chore(deps): bump the npm-deps group across 1 directory with 9 updates by dependabot[bot] · Pull Request #74 · codebar/auth

dependabot · 2026-09-17T10:15:06Z

Bumps the npm-deps group with 9 updates in the / directory:

Package	From	To
@better-auth/oauth-provider	`1.6.27`	`1.7.3`
better-auth	`1.6.27`	`1.7.3`
hono	`4.13.5`	`4.13.7`
@playwright/test	`1.62.1`	`1.63.0`
eslint	`10.8.1`	`10.10.0`
fallow	`3.22.0`	`3.24.1`
globals	`17.11.0`	`17.12.0`
lint-staged	`17.3.0`	`17.5.0`
tap	`21.7.5`	`21.8.0`

Updates @better-auth/oauth-provider from 1.6.27 to 1.7.3

Release notes

Sourced from @better-auth/oauth-provider's releases.

v1.7.3

Upgrading from 1.7.0–1.7.2:

We restored the 1.6 account core schema to avoid requiring a disruptive backfill for existing users. We recognize the cost to users who already migrated and are committed to keeping the core schema stable throughout v1.

If you applied the 1.7 issuer schema, follow the upgrade guide for the required cleanup. No backfill is needed.

better-auth

Features

Added Cloudflare as a built-in social provider with client-secret and PKCE support. (#9908)

Enabled schema validation during initialization by default, including in production, and rejected authentication requests on detected mismatches. (#11178)

Added isPasswordCompromised for checking passwords against Have I Been Pwned in custom server-side flows. (#11147)

Bug Fixes

Aligned generated OpenAPI required fields with runtime validation. (#11066)

Handled malformed custom-scheme callback URLs without excessive processing. (#11060)

Improved Auth0 domain normalization to avoid slow trailing-slash processing. (#11188)

Prevented generic OAuth discovery failures from taking down the authentication API. (#10978)

Tracked email OTP sign-ins in the last login method plugin. (#10963)

Fixed callback hooks being skipped after proxied OAuth sign-ins and preserved server state when callback cookies are unavailable. The legacy /oauth-proxy-callback endpoint is deprecated and will be removed in the next minor release. (#10988)

Fixed getSession failures when cookie caching is disabled and cached session cookies remain. (#11120)

Fixed TOTP re-enrollment replacing an active authenticator and its backup codes. (#11037)

Prevented duplicate session requests and hydration mismatches in Nuxt useFetch. (#11084)

Improved dynamic organization role permission check performance. (#11069)

Added type-safe Nuxt useFetch integration for the Vue client's useSession hook. (#11085)

Restored compatibility with 1.6 account schemas by identifying accounts with (providerId, accountId) instead of issuer. (#11153)

For detailed changes, see CHANGELOG

@better-auth/core

Features

Added Cloudflare as a built-in social provider with client-secret and PKCE support. (#9908)

Added initialization-time schema validation and actionable mismatch guidance for Drizzle and Prisma adapters. (#11179)

Enabled schema validation during initialization by default, including in production, and rejected authentication requests on detected mismatches. (#11178)

Added custom token endpoint authentication strategies for providers with non-standard request parameters. (#11101)

Bug Fixes

Restored optional consumeOne and incrementOne methods for custom database adapters. (#11189)

Fixed TikTok sign-in and token refresh with the documented clientKey and clientSecret options. (#11102)

Improved request IP validation performance. (#11068)

Improved PayPal authorization code and refresh token requests, including PKCE handling. (#11129)

Improved Reddit token requests with OAuth-compliant Basic authentication and redirect protection. (#11134)

Restored compatibility with 1.6 account schemas by identifying accounts with (providerId, accountId) instead of issuer. (#11153)

... (truncated)

Changelog

Sourced from @better-auth/oauth-provider's changelog.

1.7.3

Patch Changes

#11090 4d09d50 Thanks @Salman-Arshad! - Allow native OAuth clients with localhost loopback redirect URIs to use ephemeral callback ports, and ensure loopback port variance changes only the port.

1.7.2

Patch Changes

#11010 bb8d7c4 Thanks @bytaesu! - Client ID Metadata Document clients that declare a grant the server does not offer (such as Claude's enterprise jwt-bearer grant) can now register. Only documents sharing no grant with the server are refused.

#10979 fced1a5 Thanks @bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.

1.7.1

1.7.0

Minor Changes

#10577 5c45abc Thanks @gustavovalverde! - OAuth clients now store applicationType and expose it as application_type in OAuth metadata. tokenEndpointAuthMethod alone determines authentication: "none" is public, and every other method is confidential. The legacy type and public fields are removed.

OAuthClient no longer has a catch-all string index. Model custom wire extensions explicitly with a named intersection such as OAuthClient & YourExtensionMetadata; legacy type and public fields no longer type-check as unknown baggage.

Dynamic, administrative, and user-managed registrations default an omitted application_type to web. Client ID Metadata Documents preserve an omitted value as null.

Web redirects require HTTPS on a non-loopback host. Native redirects accept claimed HTTPS URLs, exact HTTP loopback hosts, or reverse-domain private-use schemes.

Registration resource options control resource links. mcp() contributes its protected resource by default, so standards-based clients no longer need a resources extension.

mcp() no longer enables unauthenticated Dynamic Client Registration. Compose mcp() with cimd() for Client ID Metadata Documents, or enable both DCR flags explicitly.

This release requires a database migration. Add applicationType and nullable clientDiscoveryId; map old web and native values directly, map user-agent-based to NULL for manual reclassification, and never derive it from public. Set clientDiscoveryId only from known discovery provenance, never by inspecting an HTTPS client ID. Deduplicate existing (clientId, resourceId) links before adding the new compound unique index, then drop the legacy columns. Deployments with custom schema mappings must apply this backfill manually.

Machine-to-machine scope authority is now stored separately in nullable oauthClient.clientCredentialsScopes. Missing, NULL, and empty values deny client_credentials token issuance. Only the administrative create and update endpoints expose client_credentials_scopes, and assigning a non-empty value requires clientPrivileges to approve the new configure-client-credentials-scopes action. DCR, CIMD, and user-managed registration cannot assign this field; CIMD refresh preserves an existing administrator-owned value. Remove clientCredentialGrantDefaultScopes, backfill every existing client to [], configure [] as the default for new rows, then explicitly assign every approved machine scope after auditing the client.

#10577 5c45abc Thanks @gustavovalverde! - Client ID Metadata Documents now follow shared-cache freshness rules and fail closed when freshness is ambiguous. The plugin prefers s-maxage over max-age and Expires, honors s-maxage=0, conditionally revalidates with ETag or Last-Modified, and treats invalid or duplicate freshness directives as immediately stale. Concurrent refreshes converge on one client-resource link instead of failing on its unique constraint.

Shared OAuth metadata validation now rejects a blank client_name without trimming a valid display name. Native private-use redirects require the RFC 8252 single-slash form, such as com.example.app:/callback. Native HTTP redirects accept only exact localhost, 127.0.0.1, or [::1] hosts; other 127.0.0.0/8 addresses and localhost subdomains are rejected.

CIMD now bounds metadata request amplification through metadataFetchPolicy: same-client fetches coalesce, per-client pacing and global/per-origin concurrency reject immediately, and rolling 60-second budgets cap unique-client sprays. HTTP no-store, private, and Vary: * behavior is unchanged and never feeds metadata or validators into the governor.

Node.js deployments can import fetchClientMetadataResource from @better-auth/cimd/node. The transport resolves once, rejects any non-public DNS answer, pins the approved connection without using the global HTTPS pool, preserves Host and TLS certificate identity, and returns redirects and response bodies without buffering. Other runtimes remain responsible for providing an equivalent secure transport.

Unknown draft-02 metadata members are now ignored and never persisted. Recognized secrets, privilege fields, and server controls remain fatal, while generic internal aliases and nonstandard client-credentials authority spellings are stripped.

#9159 cd8313b Thanks @gustavovalverde! - Add @better-auth/cimd for Client ID Metadata Document draft-02. An exact HTTPS metadata-document URL becomes the OAuth client_id, and OAuth discovery advertises support when the plugin is installed. The explicit metadataProfile: "mcp-2026-07-28" mode applies the draft-00 metadata requirements pinned by MCP 2026-07-28.

Validate the complete shared OAuth client metadata schema. Generic draft-02 clients may omit client_name and redirect_uris and may use any grant supported by the OAuth Provider; the MCP profile requires client_id, client_name, and redirect_uris.

Reject client secrets, private JWK material, back-channel logout metadata, server-owned fields, unsafe metadata URLs, non-JSON responses, oversized documents, redirects, and private or reserved network targets. Loopback Client Identifier URLs are no longer supported.

Validate registered, discovered, and remotely fetched client JWKS through one public-asymmetric-key boundary. RFC 7517 JWK Sets must use { "keys": [...] }; replace the removed bare-array form jwks: [key] with jwks: { keys: [key] }. Empty, malformed, symmetric, private, and unsupported key sets fail before they can enter a provider-scoped cache. EC keys must use P-256, P-384, or P-521; OKP keys must use Ed25519. A declared alg must match the key type and curve. Existing OAuth client rows written through oauthToSchema are already normalized, so no database rewrite is required unless rows were written outside Better Auth.

Require fetchClientMetadataResource as the deployment-owned transport for both metadata documents and discovery-owned jwks_uri resources. It must resolve once, reject RFC 6890 special-use addresses, pin the approved address for the connection, and refuse redirects. isMetadataDocumentUrlAllowed remains available for additional application policy.

Cache only valid successful metadata with bounded storage, HTTP shared-cache freshness rules, ETag and Last-Modified conditional revalidation, and fail-closed refresh behavior. Cache-Control: private and Vary: * are noncacheable, and an unconditional 304 is rejected.

Persist oauthClient.clientDiscoveryId as nullable discovery provenance. Discovery IDs are globally unique, and an owned client fails closed when its matching discovery is unavailable. Only that discovery may refresh the client or provide transport for its metadata-owned resources, so managed and DCR HTTPS client IDs cannot be taken over.

Preserve custom model names, resource links, and administrator-controlled client flags when clients are created or refreshed. Refresh notifications now receive previousClient.

... (truncated)

Commits

597d39c chore: release v1.7.3 (#11032)
2220ee7 revert: drop the issuer column and resolve accounts by provider id (#11153)
4d09d50 fix(oauth-provider): extend RFC 8252 loopback port variance to localhost (#11...
c0444dc fix: align OpenAPI required fields with Zod 4.5 (#11066)
ba12fcd chore: release v1.7.2 (#10870)
bb8d7c4 fix(oauth-provider): backport CIMD grant intersection (#11010)
79904f0 fix(origin-check): support fragments in relative redirect URLs (#10983)
2344536 chore: release v1.7.1 (#10864)
ccd57c2 docs(changelog): align v1.7 release notes with final behavior (#10846)
f577ec5 chore: exit pre-release mode for v1.7.0
Additional commits viewable in compare view

Updates better-auth from 1.6.27 to 1.7.3

Release notes

Sourced from better-auth's releases.

v1.7.3

Upgrading from 1.7.0–1.7.2:

We restored the 1.6 account core schema to avoid requiring a disruptive backfill for existing users. We recognize the cost to users who already migrated and are committed to keeping the core schema stable throughout v1.

If you applied the 1.7 issuer schema, follow the upgrade guide for the required cleanup. No backfill is needed.

better-auth

Features

Added Cloudflare as a built-in social provider with client-secret and PKCE support. (#9908)

Enabled schema validation during initialization by default, including in production, and rejected authentication requests on detected mismatches. (#11178)

Added isPasswordCompromised for checking passwords against Have I Been Pwned in custom server-side flows. (#11147)

Bug Fixes

Aligned generated OpenAPI required fields with runtime validation. (#11066)

Handled malformed custom-scheme callback URLs without excessive processing. (#11060)

Improved Auth0 domain normalization to avoid slow trailing-slash processing. (#11188)

Prevented generic OAuth discovery failures from taking down the authentication API. (#10978)

Tracked email OTP sign-ins in the last login method plugin. (#10963)

Fixed callback hooks being skipped after proxied OAuth sign-ins and preserved server state when callback cookies are unavailable. The legacy /oauth-proxy-callback endpoint is deprecated and will be removed in the next minor release. (#10988)

Fixed getSession failures when cookie caching is disabled and cached session cookies remain. (#11120)

Fixed TOTP re-enrollment replacing an active authenticator and its backup codes. (#11037)

Prevented duplicate session requests and hydration mismatches in Nuxt useFetch. (#11084)

Improved dynamic organization role permission check performance. (#11069)

Added type-safe Nuxt useFetch integration for the Vue client's useSession hook. (#11085)

Restored compatibility with 1.6 account schemas by identifying accounts with (providerId, accountId) instead of issuer. (#11153)

For detailed changes, see CHANGELOG

@better-auth/core

Features

Added Cloudflare as a built-in social provider with client-secret and PKCE support. (#9908)

Added initialization-time schema validation and actionable mismatch guidance for Drizzle and Prisma adapters. (#11179)

Enabled schema validation during initialization by default, including in production, and rejected authentication requests on detected mismatches. (#11178)

Added custom token endpoint authentication strategies for providers with non-standard request parameters. (#11101)

Bug Fixes

Restored optional consumeOne and incrementOne methods for custom database adapters. (#11189)

Fixed TikTok sign-in and token refresh with the documented clientKey and clientSecret options. (#11102)

Improved request IP validation performance. (#11068)

Improved PayPal authorization code and refresh token requests, including PKCE handling. (#11129)

Improved Reddit token requests with OAuth-compliant Basic authentication and redirect protection. (#11134)

Restored compatibility with 1.6 account schemas by identifying accounts with (providerId, accountId) instead of issuer. (#11153)

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.3

Patch Changes

#11060 3660f06 Thanks @bytaesu! - Handle malformed custom-scheme callback URLs without excessive processing.

#11037 5bd7096 Thanks @bytaesu! - Prevent repeated TOTP enrollment from replacing an active authenticator and its backup codes.

#11120 7ec7146 Thanks @onmax! - Prevent getSession from failing when cookie caching is disabled while clients still have cached session cookies.

#9908 76d311f Thanks @harshil1712! - Add Cloudflare as a built-in social provider, with support for client-secret authentication and PKCE clients without a secret.

#11188 c47b765 Thanks @bytaesu! - Normalize Auth0 domains without a potentially slow trailing-slash regular expression.

#11084 2d5c63d Thanks @bytaesu! - Prevent duplicate session requests and hydration mismatches when using the Vue client with Nuxt useFetch.

#11147 a9d8c12 Thanks @bytaesu! - Add isPasswordCompromised for checking passwords against Have I Been Pwned in custom server-side flows, while ignoring padded response entries with zero occurrences.

#10988 9fc7498 Thanks @bytaesu! - Run callback hooks after proxied OAuth sign-ins and preserve server state when callback cookies are unavailable. The legacy /oauth-proxy-callback endpoint is deprecated and will be removed in the next minor release.

#11178 be0e007 Thanks @bytaesu! - Report missing tables, missing columns, and required columns Better Auth never writes during initialization, with guidance for fixing them. Kysely checks the live database schema. Authentication requests await the same check and are rejected if the schema does not match.

Validation is enabled by default, including in production. Set advanced.database.validateSchema: false to disable runtime validation. auth migrate refuses to apply changes when required unwritten columns need manual repair.

#11069 0bb0dbf Thanks @bytaesu! - Improve dynamic organization role permission check performance.

#11153 2220ee7 Thanks @bytaesu! - Restore sign-in compatibility with 1.6 databases by identifying accounts with (providerId, accountId) and removing the issuer requirement introduced in 1.7.0. Upgrading from 1.6 no longer requires an account schema migration. Ambiguous account keys are rejected instead of selecting an arbitrary account.

If you applied the 1.7.0 through 1.7.2 account schema, remove its issuer unique index before upgrading. For SQL databases, also make issuer nullable or remove the column so sign-ups and account linking can succeed. auth migrate does not perform this cleanup. Follow the upgrade guide for database-specific steps.

#10978 5fe5bc2 Thanks @BetterAndBetterII! - Skip a generic OAuth provider when discovery fails instead of taking down the rest of the auth API.

#10963 74a7369 Thanks @thisismert! - Track email OTP sign-ins in the last login method plugin.

#11085 e16b40a Thanks @bytaesu! - Provide type-safe Nuxt useFetch integration for the Vue client's useSession hook.

#11066 c0444dc Thanks @bytaesu! - Upgrade the packaged Zod dependency to 4.5. Generated OpenAPI schemas now mark required request fields consistently with runtime validation, including passkey registration responses.

Updated dependencies [352d012, 76d311f, 3e9e197, 157ec8d, baa08f4, 9e36635, be0e007, a2bae0c, 1a1b7d5, 2220ee7]:

@better-auth/core@1.7.3

@better-auth/drizzle-adapter@1.7.3

@better-auth/prisma-adapter@1.7.3

@better-auth/kysely-adapter@1.7.3

@better-auth/memory-adapter@1.7.3

@better-auth/mongo-adapter@1.7.3

@better-auth/telemetry@1.7.3

1.7.2

Patch Changes

... (truncated)

Commits

597d39c chore: release v1.7.3 (#11032)
1a1b7d5 fix(core): restore optional atomic adapter methods (#11189)
76d311f feat: add Cloudflare social provider (#9908)
7ec7146 fix(session): skip cache cookie when disabled (#11120)
c47b765 fix(generic-oauth): harden Auth0 domain normalization (#11188)
be0e007 feat(db): check the database schema on initialization (#11178)
2220ee7 revert: drop the issuer column and resolve accounts by provider id (#11153)
5fe5bc2 fix(generic-oauth): skip providers whose discovery fails (#10978)
a9d8c12 feat(haveibeenpwned): expose password compromise check (#11147)
74a7369 fix(last-login-method): handle email otp logins (#10963)
Additional commits viewable in compare view

Updates hono from 4.13.5 to 4.13.7

Release notes

Sourced from hono's releases.

v4.13.7

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

What's Changed

fix(client): keep a param value of "index" in $url() and $path() in honojs/hono#5297

fix(client): normalize root WebSocket URLs in honojs/hono#5291

fix(types): allow symbol keys in Context get and set fallbacks in honojs/hono#5300

chore: bump editorconfig-checker in honojs/hono#5336

refactor(on-handler): use forEach for consistent handler iteration in honojs/hono#5326

Full Changelog: honojs/hono@v4.13.5...v4.13.6

Commits

eebdf7b 4.13.7
2b8ed40 Merge commit from fork
cac0c4d 4.13.6
dac5d57 refactor(on-handler): use forEach for consistent handler iteration (#5326)
ec648d6 chore: bump editorconfig-checker (#5336)
e2740d5 fix(types): allow symbol keys in Context<any> get and set fallbacks (#5300)
499c35e fix(client): normalize root WebSocket URLs (#5291)
50b8788 fix(client): keep a param value of "index" in $url() and $path() (#5297)
See full diff in compare view

Updates @playwright/test from 1.62.1 to 1.63.0

Release notes

Sourced from @playwright/test's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:
test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});
A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:
// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();
The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:
await page.locator('button').visible().click();
🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:
await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });
Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits

1b025d7 chore: mark v1.63.0 (#42569)
0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
13dbf10 cherry-pick(#42552): docs: release notes for v1.63
e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
2b7a5f2 test: response.body() for content-encoding:identity (#42537)
648a67c fix(mcp): create parent directories for explicitly named files (#42540)
7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
52900a1 devops: restore npm publishing from GitHub Actions (#42550)
8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
Additional commits viewable in compare view

Updates eslint from 10.8.1 to 10.10.0

Release notes

Sourced from eslint's releases.

v10.10.0

Features

264b434 feat: add d and v flags to no-unexpected-multiline (#21305) (Gihyeon Jeong / 정기현)

c6cc6c5 feat: check Object.prototype property names in new-cap (#21269) (crimsonjay0)

5661fa6 feat: no-extra-bind false negatives with class fields and static blocks (#21260) (synthex-byte)

Bug Fixes

bb47dc6 fix: update dependency file-entry-cache to v11 (#20801) (Milos Djermanovic)

427ac0a fix: use format strings in debug calls (#21247) (Francesco Trotta)

9d81532 fix: support __proto__ in /* exported */ comments (#21261) (sethamus)

87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282) (김채영)

8e2cb14 fix: new-cap false positive for UTC calls with properties: false (#21275) (Pixel)

9f4a364 fix: Ignore static imports in no-unreachable (#21276) (Taha Kotil)

Documentation

2417cad docs: Update README (GitHub Actions Bot)

9cecb8a docs: document \c control letter escapes in no-control-regex (#21286) (한국)

8724829 docs: update compat table links (#21263) (fnx)

5634542 docs: Clarify eqeqeq suggestion behavior (#21256) (Müslüm Yılmaz)

Chores

b3d876b chore: disable npm audit in ecosystem tests (#21306) (Francesco Trotta)

1696682 ci: restore EMFILE test on Node.js 26 (#21297) (Marry (Subin Yang))

2c7f5d6 chore: update github/codeql-action action to v4.37.9 (#21296) (renovate[bot])

3c753f1 chore: update eslint (#21289) (renovate[bot])

1c73469 chore: update ecosystem plugins (#21280) (ESLint Bot)

08a02be test: add error locations to no-extra-boolean-cast (#21266) (lumir)

77bb1db chore: update github/codeql-action action to v4.37.8 (#21270) (renovate[bot])

007e81a ci: skip EMFILE test on Node.js 26 (#21265) (lumir)

0430280 chore: improve ecosystem tests compatibility on Windows (#21178) (crimsonjay0)

v10.9.1

Bug Fixes

1e641c9 fix: no-loss-of-precision false positive with trailing decimal point (#21251) (Aleksandr Shoronov)

Documentation

ad74a8d docs: add deprecation steps for EOL package versions (#21248) (Francesco Trotta)

Chores

3c3ae53 chore: update ecosystem plugins (#21249) (ESLint Bot)

v10.9.0

Features

08de88e feat: handle underflow in no-loss-of-precision (#21218) (Rithish S)

55db479 feat: add checkConditionalExpressions to no-unmodified-loop-condition (#21175) (sethamus)

Bug Fixes

2ba3025 fix: prevent unsafe no-var autofix with hoisted functions (#21213) (sethamus)

8e69622 fix: Prevent no-var autofix when var is shadowed by catch parameter (#21204) (Yang Hyeonjong)

684b579 fix: prefer-template invalid autofix creates a tagged template call (#21207) (김채영)

... (truncated)

Commits

3f20a57 10.10.0
f4e5284 Build: changelog update for 10.10.0
bb47dc6 fix: update dependency file-entry-cache to v11 (#20801)
427ac0a fix: use format strings in debug calls (#21247)
b3d876b chore: disable npm audit in ecosystem tests (#21306)
9d81532 fix: support __proto__ in /* exported */ comments (#21261)
264b434 feat: add d and v flags to no-unexpected-multiline (#21305)
1696682 ci: restore EMFILE test on Node.js 26 (#21297)
2c7f5d6 chore: update github/codeql-action action to v4.37.9 (#21296)
87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282)
Additional commits viewable in compare view

Updates fallow from 3.22.0 to 3.24.1

Release notes

Sourced from fallow's releases.

v3.24.1: --production stops calling a test-only export safe to delete

A single-fix patch release for #2594.

--production stops calling a test-only export safe to delete

fallow coverage analyze --production drops test, spec, story, and fixture files from discovery. An export whose only callers live in those files therefore read as statically unused, and combined with zero production invocations it satisfied the safe_to_delete rule. Following that verdict broke the test suite.

The run now keeps a second, unfiltered reachability answer alongside the filtered one and reports it as evidence.test_only_reference. A function that is unreachable in the production graph but still referenced from an excluded file is downgraded to review_required and carries the action "Only tests reference this export; delete the test usage together with the function or keep it". An export that nothing references at all is unaffected and stays deletable.

The new evidence bit is emitted in the JSON, human, and GitHub review output. It is omitted where no production filter was applied, since there is no second answer to report.

Full Changelog: fallow-rs/fallow@v3.24.0...v3.24.1

v3.24.0: Findings that say when the run behind them was incomplete

This release is about output honesty: a number that is a floor should not be presented as a total, a zero that means "not measured" should say so, and a mutation resting on an incomplete picture should not be one click away.

Findings say when the run behind them was incomplete

A file that fails to parse, one the size guard skipped, one that could not be read: each of those silently yields zero imports, which can make a live export read as dead. Nine dead-code arrays now carry an optional reachability_caveats[] naming exactly that, so a reader who never scrolls back to the diagnostics list still sees it. fallow fix refuses to apply a mutation under a caveat (skip_reason: "low_confidence_incomplete_analysis"), the actions contract reports auto_fixable: false with the reason in its note, and the review formats withhold the one-click ```suggestion block rather than hedging in prose above it. Findings themselves are never withheld, filtered, reordered, or re-severitied, and no exit code changes. A run that read every file it discovered is byte-identical.

New commands

fallow trace --path <FROM> <TO> walks the import graph and returns the shortest chain between two modules, with type-only hops reported rather than skipped. Also over MCP as trace_import_path.

fallow trace-error [FILE|-] resolves a runtime stack trace against the project graph. It refuses to overclaim: a frame matching several definitions is ambiguous, one matching none stays not_found. Also over MCP as trace_error.

fallow doctor gains three advisory checks for installed dependencies and cache reuse.

The MCP server gains get_cloud_runtime_context, which reads a repository's runtime facts from fallow cloud and returns the same runtime_coverage block the local tools return. The key comes from FALLOW_API_KEY in the server environment and is never a call argument. This is the only fallow MCP tool that makes a network call.

Reproducible churn

Recency weighting, ownership staleness, and the churn window read the system clock at three separate points, so numbers drifted between runs over the same commit. All three now resolve one instant from HEAD's committer timestamp, FALLOW_CLOCK_EPOCH pins it explicitly, and hotspot_summaryDescription has been truncated

Bumps the npm-deps group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@better-auth/oauth-provider](https://github.com/better-auth/better-auth/tree/HEAD/packages/oauth-provider) | `1.6.27` | `1.7.3` | | [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.6.27` | `1.7.3` | | [hono](https://github.com/honojs/hono) | `4.13.5` | `4.13.7` | | [@playwright/test](https://github.com/microsoft/playwright) | `1.62.1` | `1.63.0` | | [eslint](https://github.com/eslint/eslint) | `10.8.1` | `10.10.0` | | [fallow](https://github.com/fallow-rs/fallow) | `3.22.0` | `3.24.1` | | [globals](https://github.com/sindresorhus/globals) | `17.11.0` | `17.12.0` | | [lint-staged](https://github.com/lint-staged/lint-staged) | `17.3.0` | `17.5.0` | | [tap](https://github.com/tapjs/tapjs) | `21.7.5` | `21.8.0` | Updates `@better-auth/oauth-provider` from 1.6.27 to 1.7.3 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/oauth-provider/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.3/packages/oauth-provider) Updates `better-auth` from 1.6.27 to 1.7.3 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.3/packages/better-auth) Updates `hono` from 4.13.5 to 4.13.7 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.13.5...v4.13.7) Updates `@playwright/test` from 1.62.1 to 1.63.0 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.62.1...v1.63.0) Updates `eslint` from 10.8.1 to 10.10.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.8.1...v10.10.0) Updates `fallow` from 3.22.0 to 3.24.1 - [Release notes](https://github.com/fallow-rs/fallow/releases) - [Changelog](https://github.com/fallow-rs/fallow/blob/main/release.toml) - [Commits](fallow-rs/fallow@v3.22.0...v3.24.1) Updates `globals` from 17.11.0 to 17.12.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](sindresorhus/globals@v17.11.0...v17.12.0) Updates `lint-staged` from 17.3.0 to 17.5.0 - [Release notes](https://github.com/lint-staged/lint-staged/releases) - [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md) - [Commits](lint-staged/lint-staged@v17.3.0...v17.5.0) Updates `tap` from 21.7.5 to 21.8.0 - [Release notes](https://github.com/tapjs/tapjs/releases) - [Commits](https://github.com/tapjs/tapjs/compare/tap@21.7.5...tap@21.8.0) --- updated-dependencies: - dependency-name: "@better-auth/oauth-provider" dependency-version: 1.7.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: better-auth dependency-version: 1.7.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: hono dependency-version: 4.13.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-deps - dependency-name: "@playwright/test" dependency-version: 1.63.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: eslint dependency-version: 10.10.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: fallow dependency-version: 3.24.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: globals dependency-version: 17.12.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: lint-staged dependency-version: 17.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: tap dependency-version: 21.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-deps ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 17, 2026

Navigation Menu

Uh oh!

chore(deps): bump the npm-deps group across 1 directory with 9 updates - #74

chore(deps): bump the npm-deps group across 1 directory with 9 updates#74
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-deps-091eb10645

dependabot Bot commented on behalf of github Sep 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 17, 2026

v1.7.3

better-auth

Features

Bug Fixes

@better-auth/core

Features

Bug Fixes

1.7.3

Patch Changes

1.7.2

Patch Changes

1.7.1

1.7.0

Minor Changes

v1.7.3

better-auth

Features

Bug Fixes

@better-auth/core

Features

Bug Fixes

1.7.3

Patch Changes

1.7.2

Patch Changes

v4.13.7

Security fixes

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

v4.13.6

What's Changed

v1.63.0

🔒 Test locks

🪟 Locate across frames

👁️ Visible-only locators

🧾 Step params and subtitles

v10.10.0

Features

Bug Fixes

Documentation

Chores

v10.9.1

Bug Fixes

Documentation

Chores

v10.9.0

Features

Bug Fixes

v3.24.1: --production stops calling a test-only export safe to delete

--production stops calling a test-only export safe to delete

v3.24.0: Findings that say when the run behind them was incomplete

Findings say when the run behind them was incomplete

New commands

Reproducible churn

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`better-auth`

`@better-auth/core`

`better-auth`

`@better-auth/core`

`hono/jsx` renders plain strings unescaped in boundary components, leading to XSS

`--production` stops calling a test-only export safe to delete