chore(deps): bump the npm-deps group with 8 updates by dependabot[bot] · Pull Request #64 · codebar/auth

dependabot · 2026-08-13T10:14:51Z

Bumps the npm-deps group with 8 updates:

Package	From	To
@better-auth/oauth-provider	`1.6.25`	`1.6.26`
@hono/node-server	`2.0.12`	`2.1.0`
better-auth	`1.6.25`	`1.6.27`
hono	`4.12.32`	`4.13.0`
@playwright/test	`1.62.0`	`1.62.1`
fallow	`3.10.0`	`3.14.0`
globals	`17.8.0`	`17.9.0`
lint-staged	`17.2.0`	`17.3.0`

Updates @better-auth/oauth-provider from 1.6.25 to 1.6.26

Release notes

Sourced from @better-auth/oauth-provider's releases.

v1.6.26

better-auth

Bug Fixes

Fixed session cleanup on user deletion to also remove sessions from secondary storage (#10520)

Fixed findSessions to skip invalid secondary-storage session entries without discarding other valid sessions (#10580)

Fixed email OTP sign-up to pass the verification type to custom OTP generators (#10608)

Fixed email OTP password reset to allow retrying after entering an invalid password (#10552)

Fixed email OTP verification to no longer reveal whether an email is registered before the OTP is verified (#10605)

Fixed jwtClient() collapsing createAuthClient type inference when combined with other client plugins (#10513)

Fixed JWT key minting inside database transactions to use the transaction-scoped adapter, preventing deadlocks on SQLite and ensuring keys commit with their surrounding transaction on Postgres and MySQL (#10623)

Fixed oAuthProxy to preserve Apple user data from form_post callbacks (#10599)

Fixed oneTapClient() collapsing createAuthClient type inference when combined with other client plugins (#10635)

Fixed database rate-limit cleanup to complete when no background task handler is configured (#10619)

Improved nextCookies performance in instrumented Next.js applications by reusing the next/headers import promise (#10467)

For detailed changes, see CHANGELOG

@better-auth/core

Features

Added a utility for creating stable, namespaced placeholder emails on the reserved placeholder.invalid domain (#10576)

For detailed changes, see CHANGELOG

@better-auth/redis-storage

Bug Fixes

Fixed listKeys() and clear() to use SCAN instead of KEYS so large keyspaces no longer block the Redis server (#10507)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@bytaesu, @Emmaccen, @gustavovalverde, @jashkarangiya, @jeroenvandermerwe, @jlucaso1, @krish-vachhani, @mrosberghaus, @XXMOHAMED012

Full changelog: v1.6.25...v1.6.26

Changelog

Sourced from @better-auth/oauth-provider's changelog.

1.6.26

Patch Changes

Updated dependencies [9ede805, 5a811f1, d8327f1, e2c73fb, af50c45, 701cd43, a30e274, e7b0eba, 2b4a14f, 7552a3b, ea38fca, a03e4c1]:

better-auth@1.6.26

@better-auth/core@1.6.26

Commits

a16b30e chore: release v1.6.26 (#10521)
See full diff in compare view

Updates @hono/node-server from 2.0.12 to 2.1.0

Release notes

Sourced from @hono/node-server's releases.

v2.1.0

What's Changed

feat: add Early Hints (HTTP 103) middleware by @bilal-azam in honojs/node-server#378

fix(listener): avoid uncaught error when force-closing a non-standard socket by @mohamedramadan14 in honojs/node-server#383

New Contributors

@bilal-azam made their first contribution in honojs/node-server#378

@mohamedramadan14 made their first contribution in honojs/node-server#383

Full Changelog: honojs/node-server@v2.0.12...v2.1.0

Commits

82ba34e 2.1.0
1f2909a fix(listener): avoid uncaught error when force-closing a non-standard socket ...
977a242 feat: add Early Hints (HTTP 103) middleware (#378)
See full diff in compare view

Updates better-auth from 1.6.25 to 1.6.27

Release notes

Sourced from better-auth's releases.

v1.6.27

better-auth

Bug Fixes

Fixed duplicate session requests being made across Suspense retries (#10676)

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

Fixed auth endpoint types to align with better-call (#10657)

For detailed changes, see CHANGELOG

auth

Bug Fixes

Fixed the CLI to align installed packages with the running CLI version (#10743)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@bytaesu

Full changelog: v1.6.26...v1.6.27

v1.6.26

better-auth

Bug Fixes

Fixed session cleanup on user deletion to also remove sessions from secondary storage (#10520)

Fixed findSessions to skip invalid secondary-storage session entries without discarding other valid sessions (#10580)

Fixed email OTP sign-up to pass the verification type to custom OTP generators (#10608)

Fixed email OTP password reset to allow retrying after entering an invalid password (#10552)

Fixed email OTP verification to no longer reveal whether an email is registered before the OTP is verified (#10605)

Fixed jwtClient() collapsing createAuthClient type inference when combined with other client plugins (#10513)

Fixed JWT key minting inside database transactions to use the transaction-scoped adapter, preventing deadlocks on SQLite and ensuring keys commit with their surrounding transaction on Postgres and MySQL (#10623)

Fixed oAuthProxy to preserve Apple user data from form_post callbacks (#10599)

Fixed oneTapClient() collapsing createAuthClient type inference when combined with other client plugins (#10635)

Fixed database rate-limit cleanup to complete when no background task handler is configured (#10619)

Improved nextCookies performance in instrumented Next.js applications by reusing the next/headers import promise (#10467)

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.6.27

Patch Changes

#10657 2ae491e Thanks @bytaesu! - Aligned endpoint and middleware context types with runtime route parameters, and preserved response headers when resolving sessions from endpoint contexts.

#10676 90b5093 Thanks @bytaesu! - Deduplicate in-flight session requests when React retries a suspended component.

Updated dependencies [2ae491e]:

@better-auth/core@1.6.27

@better-auth/drizzle-adapter@1.6.27

@better-auth/kysely-adapter@1.6.27

@better-auth/memory-adapter@1.6.27

@better-auth/mongo-adapter@1.6.27

@better-auth/prisma-adapter@1.6.27

@better-auth/telemetry@1.6.27

1.6.26

Patch Changes

#10619 9ede805 Thanks @jeroenvandermerwe! - Ensure database rate-limit cleanup completes when no background task handler is configured.

#10608 5a811f1 Thanks @bytaesu! - Pass the email verification type to custom OTP generators after email sign-up.

#10605 d8327f1 Thanks @XXMOHAMED012! - The email OTP verification check no longer reveals whether an email is registered before the OTP itself is verified.

#10513 e2c73fb Thanks @mrosberghaus! - Fix jwtClient() collapsing createAuthClient type inference when combined with other client plugins such as inferAdditionalFields. Additional user fields (for example on updateUser) are preserved again.

#10635 af50c45 Thanks @krish-vachhani! - Fix oneTapClient() collapsing createAuthClient type inference when combined with other client plugins. The oneTap action is available on the client again.

#10633 701cd43 Thanks @gustavovalverde! - Minting or reading a JWKS signing key inside an active database transaction now uses the transaction-scoped adapter instead of the root connection. On a single-connection SQLite database with native transactions enabled, this no longer deadlocks, and on Postgres and MySQL the key commits with the surrounding transaction instead of independently of it.

#10599 e7b0eba Thanks @bytaesu! - Preserve Apple user data from form_post callbacks when using oAuthProxy.

#10552 2b4a14f Thanks @bytaesu! - Allow users to retry email OTP password resets after entering an invalid password.

#10467 7552a3b Thanks @jlucaso1! - Improve nextCookies performance in instrumented Next.js applications.

#10580 ea38fca Thanks @Emmaccen! - Skip invalid secondary-storage session entries without discarding other valid sessions.

#10520 a03e4c1 Thanks @bytaesu! - Ensure deleting a user also removes their sessions from secondary storage.

Updated dependencies [a30e274]:

@better-auth/core@1.6.26

@better-auth/drizzle-adapter@1.6.26

@better-auth/kysely-adapter@1.6.26

@better-auth/memory-adapter@1.6.26

@better-auth/mongo-adapter@1.6.26

@better-auth/prisma-adapter@1.6.26

... (truncated)

Commits

be47e94 chore: release v1.6.27 (#10686)
2ae491e fix(types): align auth endpoints with better-call (#10657)
90b5093 fix(client): deduplicate session requests across suspense retries (#10676)
a16b30e chore: release v1.6.26 (#10521)
9ede805 fix(rate-limit): await database cleanup by default (#10619)
af50c45 fix(one-tap): preserve client plugin inference with oneTapClient (#10635)
222facf fix(jwt): resolve the transaction-scoped adapter when signing (#10623)
d8327f1 fix(email-otp): verify OTP before revealing whether the email exists (#10605)
e7b0eba fix(oauth-proxy): preserve Apple user data (#10599)
5a811f1 fix(email-otp): pass verification type on sign-up (#10608)
Additional commits viewable in compare view

Updates hono from 4.12.32 to 4.13.0

Release notes

Sourced from hono's releases.

v4.13.0

Hono v4.13.0 is now available!

The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more.

Performance improvements

This release includes a series of small optimizations: skipping unnecessary Headers allocations, replacing regex tests with indexOf, allocating internal state lazily, and more.

Here is benchmarks/fetch comparing v4.12 and v4.13 (ROUNDS=5 ./compare.sh, Bun 1.4.0, Apple Silicon — each measurement runs in a fresh process, and the variant order is reversed every round to avoid warm-up bias):

Benchmark v4.12 v4.13 Speedup

ping — GET / 165.83 ns 163.99 ns 1.01x

query — GET /id/1?name=bun 674.40 ns 616.99 ns 1.09x

json — GET /user 528.99 ns 422.44 ns 1.25x

body — POST /json 1.16 µs 1.00 µs 1.15x

The individual changes:

perf(context): iterate the header record with for..in honojs/hono#5118

perf(url): replace regex tests with indexOf honojs/hono#5121

perf(context): skip Headers creation when there are no headers to merge honojs/hono#5122

perf(urls): refactor tryDecodeURIComponent honojs/hono#5158

perf(request): allocate #validatedData lazily honojs/hono#5175

perf(request): probe the body cache without allocating honojs/hono#5176

In addition, the RegExpRouter rewrite described below makes route registration plus the first match roughly 20% faster.

Thanks @kibertoad for the contributions!

First-class QUERY method support

The QUERY method — a safe, idempotent method that carries a request body — is now a first-class citizen in Hono. You can define QUERY handlers with app.query():
const app = new Hono()
app.query('/search', async (c) => {
const conditions = await c.req.json()
return c.json(await search(conditions))
})
Thanks @shellhaki!

QUERY support across built-in middleware

The built-in middleware has been updated to handle QUERY requests properly:

... (truncated)

Commits

192768f 4.13.0
b0c2d90 Merge pull request #5154 from honojs/next
8f07028 fix(compress): set Vary: Accept-Encoding on negotiated responses (#5137)
8a0b18f feat(reg-exp-router): throw UnsupportedPathError during route registration (#...
3feb355 fix(jsx): allow a function component to return an array (#5179)
5d911d2 feat(utils/headers): add HTTP fields newly registered with IANA (#5153)
30277ae feat(jwt,jwk): add a configurable WWW-Authenticate realm (#5141)
1f707c5 feat(middleware): add method-not-allowed middleware (#5132)
2df0b47 feat(jsx): add React-compatible overloads to useRef (#5063)
3bc96ba feat(cache): add first-class support for QUERY requests (#5119)
Additional commits viewable in compare view

Updates @playwright/test from 1.62.0 to 1.62.1

Release notes

Sourced from @playwright/test's releases.

v1.62.1

Bug Fixes

#41989 [Regression]: tsconfig "extends" bare specifier isn't resolved via node_modules walk-up like tsc (fatal since 1.62)

#41998 [Regression]: directory-form tsconfig project references ("path": "../pkg") fail to resolve (fatal since 1.62)

#41985 Accessibility snapshot drops button name when text is nested inside spans with aria-hidden SVG

#42000 [Regression]: page.evaluate() arg of a branded primitive type (string & { brand }) no longer type-checks since 1.62

#42013 [BUG]Image-type actionable elements are not presented in the snapshot.

Commits

26a9e47 cherry-pick(#42043): docs: release notes for v1.62 Python, Java, and .NET (#4...
0a81d5d cherry-pick(#42040): docs(release-notes): mention the isolated headless clipb...
8376826 cherry-pick(#42034): fix(aria): keep icon-only clickable elements in ai snaps...
66c5cc9 chore: mark v1.62.1 (#42020)
9672bc3 cherry-pick(#42009): fix(types): support branded primitives in evaluate argum...
4325804 cherry-pick(#41988): fix(aria): preserve names from collapsed text contributors
9632f8e cherry-pick(#42005): fix(tsconfig): do not throw when "extends"/"references" ...
See full diff in compare view

Updates fallow from 3.10.0 to 3.14.0

Release notes

Sourced from fallow's releases.

v3.14.0: doMock-aware coverage, faster discovery and alias propagation

Mock-aware coverage learns doMock, workspace discovery and alias propagation got faster, and type-aware status tells the truth about how it found the sidecar.

Features

vi.doMock and jest.doMock join the mock-aware coverage model. They never mask test reachability (they are unhoisted and order-sensitive, so masking could produce false uncovered findings), but static path-shaped targets and their __mocks__ manual-mock siblings now receive credit edges on every proven receiver shape, and doUnmock cannot clear a sound hoisted mask. Automock (vi.mock without a factory) keeps coverage credit by pinned, documented decision. The --coverage-gaps docs now spell out the full mock-aware semantics, including what abstains.

Performance

Workspace discovery: a per-discovery manifest cache stops members reached via multiple workspace sources from being re-read and re-parsed, and Deno config probing collapses to a single filesystem probe per directory. Discovery and diagnostics benchmarks improved 7 to 12 percent with identical behavior.

Alias propagation: cross-package namespace alias propagation dropped its per-consumer string formatting and redundant clones, recovering the earlier regression and landing faster than the pre-regression baseline.

Fixes

type-aware status reports truthful discovery sources. Fallow's own launchers now mark self-injected wiring, so status distinguishes npm-wrapper and github-action from a genuinely user-set environment-override, and wrapper-wired discovery failures get the right remediation.

maxUnitSize semantics are now unambiguous. The schema and docs state explicitly that the four max* health thresholds govern which findings are listed and never move health_score, whose bins keep their fixed cross-project calibration; a regression test locks the score as byte-identical when thresholds change. Thanks @DeLuke84 for the report that exposed the ambiguity.

The flaky Windows process-tree lifecycle tests were hardened with deadline polling, serialized execution, and slow-runner headroom.

Full Changelog: fallow-rs/fallow@v3.13.0...v3.14.0

v3.13.0: Action-provisioned type-aware sidecar, flag-proof agent gate

The GitHub Action now provisions the type-aware sidecar itself, and the agent gate stops being fooled by git-level flags.

Features

The Action wires type-aware analysis end to end. A new tri-state type-aware input defaults to auto, which reads your project config: when typeAware.enabled is on (and audit.typeAware does not override it), the Action installs fallow-type-aware at exactly the CLI version it resolved, verifies the version match fail-closed, and exports FALLOW_TYPE_AWARE_BIN. Set true to force provisioning or false to skip it and run fully syntactic. Until now the Action installed only the standalone binary, so typeAware-enabled projects needed manual sidecar wiring in CI.

Bug fixes

The agent gate recognizes git -c … commit and friends. The gate installed by fallow hooks install --target agent only audited git commit / git push when the subcommand immediately followed git, so ordinary forms like git -c user.name=x commit, git --no-pager commit, or git -C dir push silently skipped the audit. Command recognition now tokenizes and steps over git-level options (including value-taking ones like -c, -C, --git-dir) while still ignoring lookalikes such as git log commit-message.txt or git stash push. A new FALLOW_GATE_DEBUG environment variable surfaces skip decisions on stderr for troubleshooting. Thanks @wouterkroes for the meticulously reproduced report, the payload-based test approach went straight into the test suite.

Full Changelog: fallow-rs/fallow@v3.12.0...v3.13.0

v3.12.0: type-aware audit enablement, rename-aware gating, sturdier baselines

Type-aware analysis and audit --gate new-only now work together out of the box, audits survive git mv, and health baselines got sturdier.

Type-aware + audit, fixed end to end

Three reports converged on the same enablement wall, and all three are gone:

One config is enough. With typeAware.enabled in .fallowrc, audit --gate new-only no longer exits 2 when base and head semantic identities differ: attribution falls back to identity-independent syntactic sets with a clear warning, semantic-only findings demote to advisory, and a genuinely new finding still fails the gate. A global --no-type-aware flag and an audit.typeAware config field give you an explicit syntactic escape hatch, and macOS /var vs /private/var temp paths no longer abort the run. Thanks @hckhanh for the detailed enablement-DX report.

Adding a file no longer degrades the gate. Identity comparison now uses the compatibility rules the identity type was designed with instead of raw equality, and the sidecar's project hash no longer includes the root file listing, so the everyday "this PR adds a new .ts file" diff compares cleanly. Thanks @lightsound for the precise source-level analysis.

The npm sidecar wiring is repaired. fallow@3.11.0 pinned fallow-type-aware to the previous version while the launcher requires an exact match, so the sidecar never wired and type-aware hard-failed on npm installs. Both the manifest and the release pipeline now bump the pin in lockstep. Thanks @lightsound for the report and the bun workaround notes.

Audit survives renames

git mv no longer turns audit --gate new-only red: base findings relocate onto post-rename paths via git rename detection across dead code, complexity, duplication, styling, and cycles, so pure renames attribute as inherited while a rename with edits still gates genuinely new debt. Validated on a real multi-directory rename that previously reported 21 introduced findings and now reports zero. Thanks @YoniChechik for the excellent report with the minimal repro.

Health and analysis improvements

... (truncated)

Commits

3cf8074 chore: release v3.14.0
5de19d4 test(process): harden the Unix process-tree registry test against slow runners
b6f6adc fix(mcp): satisfy redundant_pub_crate on the Windows test lock
6e80883 feat(health): credit doMock targets and pin the automock coverage decision (#...
e054def test(mcp): harden the Windows process-tree lifecycle tests against slow runne...
b7d1d43 docs(health): state that max thresholds govern findings, never the score (#2118)
d00354b fix(api): report truthful type-aware discovery sources (#2113)
4bc061f perf(config): cache manifest probes during workspace discovery (#2115)
85eaa3b perf(graph): cut allocations in cross-package alias propagation (#2114)
a99fb67 fix(vscode): override brace-expansion to 5.0.9 for GHSA-rgw5-rvv9-x895
Additional commits viewable in compare view

Updates globals from 17.8.0 to 17.9.0

Release notes

Sourced from globals's releases.

v17.9.0

Update globals (2026-08-01) (#348) 5a958ed

sindresorhus/globals@v17.8.0...v17.9.0

Commits

8e7b935 17.9.0
5a958ed Update globals (2026-08-01) (#348)
See full diff in compare view

Updates lint-staged from 17.2.0 to 17.3.0

Release notes

Sourced from lint-staged's releases.

v17.3.0

Minor Changes
#1825 16b3f74 - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:
{
  "*.ts": ["first", "second", ["third", "third"], "fourth"]
}
As a concrete example, lint-staged's own configuration is:
/** @type {import('./lib/index.js').Configuration} */
export default {
  "*": [
    [
      "oxfmt --check --no-error-on-unmatched-pattern",
      "oxlint --no-error-on-unmatched-pattern",
    ],
  ],
  "*.ts": () => "tsc",
};
which means:

for all staged files, run the two commands in parallel with staged filenames appended, for example:

oxfmt --check --no-error-on-unmatched-pattern lib/index.js

oxlint --no-error-on-unmatched-pattern lib/index.js

additionally, if any *.ts files are staged, run tsc without appending any arguments

The two sets of commands also run in parallel
Patch Changes

#1829 15f7e53 - During an in-progress merge, files that are unchanged from the branch being merged are now skipped. Technically, files are only included if there are staged changes against both HEAD and MERGE_HEAD.

Changelog

Sourced from lint-staged's changelog.

17.3.0

Minor Changes
#1825 16b3f74 - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:
{
  "*.ts": ["first", "second", ["third", "third"], "fourth"]
}
As a concrete example, lint-staged's own configuration is:
/** @type {import('./lib/index.js').Configuration} */
export default {
  "*": [
    [
      "oxfmt --check --no-error-on-unmatched-pattern",
      "oxlint --no-error-on-unmatched-pattern",
    ],
  ],
  "*.ts": () => "tsc",
};
which means:

for all staged files, run the two commands in parallel with staged filenames appended, for example:

oxfmt --check --no-error-on-unmatched-pattern lib/index.js

oxlint --no-error-on-unmatched-pattern lib/index.js

additionally, if any *.ts files are staged, run tsc without appending any arguments

The two sets of commands also run in parallel
Patch Changes

#1829 15f7e53 - During an in-progress merge, files that are unchanged from the branch being merged are now skipped. Technically, files are only included if there are staged changes against both HEAD and MERGE_HEAD.

Commits

d153443 Merge pull request #1828 from lint-staged/changeset-release/main
5162c14 chore(changeset): release
a4db9a4 Merge pull request #1831 from lint-staged/linter-updates
ea96cab style: enable oxlint "suspicious" category
2fae007 style: add @e18e/eslint-plugin
2280c38 Merge pull request #1829 from lint-staged/fix-merge-conflict-files
1453ae6 test: relax assertion so that it passes in worktree
15f7e53 fix: lint only files changed against HEAD and MERGE_HEAD, during a merge
dedfc31 Merge pull request #1825 from lint-staged/parallel-tasks-inside-sequence
286e25c feat: allow running parallel tasks by nesting arrays
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the npm-deps group with 8 updates: | Package | From | To | | --- | --- | --- | | [@better-auth/oauth-provider](https://github.com/better-auth/better-auth/tree/HEAD/packages/oauth-provider) | `1.6.25` | `1.6.26` | | [@hono/node-server](https://github.com/honojs/node-server) | `2.0.12` | `2.1.0` | | [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.6.25` | `1.6.27` | | [hono](https://github.com/honojs/hono) | `4.12.32` | `4.13.0` | | [@playwright/test](https://github.com/microsoft/playwright) | `1.62.0` | `1.62.1` | | [fallow](https://github.com/fallow-rs/fallow) | `3.10.0` | `3.14.0` | | [globals](https://github.com/sindresorhus/globals) | `17.8.0` | `17.9.0` | | [lint-staged](https://github.com/lint-staged/lint-staged) | `17.2.0` | `17.3.0` | Updates `@better-auth/oauth-provider` from 1.6.25 to 1.6.26 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/oauth-provider/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.6.26/packages/oauth-provider) Updates `@hono/node-server` from 2.0.12 to 2.1.0 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v2.0.12...v2.1.0) Updates `better-auth` from 1.6.25 to 1.6.27 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.6.27/packages/better-auth) Updates `hono` from 4.12.32 to 4.13.0 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.32...v4.13.0) Updates `@playwright/test` from 1.62.0 to 1.62.1 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.62.0...v1.62.1) Updates `fallow` from 3.10.0 to 3.14.0 - [Release notes](https://github.com/fallow-rs/fallow/releases) - [Changelog](https://github.com/fallow-rs/fallow/blob/main/release.toml) - [Commits](fallow-rs/fallow@v3.10.0...v3.14.0) Updates `globals` from 17.8.0 to 17.9.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](sindresorhus/globals@v17.8.0...v17.9.0) Updates `lint-staged` from 17.2.0 to 17.3.0 - [Release notes](https://github.com/lint-staged/lint-staged/releases) - [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md) - [Commits](lint-staged/lint-staged@v17.2.0...v17.3.0) --- updated-dependencies: - dependency-name: "@better-auth/oauth-provider" dependency-version: 1.6.26 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-deps - dependency-name: "@hono/node-server" dependency-version: 2.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: better-auth dependency-version: 1.6.27 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-deps - dependency-name: hono dependency-version: 4.13.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: "@playwright/test" dependency-version: 1.62.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-deps - dependency-name: fallow dependency-version: 3.14.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: globals dependency-version: 17.9.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: lint-staged dependency-version: 17.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-deps ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 13, 2026

Navigation Menu

Uh oh!

chore(deps): bump the npm-deps group with 8 updates - #64

chore(deps): bump the npm-deps group with 8 updates#64
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-deps-595935bcad

dependabot Bot commented on behalf of github Aug 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Benchmark	v4.12	v4.13	Speedup
`ping` — `GET /`	165.83 ns	163.99 ns	1.01x
`query` — `GET /id/1?name=bun`	674.40 ns	616.99 ns	1.09x
`json` — `GET /user`	528.99 ns	422.44 ns	1.25x
`body` — `POST /json`	1.16 µs	1.00 µs	1.15x

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 13, 2026

v1.6.26

better-auth

Bug Fixes

@better-auth/core

Features

@better-auth/redis-storage

Bug Fixes

Contributors

1.6.26

Patch Changes

v2.1.0

What's Changed

New Contributors

v1.6.27

better-auth

Bug Fixes

@better-auth/scim

Bug Fixes

auth

Bug Fixes

Contributors

v1.6.26

better-auth

Bug Fixes

1.6.27

Patch Changes

1.6.26

Patch Changes

v4.13.0

Performance improvements

First-class QUERY method support

QUERY support across built-in middleware

v1.62.1

Bug Fixes

v3.14.0: doMock-aware coverage, faster discovery and alias propagation

Features

Performance

Fixes

v3.13.0: Action-provisioned type-aware sidecar, flag-proof agent gate

Features

Bug fixes

v3.12.0: type-aware audit enablement, rename-aware gating, sturdier baselines

Type-aware + audit, fixed end to end

Audit survives renames

Health and analysis improvements

v17.9.0

v17.3.0

Minor Changes

Patch Changes

17.3.0

Minor Changes

Patch Changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`better-auth`

`@better-auth/core`

`@better-auth/redis-storage`

`better-auth`

`@better-auth/scim`

`auth`

`better-auth`