Bump better-auth from 1.3.8 to 1.3.24

[dependabot]

Bumps better-auth from 1.3.8 to 1.3.24.

Commits

• 0fc35e4 chore: release v1.3.24
• 2e9e639 chore: fix adapter tests (#4844)
• aba9aab fix(db): onDelete is ignored (#4973)
• 3440829 chore: misc update
• 1b49c39 fix: refresh secondary storage sessions on user update (#4522)
• 80b8c47 fix: refresh secondary storage sessions on user update (#4522)
• 574b962 perf: improve type Auth (#4930)
• 458cb20 feat: add support for custom callback for authorization url (#4919)
• 2852122 refactor: move mockLogger into the specific test file (#4931)
• 44d3f4e refactor: move db schema to core (#4918)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
diff0-web	Ready	Preview	Comment	Oct 18, 2025 8:09am

[vercel]

The updated better-auth@1.3.24 and its transitive dependencies now require Node.js >= 20.19.0, but the project doesn't specify a minimum Node version, which could cause runtime failures.

View Details

📝 Patch Details

diff --git a/packages/backend/package.json b/packages/backend/package.json
index 3e2760e..d49fd20 100644
--- a/packages/backend/package.json
+++ b/packages/backend/package.json
@@ -12,6 +12,9 @@
     "@types/node": "^24.3.0",
     "typescript": "^5.9.2"
   },
+  "engines": {
+    "node": ">=20.19.0"
+  },
   "dependencies": {
     "@diff0/sandbox": "workspace:*",
     "@diff0/ai": "workspace:*",

Analysis

Missing Node.js version requirement for better-auth@1.3.24 cryptographic dependencies

What fails: The better-auth@1.3.24 package requires Node.js >=20.19.0 via transitive dependencies @noble/ciphers@2.0.1 and @noble/hashes@2.0.1, but the project lacks an engines field specification.

How to reproduce:

# Install dependencies on Node.js < 20.19.0
cd packages/backend
pnpm install  # May succeed but runtime could fail

# Check dependency requirements
cat node_modules/.pnpm/@noble+ciphers@2.0.1/node_modules/@noble/ciphers/package.json | grep engines
cat node_modules/.pnpm/@noble+hashes@2.0.1/node_modules/@noble/hashes/package.json | grep engines

Result: Dependencies specify "engines": { "node": ">= 20.19.0" } but project has no corresponding specification, creating deployment compatibility risks.

Expected: Project should specify Node.js version requirement in engines field per npm engines documentation to match transitive dependency requirements and ensure consistent deployment environments.

[dependabot]

Dependabot can't authenticate to a private package registry. Because of this, Dependabot cannot update this pull request.

[dependabot]

Superseded by #27.