-age exclusions in examples maintenance by @anthonyshew in vercel/turborepo#13751

fix: Respect gitignore without git metadata by @anthonyshew in vercel/turborepo#13756

chore: Release Turborepo 2.10.11-canary.4 by @github-actions[bot] in vercel/turborepo#13759

feat: Expand performance agent toolbox by @anthonyshew in vercel/turborepo#13761

docs: Redesign Turborepo homepage by @christopherkindl in vercel/turborepo#13702

fix: Tolerate transient input files by @anthonyshew in vercel/turborepo#13734

Full Changelog: vercel/turborepo@v2.10.10...v2.10.11

Turborepo v2.10.11-canary.4

What's Changed

Changelog

chore: Release Turborepo 2.10.11-canary.3 by @github-actions[bot] in vercel/turborepo#13749

fix: Isolate concurrent generator config bundles by @anthonyshew in vercel/turborepo#13750

chore: Forbid release-age exclusions in examples maintenance by @anthonyshew in vercel/turborepo#13751

fix: Respect gitignore without git metadata by @anthonyshew in vercel/turborepo#13756

Full Changelog: vercel/turborepo@v2.10.11-canary.3...v2.10.11-canary.4

Turborepo v2.10.11-canary.3

What's Changed

Changelog

chore: Release Turborepo 2.10.11-canary.2 by @github-actions[bot] in vercel/turborepo#13747

feat: Cache native uv tool tasks by @anthonyshew in vercel/turborepo#13748

Full Changelog: vercel/turborepo@v2.10.11-canary.2...v2.10.11-canary.3

Turborepo v2.10.11-canary.2

... (truncated)

Commits

60af39b publish 2.10.11 to registry
3226457 fix: Tolerate transient input files (#13734)
09bf969 docs: Redesign Turborepo homepage (#13702)
f924510 feat: Expand performance agent toolbox (#13761)
9f94a7d chore: Release Turborepo 2.10.11-canary.4 (#13759)
45a87a0 fix: Respect gitignore without git metadata (#13756)
0b501f1 chore: Forbid release-age exclusions in examples maintenance (#13751)
3f64c07 fix: Isolate concurrent generator config bundles (#13750)
b08ab5f chore: Release Turborepo 2.10.11-canary.3 (#13749)
b4bd235 feat: Cache native uv tool tasks (#13748)
Additional commits viewable in compare view

Updates vitest from 4.1.10 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

🐞 Bug Fixes

Revive global concurrency limit for test lifecycle [backport to v4] - by @sheremet-va and @hi-ogawa in vitest-dev/vitest#10992 (5146d)

browser:

Encode iframeId in tester iframe URL [backport to v4] - by @sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)

Trigger playwright/chromium gc on lower disk availability [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)

mocker:

Restrict redirect mocks to the fs allowlist [backport to v4] - by @sheremet-va in vitest-dev/vitest#10974 (fe5a1)

View changes on GitHub

Commits

9bd8d46 chore: release v4.1.11 (#10995)
9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
See full diff in compare view

Updates @hono/node-server from 2.0.10 to 2.1.1

Release notes

Sourced from @hono/node-server's releases.

v2.1.1

What's Changed

perf: lazily materialize request headers by @BlankParticle in honojs/node-server#389

Full Changelog: honojs/node-server@v2.1.0...v2.1.1

v2.1.0

What's Changed

feat: add Early Hints (HTTP 103) middleware by @bilal-azam in honojs/node-server#378

fix(listener): avoid uncaught error when force-closing a non-standard socket by @mohamedramadan14 in honojs/node-server#383

New Contributors

@bilal-azam made their first contribution in honojs/node-server#378

@mohamedramadan14 made their first contribution in honojs/node-server#383

Full Changelog: honojs/node-server@v2.0.12...v2.1.0

v2.0.12

What's Changed

test: replace supertest by @BlankParticle in honojs/node-server#379

fix(response): copy headers when init is a foreign Response by @yusukebe in honojs/node-server#382

Full Changelog: honojs/node-server@v2.0.11...v2.0.12

v2.0.11

What's Changed

test: use a custom helper for path traversal tests by @BlankParticle in honojs/node-server#377

perf(request): fast-path QUERY methods by @usualoma in honojs/node-server#376

perf(request): fast-path PATCH method by @yusukebe in honojs/node-server#380

Full Changelog: honojs/node-server@v2.0.10...v2.0.11

Commits

73c03ad 2.1.1
5515aa0 perf: lazily materialize request headers (#389)
82ba34e 2.1.0
1f2909a fix(listener): avoid uncaught error when force-closing a non-standard socket ...
977a242 feat: add Early Hints (HTTP 103) middleware (#378)
a813b6c 2.0.12
caf48ba fix(response): copy headers when init is a foreign Response (#382)
3b1dd68 test: replace supertest (#379)
834e54f 2.0.11
ba72bcd perf(request): fast-path PATCH method (#380)
Additional commits viewable in compare view

Updates @langchain/core from 1.2.3 to 1.2.9

Release notes

Sourced from @langchain/core's releases.

@langchain/core@1.2.9

Patch Changes

#11402 43e4396 Thanks @thushanth-bengre-langchain! - Fix ChatVertexAI/ChatGoogle content blocks: include tool_call blocks from message.tool_calls and skip spurious empty text blocks in contentBlocks.

@langchain/core@1.2.8

Patch Changes

#11369 d6ad973 Thanks @hntrl! - fix(langchain): use unified endpoint for gateway

#11342 3b0e4c4 Thanks @thushanth-bengre-langchain! - feat(core): mark errors as retryable or not, and stop retrying the ones that aren't

Retry middleware retried every failure up to maxRetries, including deterministic ones like a bad API key or an unknown model. Retries also nest, so a single such failure could cost dozens of API calls.

@langchain/core/errors adds stampRetryable(error, retryable) and getRetryable(error). Marking an error leaves its class and shape untouched, so a provider SDK error can be classified without breaking instanceof. getRetryable returns undefined for errors nobody classified, and both are exported so tool authors can mark their own failures.

modelRetryMiddleware and toolRetryMiddleware now respect the mark by default, and retries stop as soon as one is found rather than each layer spending its own budget. Aborted calls, context overflow, and oversized payloads are marked non-retryable out of the box. Models accept a per-call maxRetries so a surrounding retry loop can take over.

Behavior change: errors marked non-retryable now fail on the first attempt. Unclassified errors — including any from third-party integrations or custom tools — retry exactly as before. Pass retryOn: () => true to restore the old default. A custom onFailedAttempt replaces the built-in handler and opts out of marking.

@langchain/core@1.2.7

Patch Changes

#11366 c068bbf Thanks @hntrl! - fix(core,langchain): patch and release core, update peer dependencies

@langchain/core@1.2.6

Patch Changes

#11344 f08e0c6 Thanks @hntrl! - fix: apply [Symbol.hasInstance] method to all comparable properties using .isInstance()

We have some internal schemas that rely on z.instanceof(). This uses a strict instanceof check which can conflict if there are multiple versions of core installed. This overrides the Symbol.hasInstance method to use the same logic as .isInstance() to compare objects at runtime.

@langchain/core@1.2.5

Patch Changes

#11305 e654022 Thanks @jacoblee93! - Add LangSmith Gateway environment configuration to OpenAI, Anthropic, and Fireworks chat models.

#11295 1a1b347 Thanks @vladislav-nechakhin! - fix(core): pass the mustache escape override per render call

@langchain/core@1.2.4

Patch Changes

#11190 9654bde Thanks @pawel-twardziak! - Coalesce nested LangChain tracer callbacks that share run bookkeeping.

#11153 84ce6d6 Thanks @parveshsaini! - fix(core): bind splitText when trimMessages receives a TextSplitter instance

Commits

e493ed6 chore: version packages (#11393)
8384848 fix(google-common): release endpoint routing fix as patch (#11413)
8cfff4d feat(google): add gateway support for genai (#11405)
7df258c chore(langchain): update langgraph deps (#11412)
3ceef4b fix(anthropic): round-trip tool search server-tool result blocks (#11407)
fe8eec1 fix(openai): drop Gemini functionCall content blocks in Chat Completions mess...
0e7c765 fix(google-genai): throw ContentBlockedError when Gemini candidate has no con...
5c9fdf2 fix(openai): retain cache_write_tokens, update to v7 sdk (#11399)
5ff9179 fix(google-genai): guard streaming chunks when candidate has no content (#10742)
43e4396 fix(core): include tool_call blocks and skip empty text blocks in ChatVertexA...
Additional commits viewable in compare view

Updates @langchain/openai from 1.5.5 to 1.5.10

Release notes

Sourced from @langchain/openai's releases.

@langchain/openai@1.5.10

Patch Changes

#11419 c26c87e Thanks @chiliec! - fix(openai): send content null (not []) for tool-call-only v1 assistant messages

@langchain/openai@1.5.9

Patch Changes

#11399 5c9fdf2 Thanks @gethin-langchain! - update to v7 openai sdk

#11403 fe8eec1 Thanks @thushanth-bengre-langchain! - Drop Gemini-native functionCall content blocks (already carried in tool_calls) when converting messages to Chat Completions API params, fixing requests that fail when a ChatGoogleGenerativeAI message is passed to ChatOpenAI (e.g. a cross-provider handoff in LangGraph).

#11399 5c9fdf2 Thanks @gethin-langchain! - Map OpenAI's cache_write_tokens to cache_creation in usage_metadata.input_token_details, mirroring the existing cached_tokens -> cache_read mapping across the Chat Completions and Responses APIs. Previously, prompt cache-write token counts were silently dropped.

@langchain/openai@1.5.8

Patch Changes

#11342 3b0e4c4 Thanks @thushanth-bengre-langchain! - feat(openai): mark OpenAI provider errors as retryable or not

Builds on stampRetryable in @langchain/core so the retry middleware can tell a transient failure from a deterministic one. Timeouts and rate limits are marked retryable; aborts, context overflow, invalid tool results, bad credentials, and unknown models non-retryable. Anything else stays unmarked and retries as before.

Also forwards a per-call maxRetries to the retry loop, so a surrounding retry loop such as modelRetryMiddleware can take over instead of the two multiplying against each other.

Errors keep their original class, so instanceof against the openai SDK error types is unaffected.

@langchain/openai@1.5.7

Patch Changes

#11347 3fe4c43 Thanks @talarari! - fix(openai): include usage in response_metadata when system_fingerprint is absent

@langchain/openai@1.5.6

Patch Changes

#11305 e654022 Thanks @jacoblee93! - Add LangSmith Gateway environment configuration to OpenAI, Anthropic, and Fireworks chat models.

Commits

d5264a1 chore: version packages (#11427)
c26c87e fix(openai): send content null (not []) for tool-call-only v1 assistant messa...
041a755 fix(anthropic): preserve generic tool_search_tool_result blocks (#11421)
e493ed6 chore: version packages (#11393)
8384848 fix(google-common): release endpoint routing fix as patch (#11413)
8cfff4d feat(google): add gateway support for genai (#11405)
7df258c chore(langchain): update langgraph deps (#11412)
3ceef4b fix(anthropic): round-trip tool search server-tool result blocks (#11407)
fe8eec1 fix(openai): drop Gemini functionCall content blocks in Chat Completions mess...
0e7c765 fix(google-genai): throw ContentBlockedError when Gemini candidate has no con...
Additional commits viewable in compare view

Updates better-auth from 1.6.23 to 1.7.1

Release notes

Sourced from better-auth's releases.

v1.7.1

better-auth

Bug Fixes

Added native database transaction support to test instances for PostgreSQL and MySQL.

Updated bundled dependencies (jose, nanostores, noble crypto packages, SimpleWebAuthn) to their latest compatible releases, with no changes required to existing projects.

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

Fixed case-insensitive parsing of string Boolean values for SCIM User active and the primary sub-attribute of emails, phoneNumbers, addresses, roles, and entitlements at the HTTP ingress, improving Microsoft Entra interoperability.

Added an optional SCIM-owned connection and credential catalog: configure managedConnections to allow trusted server code to create runtime tenant connections and issue, rotate, and revoke bearer credentials through server-only auth.api methods, without a code-defined connection or an application-owned verifier.

Fixed an issue where trusted server code could not retain a terminal connection binding before a dynamic SCIM connection's first authenticated request when supplying a provisioning domain during decommissioning.

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

Fixed SSO provider registration to allow reusing a SCIM connection ID, as SCIM connections no longer participate in the authentication provider namespace.

Fixed SAML assertion signature verification to validate signatures on the raw assertion instead of trusting an already-parsed response, and enforced signing policy and size limits on SP metadata. wantAssertionsSigned now correctly controls whether the SP requires signed assertions, matching real-world IdP signing behavior.

For detailed changes, see CHANGELOG

@better-auth/cimd

Bug Fixes

Fixed Client ID Metadata Document caching to follow shared-cache freshness rules: the plugin now prefers s-maxage over max-age and Expires, honors s-maxage=0, conditionally revalidates with ETag or Last-Modified, and treats invalid or duplicate freshness directives as immediately stale. Concurrent refreshes now converge on a single client-resource link instead of failing on a unique constraint.

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

Fixed native adapter transactions for raw database instances (better-sqlite3, node:sqlite, bun:sqlite, mysql2, pg) passed directly as database, matching the behavior of the explicit { db }/{ dialect } config shapes. Plugins requiring native transactions (such as @better-auth/scim) now work correctly when using the quickstart database: new Database(...) form.

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

Fixed scope error responses so MCP clients now receive a 403 with an RFC 6750 insufficient_scope WWW-Authenticate challenge naming every missing scope, allowing clients to request all needed scopes in a single authorization request.

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.1

Patch Changes

#10863 845bbd1 Thanks @gustavovalverde! - auth migrate no longer attempts to add a required column with no default value to a table that already has rows. It stops with an error naming the column and the backfill to run first. Previously the generated statement failed on SQLite, Postgres, and SQL Server; on MySQL it filled the new column with an empty string for every existing row and reported success. If auth migrate already ran against a MySQL database on 1.7, run the check in the upgrade guide's account identity section.

getMigrations throws the new UnsafeMigrationError (exported from better-auth/db/migration) for this refusal, so callers can distinguish it from other migration errors such as an index-definition conflict.

auth generate still emits the statements for external migration tooling, with a comment banner naming any column that needs a manual backfill first.

A required field whose database column is still nullable logs a warning instead of blocking the migration.

A CLI command that fails now prints its error and exits with a non-zero code instead of an unhandled promise rejection.

Updated dependencies []:

@better-auth/core@1.7.1

@better-auth/drizzle-adapter@1.7.1

@better-auth/kysely-adapter@1.7.1

@better-auth/memory-adapter@1.7.1

@better-auth/mongo-adapter@1.7.1

@better-auth/prisma-adapter@1.7.1

@better-auth/telemetry@1.7.1

1.7.0

Minor Changes

#8733 4e8e4c7 Thanks @bytaesu! - Add hydrateSession to seed the client with a server-fetched session so useSession returns data on the first render.

#9930 0cbaf81 Thanks @gustavovalverde! - Anonymous account linking now works after social and generic OAuth sign-in in Expo and other in-app browsers, where the OAuth callback returns without the session cookie. onLinkAccount fires and the anonymous user is migrated; before, it was silently skipped.

Plugins can now carry server-trusted data across an OAuth redirect with the new addOAuthServerContext API, read back on the callback via getOAuthState().serverContext. Unlike additionalData, it cannot be set from the request body, so it is the right place for values the server must trust.

For @better-auth/oauth-provider, the post-login authorization query now travels through that server-only channel, so it can no longer be injected through additionalData.

#10004 b36c38f Thanks @bytaesu! - The captcha plugin now requires endpoint entries to match full auth paths unless they use wildcard patterns. This prevents requests like /sign-in//email from bypassing captcha while preserving trailing-slash matches like /sign-in/email/. To protect multiple routes, replace partial paths like /sign-in with explicit wildcards such as /sign-in/* or /sign-in/**.

#10746 6782647 Thanks @gustavovalverde! - OAuth device grants now use oauthDeviceAuthorization() alongside oauthProvider() or mcp(). This single integration replaces both the standalone deviceCodeGrant() plugin and the shared-grant configuration. Standalone Device Authorization no longer accepts or stores RFC 8707 resources, and onDeviceAuthRequest receives only clientId and scope. The OAuth integration rejects resource indicators that are not absolute, fragment-free URIs.

The OAuth integration replaces the optional resource column with oauthClientId and resources. Regenerate and apply the schema when using it. Before upgrading from an earlier 1.7 prerelease, let pending OAuth device codes expire or delete them because they cannot be exchanged through the new integration.

#10402 763a267 Thanks @gustavovalverde! - Plugin database schemas can now define named or generated table-level indexes across multiple fields. SQL migrations and generated Drizzle or Prisma schemas resolve configured table and column names consistently, while the MongoDB adapter creates the same indexes before the first index-enforcing write.

#9766 bf39cbf Thanks @GautamBytes! - Add a server-only auth.api.consumePhoneNumberOTP API for custom phone OTP flows that need to verify and consume a code without creating or updating users or sessions.

#10330 081d3c3 Thanks @ping-maxwell! - Allow the username plugin's separate displayUsername field to be omitted by setting displayUsername: false on both the server and client plugins.

#10059 49b5cf6 Thanks @GautamBytes! - Device Authorization now creates unique database indexes for deviceCode and userCode, so each generated code must be unique in its column. Existing installations on every adapter must resolve duplicate values before applying the migration. MySQL and SQL Server installations must also convert both columns to bounded strings and clean up values longer than 191 characters before running it.

... (truncated)

Commits

2344536 chore: release v1.7.1 (#10864)
845bbd1 fix(db): refuse adding required no-default columns to populated tables (#10863)
ccd57c2 docs(changelog): align v1.7 release notes with final behavior (#10846)
f577ec5 chore: exit pre-release mode for v1.7.0
69258d1 chore: sync main to next
e84ec5e chore: release v1.6.30 (#10840)
bc93b27 chore: release v1.7.0-rc.6 (#10772)
58c49eb chore: release v1.6.29 (Cursor Bugbot for commit ece1218. Bugbot is set up for automated code reviews on this repo. Configure here.

…with 37 updates Bumps the minor-and-patch group with 37 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.10` | `4.1.11` | | [esbuild](https://github.com/evanw/esbuild) | `0.28.1` | `0.28.2` | | [turbo](https://github.com/vercel/turborepo) | `2.10.5` | `2.10.11` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.10` | `4.1.11` | | [@hono/node-server](https://github.com/honojs/node-server) | `2.0.10` | `2.1.1` | | [@langchain/core](https://github.com/langchain-ai/langchainjs) | `1.2.3` | `1.2.9` | | [@langchain/openai](https://github.com/langchain-ai/langchainjs) | `1.5.5` | `1.5.10` | | [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.6.23` | `1.7.1` | | [deepagents](https://github.com/langchain-ai/deepagentsjs) | `1.11.1` | `1.13.0` | | [hono](https://github.com/honojs/hono) | `4.12.31` | `4.13.3` | | [mongoose](https://github.com/Automattic/mongoose) | `9.7.4` | `9.9.3` | | [tsx](https://github.com/privatenumber/tsx) | `4.23.1` | `4.23.12` | | [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight) | `0.41.3` | `0.41.7` | | [@playwright/test](https://github.com/microsoft/playwright) | `1.61.1` | `1.62.1` | | [@dagrejs/dagre](https://github.com/dagrejs/dagre) | `3.0.0` | `3.1.1` | | [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.101.2` | `5.101.4` | | [@tanstack/react-router](https://github.com/TanStack/router/tree/HEAD/packages/react-router) | `1.170.18` | `1.170.31` | | [@xyflow/react](https://github.com/xyflow/xyflow/tree/HEAD/packages/react) | `12.11.2` | `12.11.3` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.25.0` | `1.33.0` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.17` | `19.2.18` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.3` | `19.2.4` | | [recharts](https://github.com/recharts/recharts) | `3.9.2` | `3.10.1` | | [sonner](https://github.com/emilkowalski/sonner) | `2.0.7` | `2.0.8` | | [@tanstack/router-plugin](https://github.com/TanStack/router/tree/HEAD/packages/router-plugin) | `1.168.23` | `1.168.34` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.3` | `6.1.0` | | [postcss](https://github.com/postcss/postcss) | `8.5.20` | `8.5.26` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.1.5` | `8.2.2` | | [@langchain/anthropic](https://github.com/langchain-ai/langchainjs) | `1.5.1` | `1.5.8` | | [isomorphic-git](https://github.com/isomorphic-git/isomorphic-git) | `1.38.9` | `1.41.7` | | [langchain](https://github.com/langchain-ai/langchainjs) | `1.5.3` | `1.5.10` | | [@radix-ui/react-label](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/label) | `2.1.12` | `2.1.15` | | [@radix-ui/react-separator](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/separator) | `1.1.12` | `1.1.15` | | [@radix-ui/react-slot](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/slot) | `1.3.0` | `1.3.3` | | [@radix-ui/react-tooltip](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/tooltip) | `1.2.13` | `1.2.16` | | [radix-ui](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/radix-ui) | `1.6.3` | `1.6.7` | Updates `@vitest/coverage-v8` from 4.1.10 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/coverage-v8) Updates `esbuild` from 0.28.1 to 0.28.2 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md) - [Commits](evanw/esbuild@v0.28.1...v0.28.2) Updates `turbo` from 2.10.5 to 2.10.11 - [Release notes](https://github.com/vercel/turborepo/releases) - [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md) - [Commits](vercel/turborepo@v2.10.5...v2.10.11) Updates `vitest` from 4.1.10 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest) Updates `@hono/node-server` from 2.0.10 to 2.1.1 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v2.0.10...v2.1.1) Updates `@langchain/core` from 1.2.3 to 1.2.9 - [Release notes](https://github.com/langchain-ai/langchainjs/releases) - [Commits](https://github.com/langchain-ai/langchainjs/compare/@langchain/core@1.2.3...@langchain/core@1.2.9) Updates `@langchain/openai` from 1.5.5 to 1.5.10 - [Release notes](https://github.com/langchain-ai/langchainjs/releases) - [Commits](https://github.com/langchain-ai/langchainjs/compare/@langchain/openai@1.5.5...@langchain/openai@1.5.10) Updates `better-auth` from 1.6.23 to 1.7.1 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.1/packages/better-auth) Updates `deepagents` from 1.11.1 to 1.13.0 - [Release notes](https://github.com/langchain-ai/deepagentsjs/releases) - [Commits](https://github.com/langchain-ai/deepagentsjs/compare/deepagents@1.11.1...deepagents@1.13.0) Updates `hono` from 4.12.31 to 4.13.3 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.31...v4.13.3) Updates `mongoose` from 9.7.4 to 9.9.3 - [Release notes](https://github.com/Automattic/mongoose/releases) - [Changelog](https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md) - [Commits](Automattic/mongoose@9.7.4...9.9.3) Updates `tsx` from 4.23.1 to 4.23.12 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.23.1...v4.23.12) Updates `@astrojs/starlight` from 0.41.3 to 0.41.7 - [Release notes](https://github.com/withastro/starlight/releases) - [Changelog](https://github.com/withastro/starlight/blob/main/packages/starlight/CHANGELOG.md) - [Commits](https://github.com/withastro/starlight/commits/@astrojs/starlight@0.41.7/packages/starlight) Updates `@playwright/test` from 1.61.1 to 1.62.1 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.61.1...v1.62.1) Updates `@dagrejs/dagre` from 3.0.0 to 3.1.1 - [Release notes](https://github.com/dagrejs/dagre/releases) - [Changelog](https://github.com/dagrejs/dagre/blob/master/changelog.md) - [Commits](dagrejs/dagre@v3.0.0...v3.1.1) Updates `@tanstack/react-query` from 5.101.2 to 5.101.4 - [Release notes](https://github.com/TanStack/query/releases) - [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md) - [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.101.4/packages/react-query) Updates `@tanstack/react-router` from 1.170.18 to 1.170.31 - [Release notes](https://github.com/TanStack/router/releases) - [Changelog](https://github.com/TanStack/router/blob/main/packages/react-router/CHANGELOG.md) - [Commits](https://github.com/TanStack/router/commits/@tanstack/react-router@1.170.31/packages/react-router) Updates `@xyflow/react` from 12.11.2 to 12.11.3 - [Release notes](https://github.com/xyflow/xyflow/releases) - [Changelog](https://github.com/xyflow/xyflow/blob/main/packages/react/CHANGELOG.md) - [Commits](https://github.com/xyflow/xyflow/commits/@xyflow/react@12.11.3/packages/react) Updates `lucide-react` from 1.25.0 to 1.33.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.33.0/packages/lucide-react) Updates `react` from 19.2.7 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react) Updates `@types/react` from 19.2.17 to 19.2.18 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `react-dom` from 19.2.7 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom) Updates `@types/react-dom` from 19.2.3 to 19.2.4 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `recharts` from 3.9.2 to 3.10.1 - [Release notes](https://github.com/recharts/recharts/releases) - [Changelog](https://github.com/recharts/recharts/blob/main/CHANGELOG.md) - [Commits](recharts/recharts@v3.9.2...v3.10.1) Updates `sonner` from 2.0.7 to 2.0.8 - [Release notes](https://github.com/emilkowalski/sonner/releases) - [Commits](emilkowalski/sonner@v2.0.7...v2.0.8) Updates `@tanstack/router-plugin` from 1.168.23 to 1.168.34 - [Release notes](https://github.com/TanStack/router/releases) - [Changelog](https://github.com/TanStack/router/blob/main/packages/router-plugin/CHANGELOG.md) - [Commits](https://github.com/TanStack/router/commits/@tanstack/router-plugin@1.168.34/packages/router-plugin) Updates `@types/react` from 19.2.17 to 19.2.18 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `@types/react-dom` from 19.2.3 to 19.2.4 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `@vitejs/plugin-react` from 6.0.3 to 6.1.0 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.0/packages/plugin-react) Updates `postcss` from 8.5.20 to 8.5.26 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.20...8.5.26) Updates `vite` from 8.1.5 to 8.2.2 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite) Updates `@langchain/anthropic` from 1.5.1 to 1.5.8 - [Release notes](https://github.com/langchain-ai/langchainjs/releases) - [Commits](https://github.com/langchain-ai/langchainjs/compare/@langchain/anthropic@1.5.1...@langchain/anthropic@1.5.8) Updates `isomorphic-git` from 1.38.9 to 1.41.7 - [Release notes](https://github.com/isomorphic-git/isomorphic-git/releases) - [Commits](isomorphic-git/isomorphic-git@v1.38.9...v1.41.7) Updates `langchain` from 1.5.3 to 1.5.10 - [Release notes](https://github.com/langchain-ai/langchainjs/releases) - [Commits](https://github.com/langchain-ai/langchainjs/compare/langchain@1.5.3...langchain@1.5.10) Updates `@radix-ui/react-label` from 2.1.12 to 2.1.15 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/label/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/label) Updates `@radix-ui/react-separator` from 1.1.12 to 1.1.15 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/separator/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/separator) Updates `@radix-ui/react-slot` from 1.3.0 to 1.3.3 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/slot/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/slot) Updates `@radix-ui/react-tooltip` from 1.2.13 to 1.2.16 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/tooltip/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/tooltip) Updates `radix-ui` from 1.6.3 to 1.6.7 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/radix-ui/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/1.6.7/packages/react/radix-ui) --- updated-dependencies: - dependency-name: "@vitest/coverage-v8" dependency-version: 4.1.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: esbuild dependency-version: 0.28.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: turbo dependency-version: 2.10.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: vitest dependency-version: 4.1.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@hono/node-server" dependency-version: 2.1.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@langchain/core" dependency-version: 1.2.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@langchain/openai" dependency-version: 1.5.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: better-auth dependency-version: 1.7.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: deepagents dependency-version: 1.13.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: hono dependency-version: 4.13.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: mongoose dependency-version: 9.9.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: tsx dependency-version: 4.23.12 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@astrojs/starlight" dependency-version: 0.41.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@playwright/test" dependency-version: 1.62.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@dagrejs/dagre" dependency-version: 3.1.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@tanstack/react-query" dependency-version: 5.101.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@tanstack/react-router" dependency-version: 1.170.31 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@xyflow/react" dependency-version: 12.11.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: lucide-react dependency-version: 1.33.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: react dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@types/react" dependency-version: 19.2.18 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: react-dom dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@types/react-dom" dependency-version: 19.2.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: recharts dependency-version: 3.10.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: sonner dependency-version: 2.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@tanstack/router-plugin" dependency-version: 1.168.34 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@types/react" dependency-version: 19.2.18 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@types/react-dom" dependency-version: 19.2.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@vitejs/plugin-react" dependency-version: 6.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: postcss dependency-version: 8.5.26 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: vite dependency-version: 8.2.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@langchain/anthropic" dependency-version: 1.5.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: isomorphic-git dependency-version: 1.41.7 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: langchain dependency-version: 1.5.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@radix-ui/react-label" dependency-version: 2.1.15 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@radix-ui/react-separator" dependency-version: 1.1.15 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@radix-ui/react-slot" dependency-version: 1.3.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@radix-ui/react-tooltip" dependency-version: 1.2.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: radix-ui dependency-version: 1.6.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-08-24T04:26:05Z

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

cursor

Threat-surface review (PR #92)

Dependabot-only bump: 8 package.json files + pnpm-lock.yaml. No application source, no .env / .env.local, no hardcoded secrets. Surfaces 1–5 are unchanged by this diff; surface 6 is the one that moves.

1. MCP endpoint auth — no change

MCP packages stay at @modelcontextprotocol/server / @modelcontextprotocol/hono 2.0.0-alpha.2 (OSV clean). Bearer lookup, project-slug bind, expiry, and session re-auth still live in apps/api/src/mcp/archmax-route.ts (authenticateRequest before transport.handleRequest; resumed sessions re-check tokenId / projectId / slug). Invalid tokens still return JSON-RPC -32001, not a stack trace. Tool scopes are still enforced in archmax-server.ts / executeScopedQuery.

2. Query execution sandboxing — no change

@duckdb/node-api is not in this group. execute_query still goes through executeScopedQuery with AST validation (rejects INSERT/UPDATE/DELETE/DROP/ALTER/multi-statement), readOnly: true DuckDB attach, VIEW-scoped catalogs, QUERY_TIMEOUT_MS, and MAX_ROWS.

3. Admin auth (Better Auth) — library minor, app controls intact

better-auth 1.6.23 → 1.7.1 (resolved 1.7.1; OSV clean, as are @better-auth/core@1.7.1, @better-auth/mongo-adapter@1.7.1, jose@6.2.9). App-owned controls were not edited:

BETTER_AUTH_SECRET still z.string().min(32) in packages/core/src/config/env.ts
Cookies still httpOnly: true, secure in production, sameSite: "lax" in apps/api/src/lib/auth.ts
CSRF still on /api/* via apps/api/src/middleware/csrf.ts; /api/auth/* remains Better Auth’s trustedOrigins

1.7 tightens a few defaults this app already aligns with: cookie-cache is now bound to the session_token cookie (this repo has cookieCache.enabled); forwarded-host is fail-closed unless trustedProxyHeaders is set (this repo uses a static baseURL, not allowedHosts). Captcha / OAuth / MCP / device-grant breaking changes do not apply — this app is email+password + username() + mongodbAdapter only.

Operational (not a vulnerability): 1.7 scopes account identity by issuer + accountId. Credential-only Mongo installs should smoke-test username/email sign-in after merge; OAuth/SSO backfill does not apply here.

4. API input validation — no change

zod stays ^4.4.3. No Hono handlers, Zod schemas, or Mongo/DuckDB query construction changed.

5. Environment secrets — no change

No secret values added to source or lockfile. .env / .env.* remain gitignored (!.env.example only).

6. Dependency exposure

Security-relevant resolved versions and OSV (querybatch, 2026-08-24):

Package	Base	Head	OSV
`hono`	4.12.31	4.13.3	Base hits GHSA-54fx-42gc-7vw4, GHSA-79qm-7rj5-m7r9, GHSA-8j4g-w8fx-2239 (CVE-2026-69207 CORS ReDoS), GHSA-f23p-vx2j-j53r. 4.13.3 is clean. App already sets non-empty `allowHeaders` in `apps/api/src/middleware/cors.ts`, so the ReDoS path was already mitigated; the bump still removes the vulnerable parser.
`@hono/node-server`	2.0.10	2.1.1	Clean
`better-auth`	1.6.23	1.7.1	Clean
`mongoose`	9.7.4	9.9.3	Clean (CVE-2026-42334 was fixed in 9.1.6)
`deepagents`	1.11.1	1.13.0	Clean. 1.13 adds recursive delete (still goes through `ValidatingFilesystemBackend` + `virtualMode: true`) and caps sandbox glob so root searches cannot OOM.
`isomorphic-git`	1.38.9	1.41.7	Clean (1.38.9 was already past the Aug 2026 fixes)
`vite`	8.1.5	8.2.2	Clean
MCP server/hono	2.0.0-alpha.2	unchanged	Clean (CVE-2026-25536 is legacy `@modelcontextprotocol/sdk` v1.x only)

pnpm audit is 24 vulnerabilities (2 low / 4 moderate / 18 high) — the same pre-existing set, not introduced here:

packages/core → markitdown-ts@0.0.10 → xlsx@0.18.5 / @xmldom/xmldom
direct js-yaml@^4.1.1 (lockfile also has unused 4.3.1; GHSA-52cp-r559-cp3m / GHSA-h67p-54hq-rp68 need >=4.3.0)
ws@8.20.0 (needs >=8.20.1; langsmith/openai peer + jsdom→vitest)
apps/docs astro@^6.4.8 XSS advisories (fix is major >=7.x)

Verdict: No threat-surface defect in this diff. The hono bump is a security fix. The better-auth 1.6→1.7 jump is the highest-risk library change and is OSV-clean with app cookie/CSRF/secret controls still explicit; smoke-test admin login after merge.

_{Sent by Cursor Automation: archmax Security Review}

cursor

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit ece1218. Configure here.}

cursor · 2026-08-24T04:31:20Z

    "@modelcontextprotocol/server": "2.0.0-alpha.2",
-    "better-auth": "^1.6.23",
-    "deepagents": "^1.11.1",
+    "better-auth": "^1.7.1",


Auth upgrade missing issuer migration

High Severity

Bumping better-auth from 1.6.x to 1.7.1 requires a manual Account.issuer backfill (local:credential for email/password rows) before identity lookups use the new (issuer, accountId) key. This PR only changes the package version—no MongoDB backfill or migration is added—so existing credential accounts can fail sign-in after deploy, including the seeded admin path with disableSignUp: true.

Additional Locations (1)

apps/frontend/package.json#L18-L19

^{Reviewed by Cursor Bugbot for commit ece1218. Configure here.}

cursor · 2026-08-24T04:31:20Z

+    "@langchain/openai": "^1.5.10",
    "bullmq": "^5.80.9",
-    "deepagents": "^1.11.1",
+    "deepagents": "^1.13.0",


Agent todos silently dropped

Medium Severity

Bumping deepagents from 1.11.x to 1.13.0 makes todoListMiddleware opt-in, so write_todos is no longer installed by default. createDeepAgent callers only register createToolErrorRecoveryMiddleware(), and the chat UI still has dedicated write_todos rendering, so agents lose planning todos without any compensating opt-in.

Additional Locations (1)

apps/api/package.json#L27-L28

^{Reviewed by Cursor Bugbot for commit ece1218. Configure here.}

cursor Bot reviewed Aug 24, 2026

View reviewed changes

Navigation Menu

Uh oh!

chore(deps)(deps): bump the minor-and-patch group across 1 directory with 37 updates - #92

chore(deps)(deps): bump the minor-and-patch group across 1 directory with 37 updates#92
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-d0441c55b9

dependabot Bot commented on behalf of github Aug 24, 2026 •

edited by cursor Bot

Loading

Uh oh!

dependabot Bot commented on behalf of github Aug 24, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Aug 24, 2026

Uh oh!

cursor Bot Aug 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 24, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v4.1.11

🐞 Bug Fixes

View changes on GitHub

v0.28.2

0.28.2

Turborepo v2.10.11

What's Changed

Changelog

Turborepo v2.10.11-canary.4

What's Changed

Changelog

Turborepo v2.10.11-canary.3

What's Changed

Changelog

Turborepo v2.10.11-canary.2

v4.1.11

🐞 Bug Fixes

View changes on GitHub

v2.1.1

What's Changed

v2.1.0

What's Changed

New Contributors

v2.0.12

What's Changed

v2.0.11

What's Changed

@​langchain/core@​1.2.9

Patch Changes

@​langchain/core@​1.2.8

Patch Changes

@​langchain/core@​1.2.7

Patch Changes

@​langchain/core@​1.2.6

Patch Changes

@​langchain/core@​1.2.5

Patch Changes

@​langchain/core@​1.2.4

Patch Changes

@​langchain/openai@​1.5.10

Patch Changes

@​langchain/openai@​1.5.9

Patch Changes

@​langchain/openai@​1.5.8

Patch Changes

@​langchain/openai@​1.5.7

Patch Changes

@​langchain/openai@​1.5.6

Patch Changes

v1.7.1

better-auth

Bug Fixes

@better-auth/scim

Bug Fixes

@better-auth/sso

Bug Fixes

@better-auth/cimd

Bug Fixes

@better-auth/kysely-adapter

Bug Fixes

@better-auth/oauth-provider

Bug Fixes

1.7.1

Patch Changes

1.7.0

Minor Changes

Uh oh!

dependabot Bot commented on behalf of github Aug 24, 2026

Labels

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Threat-surface review (PR #92)

1. MCP endpoint auth — no change

2. Query execution sandboxing — no change

3. Admin auth (Better Auth) — library minor, app controls intact

dependabot Bot commented on behalf of github Aug 24, 2026 •

edited by cursor Bot

Loading

`@langchain/core@1`.2.9

`@langchain/core@1`.2.8

`@langchain/core@1`.2.7

`@langchain/core@1`.2.6

`@langchain/core@1`.2.5

`@langchain/core@1`.2.4

`@langchain/openai@1`.5.10

`@langchain/openai@1`.5.9

`@langchain/openai@1`.5.8

`@langchain/openai@1`.5.7

`@langchain/openai@1`.5.6

`better-auth`

`@better-auth/scim`

`@better-auth/sso`

`@better-auth/cimd`

`@better-auth/kysely-adapter`

`@better-auth/oauth-provider`