[wiverson]

Summary

Clears the Dependabot / pnpm audit findings. pnpm audit went from 54 advisories (3 critical, 19 high) to 1 (low).

Direct bumps: better-auth + plugins 1.7.2 → 1.7.14, @modelcontextprotocol/sdk → 1.32.2, solid-js → 1.9.17, vitest → 4.1.12, zod 3 → 4.6.7.

Overrides (pnpm-workspace.yaml, each with its reason): hono, @hono/node-server, fast-uri, qs, brace-expansion, seroval, proxy-addr, body-parser, ip-address, vite, follow-redirects, node-forge, source-map-js, serialize-javascript, js-yaml@4.

Remaining: deepmerge (low, build-time only, via nitropack). There is no fixed release yet.

Two fixes the upgrade required

1. account.issuer column. Better Auth 1.7.0–1.7.2 required this column. Later releases removed it and refuse to start while a NOT NULL column they never write is present. I created a database on the current main (1.7.2) and booted it on 1.7.14: it threw Database schema mismatch at boot. So every deployment set up on 1.3.0 would have stopped working after a redeploy. dropAccountIssuer() replaces the old 1.6 backfill. It drops the column and its unique index before the migrator runs. The value was always local:credential. auth-upgrade.test.ts covers the 1.7.2 shape, the backfilled 1.6 → 1.3.0 shape and the plain 1.6 shape. Without the fix, 2 of the 3 tests fail.
2. RPC gate. Better Auth now checks the schema on every API call. /api/rpc/[fn] called getSession before runAuthMigrations, so on a new instance the first request returned 500 instead of 401 (caught by tests/http/security.test.ts). The gate now runs migrations first, as the other entry points do.

Testing

• pnpm typecheck, pnpm lint, pnpm build: clean
• pnpm test: 1100/1100
• Playwright e2e: 31/31
• Manual: database written by 1.7.2 boots and admin signs in

---

Generated by Claude Code