diff --git a/CHANGELOG.md b/CHANGELOG.md index 67355bde..b5297291 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -44,6 +44,34 @@ Two labels appear inside entries: If a release is quiet, that is the information. The intent is that the rare entry needing your attention cannot get lost among routine ones. +## 1.3.1 — 2026-10-29 + +**Taking this update:** redeploy. Nothing else. + +### Fixed + +- **Security** — dependencies updated to clear 53 of the 54 advisories `pnpm + audit` reported (3 critical, 19 high). The ones that reach the running + server: Better Auth to 1.7.14 (OAuth state reusable as a magic link; OAuth + proxy sign-in as another user), the MCP SDK to 1.32 (bearer-token and + per-session checks in the HTTP transport), seroval (deserialization of + attacker-chosen callables), and Express's `proxy-addr` and `body-parser` + (IP spoofing, DoS). zod moves to 4. The rest are build and test tooling. + The one left, a low-severity `deepmerge` advisory used only at build time, + has no fixed release yet. + +- **Upgrade safety** — Better Auth 1.7.3 and later remove the account table's + `issuer` column, which 1.7.0–1.7.2 required, and refuse to start while it + is there. Every deployment set up on 1.3.0 has it. The server now drops the + column and its index before migrating; the value was the same constant on + every row here, so nothing is lost. Tested against a database written by + 1.3.0 and one upgraded from 1.2. + +- Better Auth now checks the database schema on every call. The dashboard's + request gate called it before the auth tables were created, so on a + brand-new instance its first request would have failed with a 500. The gate + now creates the tables first, as every other entry point already did. + ## 1.3.0 — 2026-09-09 **Taking this update:** redeploy, then restart or reconnect your MCP client so it diff --git a/package.json b/package.json index 2324ebe9..ba639a11 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "notemesh", - "version": "1.3.0", + "version": "1.3.1", "description": "Personal Obsidian vault MCP server — Railway template", "type": "module", "private": true, @@ -19,24 +19,24 @@ "test:watch": "vitest" }, "dependencies": { - "@better-auth/api-key": "1.7.2", - "@better-auth/oauth-provider": "1.7.2", - "@modelcontextprotocol/sdk": "^1.30.0", + "@better-auth/api-key": "1.7.14", + "@better-auth/oauth-provider": "1.7.14", + "@modelcontextprotocol/sdk": "^1.32.2", "@picocss/pico": "^2.1.1", "@solidjs/meta": "^0.29.4", "@solidjs/router": "^0.15.3", "@solidjs/start": "^1.3.2", - "better-auth": "1.7.2", + "better-auth": "1.7.14", "better-sqlite3": "^13.0.2", "chokidar": "^5.0.0", "execa": "^10.0.0", "fetch-to-node": "^2.1.0", "jose": "^6.2.4", "obsidian-headless": "0.0.14", - "solid-js": "^1.9.7", + "solid-js": "^1.9.17", "vinxi": "^0.5.11", "yaml": "2.9.0", - "zod": "^3.25.0" + "zod": "^4.6.7" }, "devDependencies": { "@eslint/js": "^9.39.5", @@ -48,7 +48,7 @@ "globals": "^17.9.0", "typescript": "^5.8.0", "typescript-eslint": "^8.66.0", - "vitest": "^4.1.10" + "vitest": "^4.1.12" }, "engines": { "node": ">=24" diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 079c1ff0..7395e452 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -6,10 +6,21 @@ settings: overrides: h3: ^1.15.11 - hono: ^4.12.34 - fast-uri: ^3.1.6 - qs: ^6.16.0 - brace-expansion: ^2.1.4 + hono: ^4.13.11 + '@hono/node-server': ^2.1.3 + fast-uri: ^3.1.9 + qs: ^6.16.1 + brace-expansion: ^2.1.7 + seroval: ^1.6.10 + proxy-addr: ^2.0.8 + body-parser: ^2.4.0 + ip-address: ^10.7.4 + vite: ^6.4.4 + follow-redirects: ^1.16.1 + node-forge: ^1.4.1 + source-map-js: ^1.2.2 + serialize-javascript: ^7.1.3 + js-yaml@4: ^4.3.2 nanoid: ^3.3.17 importers: @@ -17,29 +28,29 @@ importers: .: dependencies: '@better-auth/api-key': - specifier: 1.7.2 - version: 1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)(better-auth@1.7.2(better-sqlite3@13.0.2)(solid-js@1.9.14)(vitest@4.1.10(@types/node@22.20.1)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))))(better-call@1.4.0(zod@3.25.76)) + specifier: 1.7.14 + version: 1.7.14(@better-auth/core@1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.1)(better-auth@1.7.14(solid-js@1.9.17)(vitest@4.1.12(@types/node@22.20.1)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))))(better-call@1.4.4(zod@4.6.7)) '@better-auth/oauth-provider': - specifier: 1.7.2 - version: 1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-auth@1.7.2(better-sqlite3@13.0.2)(solid-js@1.9.14)(vitest@4.1.10(@types/node@22.20.1)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))))(better-call@1.4.0(zod@3.25.76)) + specifier: 1.7.14 + version: 1.7.14(@better-auth/core@1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-auth@1.7.14(solid-js@1.9.17)(vitest@4.1.12(@types/node@22.20.1)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))))(better-call@1.4.4(zod@4.6.7)) '@modelcontextprotocol/sdk': - specifier: ^1.30.0 - version: 1.30.0(supports-color@10.2.2)(zod@3.25.76) + specifier: ^1.32.2 + version: 1.32.2(supports-color@10.2.2)(zod@4.6.7) '@picocss/pico': specifier: ^2.1.1 version: 2.1.1 '@solidjs/meta': specifier: ^0.29.4 - version: 0.29.4(solid-js@1.9.14) + version: 0.29.4(solid-js@1.9.17) '@solidjs/router': specifier: ^0.15.3 - version: 0.15.4(solid-js@1.9.14) + version: 0.15.4(solid-js@1.9.17) '@solidjs/start': specifier: ^1.3.2 - version: 1.3.2(solid-js@1.9.14)(supports-color@10.2.2)(vinxi@0.5.11(@parcel/watcher@2.6.0)(@types/node@22.20.1)(better-sqlite3@13.0.2)(db0@0.3.4(better-sqlite3@13.0.2))(debug@4.4.3(supports-color@10.2.2))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(supports-color@10.2.2)(terser@5.49.0)(yaml@2.9.0))(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) + version: 1.3.2(solid-js@1.9.17)(supports-color@10.2.2)(vinxi@0.5.11(@parcel/watcher@2.6.0)(@types/node@22.20.1)(better-sqlite3@13.0.2)(db0@0.3.4(better-sqlite3@13.0.2))(debug@4.4.3(supports-color@10.2.2))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(supports-color@10.2.2)(terser@5.49.0)(yaml@2.9.0))(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) better-auth: - specifier: 1.7.2 - version: 1.7.2(better-sqlite3@13.0.2)(solid-js@1.9.14)(vitest@4.1.10(@types/node@22.20.1)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))) + specifier: 1.7.14 + version: 1.7.14(solid-js@1.9.17)(vitest@4.1.12(@types/node@22.20.1)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))) better-sqlite3: specifier: ^13.0.2 version: 13.0.2 @@ -59,8 +70,8 @@ importers: specifier: 0.0.14 version: 0.0.14 solid-js: - specifier: ^1.9.7 - version: 1.9.14 + specifier: ^1.9.17 + version: 1.9.17 vinxi: specifier: ^0.5.11 version: 0.5.11(@parcel/watcher@2.6.0)(@types/node@22.20.1)(better-sqlite3@13.0.2)(db0@0.3.4(better-sqlite3@13.0.2))(debug@4.4.3(supports-color@10.2.2))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(supports-color@10.2.2)(terser@5.49.0)(yaml@2.9.0) @@ -68,8 +79,8 @@ importers: specifier: 2.9.0 version: 2.9.0 zod: - specifier: ^3.25.0 - version: 3.25.76 + specifier: ^4.6.7 + version: 4.6.7 devDependencies: '@eslint/js': specifier: ^9.39.5 @@ -99,8 +110,8 @@ importers: specifier: ^8.66.0 version: 8.66.0(eslint@9.39.5(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@5.9.3) vitest: - specifier: ^4.1.10 - version: 4.1.10(@types/node@22.20.1)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) + specifier: ^4.1.12 + version: 4.1.12(@types/node@22.20.1)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) packages: @@ -195,81 +206,78 @@ packages: resolution: {integrity: sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA==} engines: {node: '>=6.9.0'} - '@better-auth/api-key@1.7.2': - resolution: {integrity: sha512-jih45wZaQ83lVYdChSnasxb8iax8p7AYetZ/XiImA9Yuag+cqmLBsaLPNvds5aZV18hLpmvzVkuzf7H/k1X88g==} + '@better-auth/api-key@1.7.14': + resolution: {integrity: sha512-4eKtRgzsHdti+w47nEMaSKm6Hu3fIFlnge6ha6wfKx3Go4uKQoVhhg2PRqUR9/+bPcRKKzPwsfvDIhCKCTaO6g==} peerDependencies: - '@better-auth/core': ^1.7.2 - '@better-auth/utils': 0.4.2 - better-auth: ^1.7.2 - better-call: 1.4.0 + '@better-auth/core': ^1.7.14 + '@better-auth/utils': ^0.4.2 || ^0.5.0 + better-auth: ^1.7.14 + better-call: 1.4.4 - '@better-auth/core@1.7.2': - resolution: {integrity: sha512-j0nM4ygsWbF/fcYRoKtDn8gn8uLXkmC+075HqSqsJEAV828cJR9bvYBCUQ1zmxNyRBk6Iz/qXsA0Zm2oksiOTg==} + '@better-auth/core@1.7.14': + resolution: {integrity: sha512-ByhdrGVwp/el+hoTYKSVOHIH23/lQj9TQ1txdGcWOg22tnfr3hJ6ukzySooeYj/R36XsQgBhkJqIp8mKsNeErA==} peerDependencies: - '@better-auth/utils': 0.4.2 - '@better-fetch/fetch': 1.3.1 - '@cloudflare/workers-types': '>=4' + '@better-auth/utils': ^0.4.2 || ^0.5.0 + '@better-fetch/fetch': 1.3.3 '@opentelemetry/api': ^1.9.0 - better-call: 1.4.0 + better-call: 1.4.4 jose: ^6.1.0 kysely: ^0.28.5 || ^0.29.0 nanostores: ^1.0.1 peerDependenciesMeta: - '@cloudflare/workers-types': - optional: true '@opentelemetry/api': optional: true - '@better-auth/drizzle-adapter@1.7.2': - resolution: {integrity: sha512-A5wE10PIv3aS5LGePecEHntQylKy6OOF17B4dqlE0DwJeqU/IOBSd7/LZhMop9cNJ3WFjKMpazVSf91yYM/NFg==} + '@better-auth/drizzle-adapter@1.7.14': + resolution: {integrity: sha512-5RC8Ec5Ur15FWsS4As9/VrlRbB3+9EfShxIpA5A1FcD6IgPxFvzQNkAm2+FYx9LUSqx47NPf9hBTG2GUCMP9Ig==} peerDependencies: - '@better-auth/core': ^1.7.2 - '@better-auth/utils': 0.4.2 + '@better-auth/core': ^1.7.14 + '@better-auth/utils': ^0.4.2 || ^0.5.0 drizzle-orm: ^0.45.2 || >=1.0.0-rc.1 <2.0.0 peerDependenciesMeta: drizzle-orm: optional: true - '@better-auth/kysely-adapter@1.7.2': - resolution: {integrity: sha512-LYdSRLOvZiF+6S0UThu+wE/Qxsq9P2jQs7ZKkY6BIBJqUjYyxVDmi8HFcantBvWWW1/BeQCSsD7YVDG4gICMIQ==} + '@better-auth/kysely-adapter@1.7.14': + resolution: {integrity: sha512-4wkqj8a8JVpWDYLlgzfbk7eOaWCFkL6HHQd6CLamFKaC8vNsXew1x4v5dE5O6dGr8j4g5qMISS+BAvOuIvBevg==} peerDependencies: - '@better-auth/core': ^1.7.2 - '@better-auth/utils': 0.4.2 + '@better-auth/core': ^1.7.14 + '@better-auth/utils': ^0.4.2 || ^0.5.0 kysely: ^0.28.17 || ^0.29.0 peerDependenciesMeta: kysely: optional: true - '@better-auth/memory-adapter@1.7.2': - resolution: {integrity: sha512-0q1SXMzm5esH9L0xVuM6IxCk59E4G+3HySX4My9gvEwqtmUobykn+iuc/si3Y4xwUO7JODqQ5o+/pPcLDDMIrA==} + '@better-auth/memory-adapter@1.7.14': + resolution: {integrity: sha512-Ojv9BcmFyHuTHha9ZM/NUW1ut9J84wLngta+07Es0Ejn8kekqP5aHBpZd5Z8AvADs5iJUOWvQGFmGlPWAKJgBg==} peerDependencies: - '@better-auth/core': ^1.7.2 - '@better-auth/utils': 0.4.2 + '@better-auth/core': ^1.7.14 + '@better-auth/utils': ^0.4.2 || ^0.5.0 - '@better-auth/mongo-adapter@1.7.2': - resolution: {integrity: sha512-4879SmUWHUs0OYlvHoCFbycZ7i1bqytkcgAUdt9RLQMvZ5H3LRMTgax2YVlGZEXgwNjY/X7xAoXOecWLhlQWeA==} + '@better-auth/mongo-adapter@1.7.14': + resolution: {integrity: sha512-6IA0RSPZFMdRwwnLZ9oWnDIiD0y0o0azTHUfa01BNU2AFJgMDkeiASUV3bKcJBskzQoyQrff74eFYTsTSeeVUQ==} peerDependencies: - '@better-auth/core': ^1.7.2 - '@better-auth/utils': 0.4.2 + '@better-auth/core': ^1.7.14 + '@better-auth/utils': ^0.4.2 || ^0.5.0 mongodb: ^6.0.0 || ^7.0.0 peerDependenciesMeta: mongodb: optional: true - '@better-auth/oauth-provider@1.7.2': - resolution: {integrity: sha512-td7FnUz3lLKXFXN+0RbZe3ygaHqxpRqDG+gxbfSZbztbVfG7vuZtR4ba3uccsodAw7anchhIg2xwVP1/zlcxcw==} + '@better-auth/oauth-provider@1.7.14': + resolution: {integrity: sha512-ey5PmiL4HcJ8CI65xZ3B9LSmRMziF+CNBuzAXx8oJujrItQ7UrEuDr6EAa+nKLQflexRL0AJMXqT7EYObWZxhg==} peerDependencies: - '@better-auth/core': ^1.7.2 - '@better-auth/utils': 0.4.2 - '@better-fetch/fetch': 1.3.1 - better-auth: ^1.7.2 - better-call: 1.4.0 - - '@better-auth/prisma-adapter@1.7.2': - resolution: {integrity: sha512-mXTr/83WrNWLrvzIjtgDgdu9iXhOcSG1+qBQOAKlbGSFiOB+z4IMRneQ2wmMOiB8mKY9qGkClVUjKRFXqtHnFQ==} + '@better-auth/core': ^1.7.14 + '@better-auth/utils': ^0.4.2 || ^0.5.0 + '@better-fetch/fetch': 1.3.3 + better-auth: ^1.7.14 + better-call: 1.4.4 + + '@better-auth/prisma-adapter@1.7.14': + resolution: {integrity: sha512-mF6t5xqeZNWzUe0ErmrSdzQmtslJscmu9X8Mp5QmROlpnnAzvSc70RILu8lHms8CePt7N34+KRH1QvYjGFrVGQ==} peerDependencies: - '@better-auth/core': ^1.7.2 - '@better-auth/utils': 0.4.2 + '@better-auth/core': ^1.7.14 + '@better-auth/utils': ^0.4.2 || ^0.5.0 '@prisma/client': ^5.0.0 || ^6.0.0 || ^7.0.0 prisma: ^5.0.0 || ^6.0.0 || ^7.0.0 peerDependenciesMeta: @@ -278,21 +286,18 @@ packages: prisma: optional: true - '@better-auth/telemetry@1.7.2': - resolution: {integrity: sha512-LcWu+O0zrxYDQj8E36vfkJwGPW4k9ZDA/rCo0zST6ihzL+juR7pBowoZIM9E6tK0Vit52mf6412bGT4XM4eTjQ==} + '@better-auth/telemetry@1.7.14': + resolution: {integrity: sha512-PtKFzsH7gje/WJuUPDjckOoNFazsq8NMt3AdiXIPzHl7tZULcNGTKAX8K7+yn0rG6cO/4mtMgpOjhtilElOnmg==} peerDependencies: - '@better-auth/core': ^1.7.2 - '@better-auth/utils': 0.4.2 - '@better-fetch/fetch': 1.3.1 - - '@better-auth/utils@0.4.2': - resolution: {integrity: sha512-AUxrvu+HaaODsUyzDxFgwd/8RZ1yZaYo42LXKSrU2oGgR38pS1ij8nqQKNgtTWoYGpNevNXtCfgTy6loHveW9A==} + '@better-auth/core': ^1.7.14 + '@better-auth/utils': ^0.4.2 || ^0.5.0 + '@better-fetch/fetch': 1.3.3 - '@better-auth/utils@0.5.0': - resolution: {integrity: sha512-BL8W4EfIZFwlu0r54m3v1ztjDhu6dDe/amLTm0xybmbZaNgYUqhD3SjpAsnq0q8YD6/ki4iwIgxJNLP/N3TxiA==} + '@better-auth/utils@0.5.1': + resolution: {integrity: sha512-WETqw5vQ52uQ/xwWR4E8rTgT6fDEr/wnS+otDNkBCa/69281FCF32OKDdQUcahMCnjsvqXBNiEvAQHFB0EVRRg==} - '@better-fetch/fetch@1.3.1': - resolution: {integrity: sha512-ABkD1WhyfPZprKRQI3bhATjeiFuNWC9PXhfGWqL+sg/gKrM977oFrYkdb4msM3hgUGonr7KlOsOFT5TU2rht9g==} + '@better-fetch/fetch@1.3.3': + resolution: {integrity: sha512-U6SlDt/GUWtK2JAxS/NhdoYTEim+EL1G5byz2TUj83KjLZBUpYzb5SmX0aXaCnbGkAjFKnV/o/0+cyXMbEcqqg==} '@cloudflare/kv-asset-handler@0.4.2': resolution: {integrity: sha512-SIOD2DxrRRwQ+jgzlXCqoEFiKOFqaPjhnNTGKXSRLvp1HiOvapLaFG2kEr9dYQTYe8rKrd9uvDUzmAITeNyaHQ==} @@ -654,11 +659,11 @@ packages: resolution: {integrity: sha512-43/qtrDUokr7LJqoF2c3+RInu/t4zfrpYdoSDfYyhg52rwLV6TnOvdG4fXm7IkSB3wErkcmJS9iEhjVtOSEjjA==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} - '@hono/node-server@2.0.12': - resolution: {integrity: sha512-eWpQYr67tqJLeaSUl0Q+TquuYfUdTibpOJlUMV2FfUP7+KqCC5TufnwnlXL6mobZBJbGAYRd7ZvEBDCbLInjhg==} + '@hono/node-server@2.1.5': + resolution: {integrity: sha512-MgP/I06GdvsilDspMk/qmRzpk8LOUStP6jFAbSRi40W09DhoyUn+Mj7eyKICPqeYKybOjVFLVIAQzvu1bfIa7Q==} engines: {node: '>=20'} peerDependencies: - hono: ^4.12.34 + hono: ^4.13.11 '@humanfs/core@0.19.2': resolution: {integrity: sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==} @@ -715,8 +720,8 @@ packages: engines: {node: '>=18'} hasBin: true - '@modelcontextprotocol/sdk@1.30.0': - resolution: {integrity: sha512-xKd8OIzlqNzcqcNumGAa6g+PW2kjD5vrpcKOnfldAUPP3j7lnqMPwlTXQm8gF+UwH72z0lqaRbjr9hqGz0eITA==} + '@modelcontextprotocol/sdk@1.32.2': + resolution: {integrity: sha512-SWsVtH/0vULSQStoZ6xxH2K09Li8fXYTMC64ZeogCdpZ3XSi1eCPOByV1OpuJxuI3OcmHhosDWYyii07tpPsLw==} engines: {node: '>=18'} peerDependencies: '@cfworker/json-schema': ^4.1.1 @@ -745,10 +750,6 @@ packages: resolution: {integrity: sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==} engines: {node: '>= 8'} - '@opentelemetry/semantic-conventions@1.43.0': - resolution: {integrity: sha512-eSYWTm620tTk45EKSedaUL8MFYI8hW164hIXsgIHyxu3VobUB3fFCu5t0hQby6OoWRPsG1KkKUG2M5UadiLiVg==} - engines: {node: '>=14'} - '@parcel/watcher-android-arm64@2.6.0': resolution: {integrity: sha512-trgpLSCKRC/huFjXX/Smh+0sWe4+YtKfktIToiMl59ghz7z+qkH6kMvNnUbLyRs9N11t8l4svSCs1+5B3rOAhA==} engines: {node: '>= 10.0.0'} @@ -1131,7 +1132,7 @@ packages: resolution: {integrity: sha512-B9z/HbF7gJBaRHieyX7f2uQ4LpLLAVAEutBZipH6w+CYD6RHRJvSVPzECGHF7icFhNWTiJQL2QR6K07s59yzEw==} engines: {node: '>=12'} peerDependencies: - vite: '>=6.0.0' + vite: ^6.4.4 '@tanstack/router-utils@1.162.2': resolution: {integrity: sha512-hTWqJtqIFFdvuCl8WXNyrodp2L9zo2G37xKRrcVmVRWpAB2h+U1LuRAfS4tsFTiWOIoE/B+WDVFB8JpoEdw6jQ==} @@ -1270,34 +1271,34 @@ packages: peerDependencies: vinxi: ^0.5.5 - '@vitest/expect@4.1.10': - resolution: {integrity: sha512-YsCn+qAk1GWjQOWFEsEcL2gNQ0zmVmQu3T03qP6UyjhtmdtwtbuI+DASn/7iQB3HGTXkdBwGddzxPlmiql5vlA==} + '@vitest/expect@4.1.12': + resolution: {integrity: sha512-vFlTt+YEu9WBpNjdGayNmlMVzrWPi1+sv853/7t2FU7hpO5gAFBKHzQmkCq5Xjpr+evegF2994LQT3hF3mRlqQ==} - '@vitest/mocker@4.1.10': - resolution: {integrity: sha512-v0xaezt+DKEmKfaxg133ldzADrwLGd7Ze1MfQQTYfvs8OqZIwbxyxaYURivwV7sWy5fqn3rH5uOrSp07bp44Ow==} + '@vitest/mocker@4.1.12': + resolution: {integrity: sha512-fKShNpKZzupWZuY0z7egydvL0sqW4INEZBEExMBMAa6izlENEVHwoXgdaTCaBZ5fwlr4xf2o1wXC83n9RpO+NA==} peerDependencies: msw: ^2.4.9 - vite: ^6.0.0 || ^7.0.0 || ^8.0.0 + vite: ^6.4.4 peerDependenciesMeta: msw: optional: true vite: optional: true - '@vitest/pretty-format@4.1.10': - resolution: {integrity: sha512-W1HsjSH4MXQ9YfmmhLAoIYf1HRfekQCGngeIgcei6MP5QQGWUe0gkopdZQaVCFO+JDJMrAJGwa5pRpNpvy4P8Q==} + '@vitest/pretty-format@4.1.12': + resolution: {integrity: sha512-XW9O8+Mxx4VpCtkYdMJLZQQwsVryP9wk7cPKDxtXFfwSak6yRh5+2fep/Y0XF/ElBvJHq8bcYdi6aeuai0opZA==} - '@vitest/runner@4.1.10': - resolution: {integrity: sha512-IKI6kpIH+LmpROplyLwBBaCfMgOZOMsygVa6BARD6ahA04VRuJSa6OaVG7kRvSEMD870Vd91rSSw0eegtWyLGg==} + '@vitest/runner@4.1.12': + resolution: {integrity: sha512-NKlVKCr5QnCe8jijdMnmkpHHU+WTqiLFR6G0pHji9uRjXK9xJl1k1nTw6F3pOOj2PDcsDt2GKQMI7wIsaT491w==} - '@vitest/snapshot@4.1.10': - resolution: {integrity: sha512-xRkfOT1qpTAi/Ti4Y1LtfRc3kEuqxGw59eN2jN9pRWMtS/XDevekhcFSqvQqjUNGksfjMJu3Y+oJ+4Ypn2OaJw==} + '@vitest/snapshot@4.1.12': + resolution: {integrity: sha512-ko1y1Qgb/slzQ9mr+b89Cuqud8WG1TKtsPD8r7ZUBdvVOGt85Af2HwCqHujrhwJq95hs/9RM7fcAPg57o1vlzw==} - '@vitest/spy@4.1.10': - resolution: {integrity: sha512-PLf/Ugvoq5wO/b4rwYCR1h2PSIdXz7wnkQFMiUpLdtM7l6pqVFcQIBEHyT1+l+cj7mNwAfZHzqXqDyjvOuwbDw==} + '@vitest/spy@4.1.12': + resolution: {integrity: sha512-RGq9x4JNGNTZHEJxvN0oSiJjeSCExm0n2gZKKJZHY9cX5AVA6M7VJILBT3ZJ/tJ/0J9uWT7fETV9/btoi//vSg==} - '@vitest/utils@4.1.10': - resolution: {integrity: sha512-fy9am/HWxbaGt/Sawrp90vt6Y6jQwf1RX77cz3uwoJwJVMli/e1IEwRPnMNJ7vKfPTwo0diXifkpPvwH9v7nGA==} + '@vitest/utils@4.1.12': + resolution: {integrity: sha512-Q3awXrwOfEV+qc3WmO5ONyE0yO7Q1gQ9/oyHxGLZ/pl7N3NO/ZztqQwKLuwMkV+CA1JYSIeO3gkHnRDIo4AVaA==} abbrev@3.0.1: resolution: {integrity: sha512-AO2ac6pjRB3SJmGJo+v5/aK6Omggp6fsLrs6wN9bd35ulu4cCwaAU9+7ZhXjeqHVkaHThLuzH0nZr0YpCDhygg==} @@ -1482,15 +1483,14 @@ packages: engines: {node: '>=6.0.0'} hasBin: true - better-auth@1.7.2: - resolution: {integrity: sha512-gKapKBEvYIGcMxi74RjQ7EbFLiqyQt58vdoJmL1qAlWSkY1Bc2Vqshl524/3u1NxauiOU03M/Ebh762Brmac9A==} + better-auth@1.7.14: + resolution: {integrity: sha512-QxDCI0pOCCHDYmruisKhKyrvOJ6Icv9xg0RA6ZUysfKFXENYwhNNpwUlkE/NmViH2nDMgkKcymmLr55pnpR9vw==} peerDependencies: '@lynx-js/react': '*' '@prisma/client': ^5.0.0 || ^6.0.0 || ^7.0.0 - '@sveltejs/kit': ^2.0.0 + '@sveltejs/kit': ^2.0.0 || ^3.0.0 '@tanstack/react-start': ^1.0.0 '@tanstack/solid-start': ^1.0.0 - better-sqlite3: ^12.0.0 drizzle-kit: '>=0.31.4 || >=1.0.0-beta.1' drizzle-orm: ^0.45.2 || >=1.0.0-rc.1 <2.0.0 mongodb: ^6.0.0 || ^7.0.0 @@ -1502,7 +1502,7 @@ packages: react-dom: ^18.0.0 || ^19.0.0 solid-js: ^1.0.0 svelte: ^4.0.0 || ^5.0.0 - vitest: ^2.0.0 || ^3.0.0 || ^4.0.0 + vitest: ^2.0.0 || ^3.0.0 || ^4.0.0 || ^5.0.0 vue: ^3.0.0 peerDependenciesMeta: '@lynx-js/react': @@ -1515,8 +1515,6 @@ packages: optional: true '@tanstack/solid-start': optional: true - better-sqlite3: - optional: true drizzle-kit: optional: true drizzle-orm: @@ -1544,8 +1542,8 @@ packages: vue: optional: true - better-call@1.4.0: - resolution: {integrity: sha512-bBKOT4vv1kZLDgxVePdilk/Jwkn+dtRRsmi3DzHcDP+WnswyVl6dR59l2HEeP/0cB+bDoopASAesWDPIdd/zZA==} + better-call@1.4.4: + resolution: {integrity: sha512-Gq4XdGFy4dmUxFEAX2nj0ycFcFbD9ZWh8YROouZoyXeF1M11TpYbplk0pDByTFF8Wz+MYa6W9052c9m7dD+mfw==} peerDependencies: zod: ^4.0.0 peerDependenciesMeta: @@ -1566,16 +1564,16 @@ packages: bl@4.1.0: resolution: {integrity: sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==} - body-parser@2.3.0: - resolution: {integrity: sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==} + body-parser@2.4.0: + resolution: {integrity: sha512-Ifk1KcLrxaGt1occQagQNFNNOqRt1LFuehEnHHzB8Z6cRgIxRU1TBaiIsUiCdA+gy5PL7Y1IX31DNKkRmxtXjQ==} engines: {node: '>=18'} boxen@8.0.1: resolution: {integrity: sha512-F3PH5k5juxom4xktynS7MoFY+NUWH5LC4CnH11YB8NPew+HLpmBLCybSAEyb2F+4pRXhuhWqFesoQd6DAyc2hw==} engines: {node: '>=18'} - brace-expansion@2.1.4: - resolution: {integrity: sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==} + brace-expansion@2.1.7: + resolution: {integrity: sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==} braces@3.0.3: resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==} @@ -1741,6 +1739,10 @@ packages: resolution: {integrity: sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==} engines: {node: '>=18'} + content-type@2.1.0: + resolution: {integrity: sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==} + engines: {node: '>=18'} + convert-source-map@2.0.0: resolution: {integrity: sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==} @@ -2135,8 +2137,8 @@ packages: fast-levenshtein@2.0.6: resolution: {integrity: sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==} - fast-uri@3.1.7: - resolution: {integrity: sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==} + fast-uri@3.1.9: + resolution: {integrity: sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==} fastq@1.20.1: resolution: {integrity: sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==} @@ -2183,8 +2185,8 @@ packages: flatted@3.4.4: resolution: {integrity: sha512-5+ybhBZANEJxaH3X5evAFatUxLfEHSr7n6kYJ+1Qd0mUqr4eu9gIf6GDbWHf8RJijHrjjO8G+la14SlL2SeS1Q==} - follow-redirects@1.16.0: - resolution: {integrity: sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==} + follow-redirects@1.16.2: + resolution: {integrity: sha512-/kVP2U8z596Ia0gwFrwyIeo74ta5aVmSeU1FfAUMAmcEP5EP7zydmag3SLiN64NaRKef3lxsq7i/g7ltJQDGow==} engines: {node: '>=4.0'} peerDependencies: debug: '*' @@ -2323,8 +2325,8 @@ packages: hast-util-whitespace@3.0.0: resolution: {integrity: sha512-88JUN06ipLwsnv+dVn+OIYOvAuvBMy/Qoi6O7mQHxdPXpjy+Cd6xRkWwux7DKO+4sYILtLBRIKgsdpS2gQc7qw==} - hono@4.12.34: - resolution: {integrity: sha512-GqXJqY/xJkJmuloTrnV1ZEXG3fqte+VjkUqoRNZXcrUidiUOP4fMSIHHY4tsqZBK++kVyWmt/AAfSUuy57/eSA==} + hono@4.13.14: + resolution: {integrity: sha512-yhRLQ21U6qa9Hsu2N7Qcbh8tE+WKEcoErjIo56LeSGiGXGp9sA7UpE86Ui9uexb61KakiGwuHMn2QdV7w6i6kQ==} engines: {node: '>=16.9.0'} hookable@5.5.3: @@ -2406,8 +2408,8 @@ packages: resolution: {integrity: sha512-ehuGcf94bQXhfagULNXrJdfnWO38v070jxSx/qE87Kjzmu2fU7ro5EFAb+OPituLqgfyuQaym5DlrNydW2sJ9A==} engines: {node: '>=12.22.0'} - ip-address@10.3.1: - resolution: {integrity: sha512-1e9d3kb97NHJTIJDZW9rKqW2h6+dFa50Dy0fpPSMQp2ADje5gvKsXmdiK6dwY5t76TaTt5+P5N1Y/LoToIxP6g==} + ip-address@10.7.5: + resolution: {integrity: sha512-t2v0rkILYv9WXmSL7TpAaU3HXgaFYOPUcH3QHgwQ++gpJuH3bqyMy4Fvt/DJCTKwzH3Cf+bAp5W/mFL39KPLzA==} engines: {node: '>= 12'} ipaddr.js@1.9.1: @@ -2530,8 +2532,8 @@ packages: js-tokens@9.0.1: resolution: {integrity: sha512-mxa9E9ITFOt0ban3j6L5MpjwegGz6lBQmM1IJkWeBZGcMxto50+eWdjC/52xDbS2vy0k7vIMK0Fe2wfL9OQSpQ==} - js-yaml@4.3.1: - resolution: {integrity: sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==} + js-yaml@4.3.2: + resolution: {integrity: sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==} hasBin: true jsesc@3.1.0: @@ -2799,8 +2801,8 @@ packages: encoding: optional: true - node-forge@1.4.0: - resolution: {integrity: sha512-LarFH0+6VfriEhqMMcLX2F7SwSXeWwnEAJEsYm5QKWchiVYVvJyV9v7UDvUv+w5HO23ZpQTXDv/GxdDdMyOuoQ==} + node-forge@1.4.2: + resolution: {integrity: sha512-rRtAR5XLJ8gCKd9du4qrKAsgCG1ObGP4gLeNJMa4vYSeq4bmBMOJk5IHkrviBV0q7uoAJlVd8HEQYQSVUb4FGQ==} engines: {node: '>= 6.13.0'} node-gyp-build@4.8.4: @@ -3007,8 +3009,8 @@ packages: property-information@7.2.0: resolution: {integrity: sha512-IAtzIB6sUiWaJYrX9smp3V46pBGbBeLFRGdh25kg1334VcBlD8HzhPeNIWQH9zhGmo2itIe25EHt9dQP7G5hmg==} - proxy-addr@2.0.7: - resolution: {integrity: sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==} + proxy-addr@2.0.8: + resolution: {integrity: sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==} engines: {node: '>= 0.10'} pump@3.0.4: @@ -3018,8 +3020,8 @@ packages: resolution: {integrity: sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==} engines: {node: '>=6'} - qs@6.16.0: - resolution: {integrity: sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==} + qs@6.17.0: + resolution: {integrity: sha512-5LK5BZ2XDHMvcUJaf0CQ5HL3aVgKbpklvByC7qLSxYkfE8COEEbJg5xCHWCTqzqi0Gs4Jn5Mv5v3R38W6edscA==} engines: {node: '>=0.6'} quansync@0.2.11: @@ -3178,19 +3180,25 @@ packages: resolution: {integrity: sha512-1gnZf7DFcoIcajTjTwjwuDjzuz4PPcY2StKPlsGAQ1+YH20IRVrBaXSWmdjowTJ6u8Rc01PoYOGHXfP1mYcZNQ==} engines: {node: '>= 18'} - serialize-javascript@7.0.7: - resolution: {integrity: sha512-YAy8Od6KV+uuwUuU50np8fGB/Aues6Y0nAhA9y/hId74PlKUcme4pXcBD46NWKr1Q4osN/iseZ17YqO1XfmI8g==} + serialize-javascript@7.1.4: + resolution: {integrity: sha512-FqlEuoTq/zRmA4Lg6aOqyH3lCHbUtCB0bmHCeFniX2GBdDqMJM3FwdvEhlE5Pim1dlt2FfBdVPmUNNiGhhKqpw==} engines: {node: '>=20.0.0'} seroval-plugins@1.5.6: resolution: {integrity: sha512-HXuLAX2pu/UByPpaeo/TaMfvMIi+1QqIoPJYCcAtU8QkVNwgR6MPlGuCQTErV1JwraaMbYaWVIBX7mppzGLATQ==} engines: {node: '>=10'} peerDependencies: - seroval: ^1.0 + seroval: ^1.6.10 - seroval@1.5.6: - resolution: {integrity: sha512-rVQVWjjSvlINzaQPZH5JFqsqEsIWdTxY3iJZCnTL/5gQbXIRooVZKI60tVCkOVfzcRPejboxO2t0P89dg5mQaA==} + seroval-plugins@1.6.12: + resolution: {integrity: sha512-+reiwp/lYxiyctSrdvX7OQ1YLrcbWYgBiZrhSFL+V43b0/DGRLNVSDyZINbQe+tWplPOI2fw2dPrdv6hcc09kQ==} engines: {node: '>=10'} + peerDependencies: + seroval: ^1.6.10 + + seroval@1.7.3: + resolution: {integrity: sha512-fYkZS/GrMJhj1CW+IDoPlILRmYl5/S9L/OYju/sA2K/HQ3G5JBWDZHxaUWVZV/0hfAC2n1+9ysBRDtqMbMXvzA==} + engines: {node: '>=20'} serve-placeholder@2.0.2: resolution: {integrity: sha512-/TMG8SboeiQbZJWRlfTCqMs2DD3SZgWp0kDQePz9yUuCnDfDh/92gf7/PxGhzXTKBIPASIHxFcZndoNbp6QOLQ==} @@ -3257,8 +3265,8 @@ packages: resolution: {integrity: sha512-RQsvleCbF8cVHEv+xuDGaA4pOizFqJ0GgjtMSRo6oP8pnN7WsigHgVGey6aILRBKv4W2YOMHLqbKdnB6hpB9fw==} engines: {node: '>=20.0.0'} - solid-js@1.9.14: - resolution: {integrity: sha512-sAEXC0Kk0S1EDg+8ysEWJDbYhA3RRoEjwuySUGlKIemeo0I5YZfOyumNjNs9Sv3y2nmhD+0rW66ag2HsMuQiGQ==} + solid-js@1.9.17: + resolution: {integrity: sha512-4GAmLOWPfNV8H9Jfn2LSFTpNEG6jiOKPiwd5lnLGQtehHaX6l3TOLzJqQ7mqwB/3k1Yy3zyumFVopmc/tm34ow==} solid-refresh@0.6.3: resolution: {integrity: sha512-F3aPsX6hVw9ttm5LYlth8Q15x6MlI/J3Dn+o3EQyRTtTxidepSTwAYdozt01/YA+7ObcciagGEyXIopGZzQtbA==} @@ -3271,8 +3279,8 @@ packages: peerDependencies: solid-js: ^1.7 - source-map-js@1.2.1: - resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==} + source-map-js@1.2.2: + resolution: {integrity: sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==} engines: {node: '>=0.10.0'} source-map-support@0.5.21: @@ -3575,7 +3583,7 @@ packages: rolldown: '*' rollup: '*' unloader: '*' - vite: '*' + vite: ^6.4.4 webpack: '*' peerDependenciesMeta: '@farmfe/core': @@ -3708,13 +3716,13 @@ packages: peerDependencies: '@testing-library/jest-dom': ^5.16.6 || ^5.17.0 || ^6.0.0 || ^7.0.0 solid-js: ^1.7.2 - vite: ^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0 || ^9.0.0 + vite: ^6.4.4 peerDependenciesMeta: '@testing-library/jest-dom': optional: true - vite@6.4.3: - resolution: {integrity: sha512-NTKlcQjlAK7MlQoyb6LgaqHc8sso/pVyUJYWMws3jg21uTJw/LddqIFPcPqP6PzpgbIcZyKI85sFE4HBrQDA8A==} + vite@6.4.5: + resolution: {integrity: sha512-4enwjFfi4IwtEh0w+jPzpLVOFQiPHmmzPxcHXQOyEur47o6u0jE573DmGpjA+7irXoMLYRZD5ZaFUEneS3abPg==} engines: {node: ^18.0.0 || ^20.0.0 || >=22.0.0} hasBin: true peerDependencies: @@ -3756,28 +3764,28 @@ packages: vitefu@1.1.3: resolution: {integrity: sha512-ub4okH7Z5KLjb6hDyjqrGXqWtWvoYdU3IGm/NorpgHncKoLTCfRIbvlhBm7r0YstIaQRYlp4yEbFqDcKSzXSSg==} peerDependencies: - vite: ^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0 + vite: ^6.4.4 peerDependenciesMeta: vite: optional: true - vitest@4.1.10: - resolution: {integrity: sha512-R9jUTe5S4Qb0HCd4TNqpC7oGcrMssMRGXLW80ubjWsW9VH5GF8y1Y0SFLY9AbqSk6nt0PnOx4H4WNJYZ13GUPw==} + vitest@4.1.12: + resolution: {integrity: sha512-5eWdz2yb3ajxWF3C8C4TjkXl7FGm3n2E/VlazALrQHzK7nYMSGFnCZto0bbPNl77AwkOZVLk0YnBAejUu0NiWA==} engines: {node: ^20.0.0 || ^22.0.0 || >=24.0.0} hasBin: true peerDependencies: '@edge-runtime/vm': '*' '@opentelemetry/api': ^1.9.0 '@types/node': ^20.0.0 || ^22.0.0 || >=24.0.0 - '@vitest/browser-playwright': 4.1.10 - '@vitest/browser-preview': 4.1.10 - '@vitest/browser-webdriverio': 4.1.10 - '@vitest/coverage-istanbul': 4.1.10 - '@vitest/coverage-v8': 4.1.10 - '@vitest/ui': 4.1.10 + '@vitest/browser-playwright': 4.1.12 + '@vitest/browser-preview': 4.1.12 + '@vitest/browser-webdriverio': ^4.1.11 + '@vitest/coverage-istanbul': 4.1.12 + '@vitest/coverage-v8': 4.1.12 + '@vitest/ui': 4.1.12 happy-dom: '*' jsdom: '*' - vite: ^6.0.0 || ^7.0.0 || ^8.0.0 + vite: ^6.4.4 peerDependenciesMeta: '@edge-runtime/vm': optional: true @@ -3905,11 +3913,8 @@ packages: peerDependencies: zod: ^3.25.28 || ^4 - zod@3.25.76: - resolution: {integrity: sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==} - - zod@4.4.3: - resolution: {integrity: sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==} + zod@4.6.7: + resolution: {integrity: sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==} zwitch@2.0.4: resolution: {integrity: sha512-bXE4cR/kVZhKZX/RjPEflHaKVhUVl85noU3v6b8apfQEc1x4A+zBxjZ4lN8LqGd6WZ3dl98pY4o717VFmoPp+A==} @@ -4038,78 +4043,73 @@ snapshots: '@babel/helper-string-parser': 7.29.7 '@babel/helper-validator-identifier': 7.29.7 - '@better-auth/api-key@1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)(better-auth@1.7.2(better-sqlite3@13.0.2)(solid-js@1.9.14)(vitest@4.1.10(@types/node@22.20.1)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))))(better-call@1.4.0(zod@3.25.76))': + '@better-auth/api-key@1.7.14(@better-auth/core@1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.1)(better-auth@1.7.14(solid-js@1.9.17)(vitest@4.1.12(@types/node@22.20.1)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))))(better-call@1.4.4(zod@4.6.7))': dependencies: - '@better-auth/core': 1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) - '@better-auth/utils': 0.4.2 - better-auth: 1.7.2(better-sqlite3@13.0.2)(solid-js@1.9.14)(vitest@4.1.10(@types/node@22.20.1)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))) - better-call: 1.4.0(zod@3.25.76) - zod: 4.4.3 + '@better-auth/core': 1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) + '@better-auth/utils': 0.5.1 + better-auth: 1.7.14(solid-js@1.9.17)(vitest@4.1.12(@types/node@22.20.1)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))) + better-call: 1.4.4(zod@4.6.7) + zod: 4.6.7 - '@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1)': + '@better-auth/core@1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1)': dependencies: - '@better-auth/utils': 0.4.2 - '@better-fetch/fetch': 1.3.1 - '@opentelemetry/semantic-conventions': 1.43.0 + '@better-auth/utils': 0.5.1 + '@better-fetch/fetch': 1.3.3 '@standard-schema/spec': 1.1.0 - better-call: 1.4.0(zod@3.25.76) + better-call: 1.4.4(zod@4.6.7) jose: 6.2.4 kysely: 0.29.4 nanostores: 1.4.1 - zod: 4.4.3 + zod: 4.6.7 - '@better-auth/drizzle-adapter@1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)': + '@better-auth/drizzle-adapter@1.7.14(@better-auth/core@1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.1)': dependencies: - '@better-auth/core': 1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) - '@better-auth/utils': 0.4.2 + '@better-auth/core': 1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) + '@better-auth/utils': 0.5.1 - '@better-auth/kysely-adapter@1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)(kysely@0.29.4)': + '@better-auth/kysely-adapter@1.7.14(@better-auth/core@1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.1)(kysely@0.29.4)': dependencies: - '@better-auth/core': 1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) - '@better-auth/utils': 0.4.2 + '@better-auth/core': 1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) + '@better-auth/utils': 0.5.1 optionalDependencies: kysely: 0.29.4 - '@better-auth/memory-adapter@1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)': + '@better-auth/memory-adapter@1.7.14(@better-auth/core@1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.1)': dependencies: - '@better-auth/core': 1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) - '@better-auth/utils': 0.4.2 + '@better-auth/core': 1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) + '@better-auth/utils': 0.5.1 - '@better-auth/mongo-adapter@1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)': + '@better-auth/mongo-adapter@1.7.14(@better-auth/core@1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.1)': dependencies: - '@better-auth/core': 1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) - '@better-auth/utils': 0.4.2 + '@better-auth/core': 1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) + '@better-auth/utils': 0.5.1 - '@better-auth/oauth-provider@1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-auth@1.7.2(better-sqlite3@13.0.2)(solid-js@1.9.14)(vitest@4.1.10(@types/node@22.20.1)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))))(better-call@1.4.0(zod@3.25.76))': + '@better-auth/oauth-provider@1.7.14(@better-auth/core@1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-auth@1.7.14(solid-js@1.9.17)(vitest@4.1.12(@types/node@22.20.1)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))))(better-call@1.4.4(zod@4.6.7))': dependencies: - '@better-auth/core': 1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) - '@better-auth/utils': 0.4.2 - '@better-fetch/fetch': 1.3.1 - better-auth: 1.7.2(better-sqlite3@13.0.2)(solid-js@1.9.14)(vitest@4.1.10(@types/node@22.20.1)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))) - better-call: 1.4.0(zod@3.25.76) + '@better-auth/core': 1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) + '@better-auth/utils': 0.5.1 + '@better-fetch/fetch': 1.3.3 + better-auth: 1.7.14(solid-js@1.9.17)(vitest@4.1.12(@types/node@22.20.1)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))) + better-call: 1.4.4(zod@4.6.7) jose: 6.2.4 - zod: 4.4.3 + zod: 4.6.7 - '@better-auth/prisma-adapter@1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)': + '@better-auth/prisma-adapter@1.7.14(@better-auth/core@1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.1)': dependencies: - '@better-auth/core': 1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) - '@better-auth/utils': 0.4.2 + '@better-auth/core': 1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) + '@better-auth/utils': 0.5.1 - '@better-auth/telemetry@1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)': + '@better-auth/telemetry@1.7.14(@better-auth/core@1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)': dependencies: - '@better-auth/core': 1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) - '@better-auth/utils': 0.4.2 - '@better-fetch/fetch': 1.3.1 + '@better-auth/core': 1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) + '@better-auth/utils': 0.5.1 + '@better-fetch/fetch': 1.3.3 - '@better-auth/utils@0.4.2': + '@better-auth/utils@0.5.1': dependencies: '@noble/hashes': 2.2.0 - '@better-auth/utils@0.5.0': - dependencies: - '@noble/hashes': 2.2.0 - - '@better-fetch/fetch@1.3.1': {} + '@better-fetch/fetch@1.3.3': {} '@cloudflare/kv-asset-handler@0.4.2': {} @@ -4307,7 +4307,7 @@ snapshots: globals: 14.0.0 ignore: 5.3.2 import-fresh: 3.3.1 - js-yaml: 4.3.1 + js-yaml: 4.3.2 minimatch: 3.1.5 strip-json-comments: 3.1.1 transitivePeerDependencies: @@ -4322,9 +4322,9 @@ snapshots: '@eslint/core': 0.17.0 levn: 0.4.1 - '@hono/node-server@2.0.12(hono@4.12.34)': + '@hono/node-server@2.1.5(hono@4.13.14)': dependencies: - hono: 4.12.34 + hono: 4.13.14 '@humanfs/core@0.19.2': dependencies: @@ -4394,9 +4394,9 @@ snapshots: - encoding - supports-color - '@modelcontextprotocol/sdk@1.30.0(supports-color@10.2.2)(zod@3.25.76)': + '@modelcontextprotocol/sdk@1.32.2(supports-color@10.2.2)(zod@4.6.7)': dependencies: - '@hono/node-server': 2.0.12(hono@4.12.34) + '@hono/node-server': 2.1.5(hono@4.13.14) ajv: 8.20.0 ajv-formats: 3.0.1(ajv@8.20.0) content-type: 1.0.5 @@ -4406,13 +4406,13 @@ snapshots: eventsource-parser: 3.1.0 express: 5.2.1(supports-color@10.2.2) express-rate-limit: 8.6.1(express@5.2.1(supports-color@10.2.2))(supports-color@10.2.2) - hono: 4.12.34 + hono: 4.13.14 jose: 6.2.4 json-schema-typed: 8.0.2 pkce-challenge: 5.0.1 raw-body: 3.0.2 - zod: 3.25.76 - zod-to-json-schema: 3.25.2(zod@3.25.76) + zod: 4.6.7 + zod-to-json-schema: 3.25.2(zod@4.6.7) transitivePeerDependencies: - supports-color @@ -4432,8 +4432,6 @@ snapshots: '@nodelib/fs.scandir': 2.1.5 fastq: 1.20.1 - '@opentelemetry/semantic-conventions@1.43.0': {} - '@parcel/watcher-android-arm64@2.6.0': optional: true @@ -4570,7 +4568,7 @@ snapshots: '@rollup/plugin-terser@1.0.0(rollup@4.62.3)': dependencies: - serialize-javascript: 7.0.7 + serialize-javascript: 7.1.4 smob: 1.6.2 terser: 5.49.0 optionalDependencies: @@ -4700,17 +4698,17 @@ snapshots: '@sindresorhus/merge-streams@4.0.0': {} - '@solidjs/meta@0.29.4(solid-js@1.9.14)': + '@solidjs/meta@0.29.4(solid-js@1.9.17)': dependencies: - solid-js: 1.9.14 + solid-js: 1.9.17 - '@solidjs/router@0.15.4(solid-js@1.9.14)': + '@solidjs/router@0.15.4(solid-js@1.9.17)': dependencies: - solid-js: 1.9.14 + solid-js: 1.9.17 - '@solidjs/start@1.3.2(solid-js@1.9.14)(supports-color@10.2.2)(vinxi@0.5.11(@parcel/watcher@2.6.0)(@types/node@22.20.1)(better-sqlite3@13.0.2)(db0@0.3.4(better-sqlite3@13.0.2))(debug@4.4.3(supports-color@10.2.2))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(supports-color@10.2.2)(terser@5.49.0)(yaml@2.9.0))(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))': + '@solidjs/start@1.3.2(solid-js@1.9.17)(supports-color@10.2.2)(vinxi@0.5.11(@parcel/watcher@2.6.0)(@types/node@22.20.1)(better-sqlite3@13.0.2)(db0@0.3.4(better-sqlite3@13.0.2))(debug@4.4.3(supports-color@10.2.2))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(supports-color@10.2.2)(terser@5.49.0)(yaml@2.9.0))(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))': dependencies: - '@tanstack/server-functions-plugin': 1.121.21(supports-color@10.2.2)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) + '@tanstack/server-functions-plugin': 1.121.21(supports-color@10.2.2)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) '@vinxi/plugin-directives': 0.5.1(vinxi@0.5.11(@parcel/watcher@2.6.0)(@types/node@22.20.1)(better-sqlite3@13.0.2)(db0@0.3.4(better-sqlite3@13.0.2))(debug@4.4.3(supports-color@10.2.2))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(supports-color@10.2.2)(terser@5.49.0)(yaml@2.9.0)) '@vinxi/server-components': 0.5.1(vinxi@0.5.11(@parcel/watcher@2.6.0)(@types/node@22.20.1)(better-sqlite3@13.0.2)(db0@0.3.4(better-sqlite3@13.0.2))(debug@4.4.3(supports-color@10.2.2))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(supports-color@10.2.2)(terser@5.49.0)(yaml@2.9.0)) cookie-es: 2.0.1 @@ -4718,14 +4716,14 @@ snapshots: error-stack-parser: 2.1.4 html-to-image: 1.11.13 radix3: 1.1.2 - seroval: 1.5.6 - seroval-plugins: 1.5.6(seroval@1.5.6) + seroval: 1.7.3 + seroval-plugins: 1.5.6(seroval@1.7.3) shiki: 1.29.2 - source-map-js: 1.2.1 - terracotta: 1.1.1(solid-js@1.9.14) + source-map-js: 1.2.2 + terracotta: 1.1.1(solid-js@1.9.17) tinyglobby: 0.2.17 vinxi: 0.5.11(@parcel/watcher@2.6.0)(@types/node@22.20.1)(better-sqlite3@13.0.2)(db0@0.3.4(better-sqlite3@13.0.2))(debug@4.4.3(supports-color@10.2.2))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(supports-color@10.2.2)(terser@5.49.0)(yaml@2.9.0) - vite-plugin-solid: 2.11.14(solid-js@1.9.14)(supports-color@10.2.2)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) + vite-plugin-solid: 2.11.14(solid-js@1.9.17)(supports-color@10.2.2)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) transitivePeerDependencies: - '@testing-library/jest-dom' - solid-js @@ -4736,7 +4734,7 @@ snapshots: '@standard-schema/spec@1.1.0': {} - '@tanstack/directive-functions-plugin@1.121.21(supports-color@10.2.2)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))': + '@tanstack/directive-functions-plugin@1.121.21(supports-color@10.2.2)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))': dependencies: '@babel/code-frame': 7.26.2 '@babel/core': 7.29.7(supports-color@10.2.2) @@ -4745,7 +4743,7 @@ snapshots: '@tanstack/router-utils': 1.162.2(supports-color@10.2.2) babel-dead-code-elimination: 1.0.12(supports-color@10.2.2) tiny-invariant: 1.3.3 - vite: 6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0) + vite: 6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0) transitivePeerDependencies: - supports-color @@ -4762,7 +4760,7 @@ snapshots: transitivePeerDependencies: - supports-color - '@tanstack/server-functions-plugin@1.121.21(supports-color@10.2.2)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))': + '@tanstack/server-functions-plugin@1.121.21(supports-color@10.2.2)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))': dependencies: '@babel/code-frame': 7.26.2 '@babel/core': 7.29.7(supports-color@10.2.2) @@ -4771,7 +4769,7 @@ snapshots: '@babel/template': 7.29.7 '@babel/traverse': 7.29.7(supports-color@10.2.2) '@babel/types': 7.29.7 - '@tanstack/directive-functions-plugin': 1.121.21(supports-color@10.2.2)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) + '@tanstack/directive-functions-plugin': 1.121.21(supports-color@10.2.2)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) babel-dead-code-elimination: 1.0.12(supports-color@10.2.2) tiny-invariant: 1.3.3 transitivePeerDependencies: @@ -4961,7 +4959,7 @@ snapshots: http-shutdown: 1.2.2 jiti: 1.21.7 mlly: 1.8.2 - node-forge: 1.4.0 + node-forge: 1.4.2 pathe: 1.1.2 std-env: 3.10.0 ufo: 1.6.4 @@ -4992,44 +4990,44 @@ snapshots: recast: 0.23.12 vinxi: 0.5.11(@parcel/watcher@2.6.0)(@types/node@22.20.1)(better-sqlite3@13.0.2)(db0@0.3.4(better-sqlite3@13.0.2))(debug@4.4.3(supports-color@10.2.2))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(supports-color@10.2.2)(terser@5.49.0)(yaml@2.9.0) - '@vitest/expect@4.1.10': + '@vitest/expect@4.1.12': dependencies: '@standard-schema/spec': 1.1.0 '@types/chai': 5.2.3 - '@vitest/spy': 4.1.10 - '@vitest/utils': 4.1.10 + '@vitest/spy': 4.1.12 + '@vitest/utils': 4.1.12 chai: 6.2.2 tinyrainbow: 3.1.1 - '@vitest/mocker@4.1.10(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))': + '@vitest/mocker@4.1.12(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))': dependencies: - '@vitest/spy': 4.1.10 + '@vitest/spy': 4.1.12 estree-walker: 3.0.3 magic-string: 0.30.21 optionalDependencies: - vite: 6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0) + vite: 6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0) - '@vitest/pretty-format@4.1.10': + '@vitest/pretty-format@4.1.12': dependencies: tinyrainbow: 3.1.1 - '@vitest/runner@4.1.10': + '@vitest/runner@4.1.12': dependencies: - '@vitest/utils': 4.1.10 + '@vitest/utils': 4.1.12 pathe: 2.0.3 - '@vitest/snapshot@4.1.10': + '@vitest/snapshot@4.1.12': dependencies: - '@vitest/pretty-format': 4.1.10 - '@vitest/utils': 4.1.10 + '@vitest/pretty-format': 4.1.12 + '@vitest/utils': 4.1.12 magic-string: 0.30.21 pathe: 2.0.3 - '@vitest/spy@4.1.10': {} + '@vitest/spy@4.1.12': {} - '@vitest/utils@4.1.10': + '@vitest/utils@4.1.12': dependencies: - '@vitest/pretty-format': 4.1.10 + '@vitest/pretty-format': 4.1.12 convert-source-map: 2.0.0 tinyrainbow: 3.1.1 @@ -5078,7 +5076,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.7 + fast-uri: 3.1.9 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -5161,12 +5159,12 @@ snapshots: html-entities: 2.3.3 parse5: 7.3.0 - babel-preset-solid@1.9.12(@babel/core@7.29.7(supports-color@10.2.2))(solid-js@1.9.14): + babel-preset-solid@1.9.12(@babel/core@7.29.7(supports-color@10.2.2))(solid-js@1.9.17): dependencies: '@babel/core': 7.29.7(supports-color@10.2.2) babel-plugin-jsx-dom-expressions: 0.40.7(@babel/core@7.29.7(supports-color@10.2.2)) optionalDependencies: - solid-js: 1.9.14 + solid-js: 1.9.17 balanced-match@1.0.2: {} @@ -5203,50 +5201,39 @@ snapshots: baseline-browser-mapping@2.11.6: {} - better-auth@1.7.2(better-sqlite3@13.0.2)(solid-js@1.9.14)(vitest@4.1.10(@types/node@22.20.1)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))): - dependencies: - '@better-auth/core': 1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) - '@better-auth/drizzle-adapter': 1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2) - '@better-auth/kysely-adapter': 1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)(kysely@0.29.4) - '@better-auth/memory-adapter': 1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2) - '@better-auth/mongo-adapter': 1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2) - '@better-auth/prisma-adapter': 1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2) - '@better-auth/telemetry': 1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1) - '@better-auth/utils': 0.4.2 - '@better-fetch/fetch': 1.3.1 + better-auth@1.7.14(solid-js@1.9.17)(vitest@4.1.12(@types/node@22.20.1)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))): + dependencies: + '@better-auth/core': 1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) + '@better-auth/drizzle-adapter': 1.7.14(@better-auth/core@1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.1) + '@better-auth/kysely-adapter': 1.7.14(@better-auth/core@1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.1)(kysely@0.29.4) + '@better-auth/memory-adapter': 1.7.14(@better-auth/core@1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.1) + '@better-auth/mongo-adapter': 1.7.14(@better-auth/core@1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.1) + '@better-auth/prisma-adapter': 1.7.14(@better-auth/core@1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.1) + '@better-auth/telemetry': 1.7.14(@better-auth/core@1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3) + '@better-auth/utils': 0.5.1 + '@better-fetch/fetch': 1.3.3 '@noble/ciphers': 2.2.0 '@noble/hashes': 2.2.0 - better-call: 1.4.0(zod@4.4.3) + better-call: 1.4.4(zod@4.6.7) defu: 6.1.7 jose: 6.2.4 kysely: 0.29.4 nanostores: 1.4.1 - zod: 4.4.3 + zod: 4.6.7 optionalDependencies: - better-sqlite3: 13.0.2 - solid-js: 1.9.14 - vitest: 4.1.10(@types/node@22.20.1)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) + solid-js: 1.9.17 + vitest: 4.1.12(@types/node@22.20.1)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) transitivePeerDependencies: - - '@cloudflare/workers-types' - '@opentelemetry/api' - better-call@1.4.0(zod@3.25.76): + better-call@1.4.4(zod@4.6.7): dependencies: - '@better-auth/utils': 0.5.0 - '@better-fetch/fetch': 1.3.1 + '@better-auth/utils': 0.5.1 + '@better-fetch/fetch': 1.3.3 rou3: 0.9.2 set-cookie-parser: 3.1.2 optionalDependencies: - zod: 3.25.76 - - better-call@1.4.0(zod@4.4.3): - dependencies: - '@better-auth/utils': 0.5.0 - '@better-fetch/fetch': 1.3.1 - rou3: 0.9.2 - set-cookie-parser: 3.1.2 - optionalDependencies: - zod: 4.4.3 + zod: 4.6.7 better-sqlite3@12.11.1: dependencies: @@ -5267,15 +5254,15 @@ snapshots: inherits: 2.0.4 readable-stream: 3.6.2 - body-parser@2.3.0(supports-color@10.2.2): + body-parser@2.4.0(supports-color@10.2.2): dependencies: bytes: 3.1.2 - content-type: 2.0.0 + content-type: 2.1.0 debug: 4.4.3(supports-color@10.2.2) http-errors: 2.0.1 iconv-lite: 0.7.3 on-finished: 2.4.1 - qs: 6.16.0 + qs: 6.17.0 raw-body: 3.0.2 type-is: 2.1.0 transitivePeerDependencies: @@ -5292,7 +5279,7 @@ snapshots: widest-line: 5.0.0 wrap-ansi: 9.0.2 - brace-expansion@2.1.4: + brace-expansion@2.1.7: dependencies: balanced-match: 1.0.2 @@ -5446,6 +5433,8 @@ snapshots: content-type@2.0.0: {} + content-type@2.1.0: {} + convert-source-map@2.0.0: {} cookie-es@1.2.3: {} @@ -5815,14 +5804,14 @@ snapshots: dependencies: debug: 4.4.3(supports-color@10.2.2) express: 5.2.1(supports-color@10.2.2) - ip-address: 10.3.1 + ip-address: 10.7.5 transitivePeerDependencies: - supports-color express@5.2.1(supports-color@10.2.2): dependencies: accepts: 2.0.0 - body-parser: 2.3.0(supports-color@10.2.2) + body-parser: 2.4.0(supports-color@10.2.2) content-disposition: 1.1.0 content-type: 1.0.5 cookie: 0.7.2 @@ -5840,8 +5829,8 @@ snapshots: on-finished: 2.4.1 once: 1.4.0 parseurl: 1.3.3 - proxy-addr: 2.0.7 - qs: 6.16.0 + proxy-addr: 2.0.8 + qs: 6.17.0 range-parser: 1.3.0 router: 2.2.0(supports-color@10.2.2) send: 1.2.1(supports-color@10.2.2) @@ -5870,7 +5859,7 @@ snapshots: fast-levenshtein@2.0.6: {} - fast-uri@3.1.7: {} + fast-uri@3.1.9: {} fastq@1.20.1: dependencies: @@ -5919,7 +5908,7 @@ snapshots: flatted@3.4.4: {} - follow-redirects@1.16.0(debug@4.4.3(supports-color@10.2.2)): + follow-redirects@1.16.2(debug@4.4.3(supports-color@10.2.2)): optionalDependencies: debug: 4.4.3(supports-color@10.2.2) @@ -6063,7 +6052,7 @@ snapshots: dependencies: '@types/hast': 3.0.5 - hono@4.12.34: {} + hono@4.13.14: {} hookable@5.5.3: {} @@ -6086,7 +6075,7 @@ snapshots: http-proxy@1.18.1(debug@4.4.3(supports-color@10.2.2)): dependencies: eventemitter3: 4.0.7 - follow-redirects: 1.16.0(debug@4.4.3(supports-color@10.2.2)) + follow-redirects: 1.16.2(debug@4.4.3(supports-color@10.2.2)) requires-port: 1.0.0 transitivePeerDependencies: - debug @@ -6141,7 +6130,7 @@ snapshots: transitivePeerDependencies: - supports-color - ip-address@10.3.1: {} + ip-address@10.7.5: {} ipaddr.js@1.9.1: {} @@ -6225,7 +6214,7 @@ snapshots: js-tokens@9.0.1: {} - js-yaml@4.3.1: + js-yaml@4.3.2: dependencies: argparse: 2.0.1 @@ -6279,7 +6268,7 @@ snapshots: h3: 1.15.11 http-shutdown: 1.2.2 jiti: 2.7.0 - node-forge: 1.4.0 + node-forge: 1.4.2 pathe: 2.0.3 std-env: 4.2.0 tinyclip: 0.1.15 @@ -6327,7 +6316,7 @@ snapshots: dependencies: '@babel/parser': 7.29.7 '@babel/types': 7.29.7 - source-map-js: 1.2.1 + source-map-js: 1.2.2 math-intrinsics@1.1.0: {} @@ -6395,19 +6384,19 @@ snapshots: minimatch@10.2.6: dependencies: - brace-expansion: 2.1.4 + brace-expansion: 2.1.7 minimatch@3.1.5: dependencies: - brace-expansion: 2.1.4 + brace-expansion: 2.1.7 minimatch@5.1.9: dependencies: - brace-expansion: 2.1.4 + brace-expansion: 2.1.7 minimatch@9.0.9: dependencies: - brace-expansion: 2.1.4 + brace-expansion: 2.1.7 minimist@1.2.8: {} @@ -6440,7 +6429,7 @@ snapshots: negotiator@1.0.0: {} - nitropack@2.13.4(@parcel/watcher@2.6.0)(better-sqlite3@13.0.2)(supports-color@10.2.2)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)): + nitropack@2.13.4(@parcel/watcher@2.6.0)(better-sqlite3@13.0.2)(supports-color@10.2.2)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)): dependencies: '@cloudflare/kv-asset-handler': 0.4.2 '@rollup/plugin-alias': 6.0.0(rollup@4.62.3) @@ -6505,7 +6494,7 @@ snapshots: uncrypto: 0.1.3 unctx: 2.5.0 unenv: 2.0.0-rc.24 - unimport: 6.3.1(esbuild@0.28.1)(rollup@4.62.3)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) + unimport: 6.3.1(esbuild@0.28.1)(rollup@4.62.3)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) unplugin-utils: 0.3.2 unstorage: 1.17.5(db0@0.3.4(better-sqlite3@13.0.2))(ioredis@5.11.1(supports-color@10.2.2)) untyped: 2.0.0 @@ -6566,7 +6555,7 @@ snapshots: dependencies: whatwg-url: 5.0.0 - node-forge@1.4.0: {} + node-forge@1.4.2: {} node-gyp-build@4.8.4: {} @@ -6726,7 +6715,7 @@ snapshots: dependencies: nanoid: 3.3.18 picocolors: 1.1.1 - source-map-js: 1.2.1 + source-map-js: 1.2.2 powershell-utils@0.1.0: {} @@ -6759,7 +6748,7 @@ snapshots: property-information@7.2.0: {} - proxy-addr@2.0.7: + proxy-addr@2.0.8: dependencies: forwarded: 0.2.0 ipaddr.js: 1.9.1 @@ -6771,7 +6760,7 @@ snapshots: punycode@2.3.1: {} - qs@6.16.0: + qs@6.17.0: dependencies: es-define-property: 1.0.1 side-channel: 1.1.1 @@ -6983,13 +6972,17 @@ snapshots: transitivePeerDependencies: - supports-color - serialize-javascript@7.0.7: {} + serialize-javascript@7.1.4: {} - seroval-plugins@1.5.6(seroval@1.5.6): + seroval-plugins@1.5.6(seroval@1.7.3): dependencies: - seroval: 1.5.6 + seroval: 1.7.3 - seroval@1.5.6: {} + seroval-plugins@1.6.12(seroval@1.7.3): + dependencies: + seroval: 1.7.3 + + seroval@1.7.3: {} serve-placeholder@2.0.2: dependencies: @@ -7078,26 +7071,26 @@ snapshots: smob@1.6.2: {} - solid-js@1.9.14: + solid-js@1.9.17: dependencies: csstype: 3.2.3 - seroval: 1.5.6 - seroval-plugins: 1.5.6(seroval@1.5.6) + seroval: 1.7.3 + seroval-plugins: 1.6.12(seroval@1.7.3) - solid-refresh@0.6.3(solid-js@1.9.14)(supports-color@10.2.2): + solid-refresh@0.6.3(solid-js@1.9.17)(supports-color@10.2.2): dependencies: '@babel/generator': 7.29.7 '@babel/helper-module-imports': 7.29.7(supports-color@10.2.2) '@babel/types': 7.29.7 - solid-js: 1.9.14 + solid-js: 1.9.17 transitivePeerDependencies: - supports-color - solid-use@0.9.1(solid-js@1.9.14): + solid-use@0.9.1(solid-js@1.9.17): dependencies: - solid-js: 1.9.14 + solid-js: 1.9.17 - source-map-js@1.2.1: {} + source-map-js@1.2.2: {} source-map-support@0.5.21: dependencies: @@ -7244,10 +7237,10 @@ snapshots: - bare-abort-controller - react-native-b4a - terracotta@1.1.1(solid-js@1.9.14): + terracotta@1.1.1(solid-js@1.9.17): dependencies: - solid-js: 1.9.14 - solid-use: 0.9.1(solid-js@1.9.14) + solid-js: 1.9.17 + solid-use: 0.9.1(solid-js@1.9.17) terser@5.49.0: dependencies: @@ -7359,7 +7352,7 @@ snapshots: unicorn-magic@0.4.0: {} - unimport@6.3.1(esbuild@0.28.1)(rollup@4.62.3)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)): + unimport@6.3.1(esbuild@0.28.1)(rollup@4.62.3)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)): dependencies: acorn: 8.18.0 escape-string-regexp: 5.0.0 @@ -7373,7 +7366,7 @@ snapshots: scule: 1.3.0 strip-literal: 3.1.0 tinyglobby: 0.2.17 - unplugin: 3.3.0(esbuild@0.28.1)(rollup@4.62.3)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) + unplugin: 3.3.0(esbuild@0.28.1)(rollup@4.62.3)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) unplugin-utils: 0.3.2 transitivePeerDependencies: - '@farmfe/core' @@ -7422,7 +7415,7 @@ snapshots: picomatch: 4.0.5 webpack-virtual-modules: 0.6.2 - unplugin@3.3.0(esbuild@0.28.1)(rollup@4.62.3)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)): + unplugin@3.3.0(esbuild@0.28.1)(rollup@4.62.3)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)): dependencies: '@jridgewell/remapping': 2.3.5 picomatch: 4.0.5 @@ -7430,7 +7423,7 @@ snapshots: optionalDependencies: esbuild: 0.28.1 rollup: 4.62.3 - vite: 6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0) + vite: 6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0) unstorage@1.17.5(db0@0.3.4(better-sqlite3@13.0.2))(ioredis@5.11.1(supports-color@10.2.2)): dependencies: @@ -7518,7 +7511,7 @@ snapshots: hookable: 5.5.3 http-proxy: 1.18.1(debug@4.4.3(supports-color@10.2.2)) micromatch: 4.0.8 - nitropack: 2.13.4(@parcel/watcher@2.6.0)(better-sqlite3@13.0.2)(supports-color@10.2.2)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) + nitropack: 2.13.4(@parcel/watcher@2.6.0)(better-sqlite3@13.0.2)(supports-color@10.2.2)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) node-fetch-native: 1.6.7 path-to-regexp: 6.3.0 pathe: 1.1.2 @@ -7531,8 +7524,8 @@ snapshots: unctx: 2.5.0 unenv: 1.10.0 unstorage: 1.17.5(db0@0.3.4(better-sqlite3@13.0.2))(ioredis@5.11.1(supports-color@10.2.2)) - vite: 6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0) - zod: 4.4.3 + vite: 6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0) + zod: 4.6.7 transitivePeerDependencies: - '@azure/app-configuration' - '@azure/cosmos' @@ -7587,20 +7580,20 @@ snapshots: - xml2js - yaml - vite-plugin-solid@2.11.14(solid-js@1.9.14)(supports-color@10.2.2)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)): + vite-plugin-solid@2.11.14(solid-js@1.9.17)(supports-color@10.2.2)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)): dependencies: '@babel/core': 7.29.7(supports-color@10.2.2) '@types/babel__core': 7.20.5 - babel-preset-solid: 1.9.12(@babel/core@7.29.7(supports-color@10.2.2))(solid-js@1.9.14) + babel-preset-solid: 1.9.12(@babel/core@7.29.7(supports-color@10.2.2))(solid-js@1.9.17) merge-anything: 5.1.7 - solid-js: 1.9.14 - solid-refresh: 0.6.3(solid-js@1.9.14)(supports-color@10.2.2) - vite: 6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0) - vitefu: 1.1.3(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) + solid-js: 1.9.17 + solid-refresh: 0.6.3(solid-js@1.9.17)(supports-color@10.2.2) + vite: 6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0) + vitefu: 1.1.3(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) transitivePeerDependencies: - supports-color - vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0): + vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0): dependencies: esbuild: 0.25.12 fdir: 6.5.0(picomatch@4.0.5) @@ -7615,19 +7608,19 @@ snapshots: terser: 5.49.0 yaml: 2.9.0 - vitefu@1.1.3(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)): + vitefu@1.1.3(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)): optionalDependencies: - vite: 6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0) + vite: 6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0) - vitest@4.1.10(@types/node@22.20.1)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)): + vitest@4.1.12(@types/node@22.20.1)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)): dependencies: - '@vitest/expect': 4.1.10 - '@vitest/mocker': 4.1.10(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) - '@vitest/pretty-format': 4.1.10 - '@vitest/runner': 4.1.10 - '@vitest/snapshot': 4.1.10 - '@vitest/spy': 4.1.10 - '@vitest/utils': 4.1.10 + '@vitest/expect': 4.1.12 + '@vitest/mocker': 4.1.12(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) + '@vitest/pretty-format': 4.1.12 + '@vitest/runner': 4.1.12 + '@vitest/snapshot': 4.1.12 + '@vitest/spy': 4.1.12 + '@vitest/utils': 4.1.12 es-module-lexer: 2.3.1 expect-type: 1.4.0 magic-string: 0.30.21 @@ -7639,7 +7632,7 @@ snapshots: tinyexec: 1.3.0 tinyglobby: 0.2.17 tinyrainbow: 3.1.1 - vite: 6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0) + vite: 6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0) why-is-node-running: 2.3.0 optionalDependencies: '@types/node': 22.20.1 @@ -7743,12 +7736,10 @@ snapshots: compress-commons: 6.0.2 readable-stream: 4.7.0 - zod-to-json-schema@3.25.2(zod@3.25.76): + zod-to-json-schema@3.25.2(zod@4.6.7): dependencies: - zod: 3.25.76 - - zod@3.25.76: {} + zod: 4.6.7 - zod@4.4.3: {} + zod@4.6.7: {} zwitch@2.0.4: {} diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index ac69e699..77ed0857 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -11,10 +11,21 @@ minimumReleaseAgeExclude: # framework targets rather than jumping to an RC. overrides: h3: ^1.15.11 # path traversal, SSE injection, request smuggling - hono: ^4.12.34 # ReDoS in CORS middleware - fast-uri: ^3.1.6 # host confusion via backslash; 3.1.6 also clears the four 2026 URI-parsing advisories (#62) - qs: ^6.16.0 # prototype pollution and DoS in query parsing, reached only through the MCP SDK's Express (#62) - brace-expansion: ^2.1.4 # DoS via unbounded intermediate arrays + hono: ^4.13.11 # ReDoS in CORS middleware; 4.13.11 also clears parseBody, query, serveStatic and JSX advisories + "@hono/node-server": ^2.1.3 # serveStatic double-decodes the request path + fast-uri: ^3.1.9 # host confusion, scheme spoofing and path equivalence in URI parsing (#62) + qs: ^6.16.1 # prototype pollution and DoS in query parsing, reached only through the MCP SDK's Express (#62) + brace-expansion: ^2.1.7 # DoS via recursion and quadratic expansion + seroval: ^1.6.10 # deserialization of attacker-chosen callables, DoS, script injection + proxy-addr: ^2.0.8 # IP spoofing via IPv4-mapped IPv6 trust check + body-parser: ^2.4.0 # DoS via trailing bytes + ip-address: ^10.7.4 # subnet and link-local misclassification, quadratic zone parsing + vite: ^6.4.4 # fs.allow bypass and launch-editor advisories in the dev server + follow-redirects: ^1.16.1 # cross-origin credential leak on redirect + node-forge: ^1.4.1 # RSA PKCS#1 v1.5 signature forgery + source-map-js: ^1.2.2 # event-loop DoS on crafted source maps + serialize-javascript: ^7.1.3 # XSS via unescaped input + js-yaml@4: ^4.3.2 # CPU DoS via merge keys (ESLint config loader) nanoid: ^3.3.17 # custom generators loop forever when size is zero # CI fails on a high or critical advisory in a production dependency. An diff --git a/src/routes/api/rpc/[fn].ts b/src/routes/api/rpc/[fn].ts index 8703ee55..bd58bce1 100644 --- a/src/routes/api/rpc/[fn].ts +++ b/src/routes/api/rpc/[fn].ts @@ -191,8 +191,11 @@ export async function POST(event: APIEvent) { // // Resolved for every procedure, not only the protected ones, because the // answer also decides whether this request is throttled. A request with no - // cookie never reaches the database for it. - const { auth } = await import("~/server/auth"); + // cookie never reaches the database for it. Better Auth does check the + // schema on every call, though, so the tables must exist first: on a fresh + // instance this can be the first request to reach auth at all. + const { auth, runAuthMigrations } = await import("~/server/auth"); + await runAuthMigrations(); const session = await auth.api.getSession({ headers: event.request.headers }); if (!session) { diff --git a/src/server/auth-upgrade.test.ts b/src/server/auth-upgrade.test.ts index 8d1b1439..66189b3d 100644 --- a/src/server/auth-upgrade.test.ts +++ b/src/server/auth-upgrade.test.ts @@ -3,11 +3,13 @@ import fs from "node:fs"; import os from "node:os"; import path from "node:path"; -// The 1.6 → 1.7 upgrade, on the database an existing deployment has: one -// admin row in an account table without the `issuer` column 1.7 requires. -// Better Auth's migrator refuses to add a required column to a populated -// table, so without the backfill in runAuthMigrations every upgraded -// instance threw at boot and could not sign in. Reproduced before the fix. +// Upgrades to the current Better Auth, from the account tables deployments +// have in the field. 1.6 had no `issuer` column. 1.7.0–1.7.2 added one, NOT +// NULL with a unique index; NoteMesh 1.3.0 backfilled it with a default on +// databases upgraded from 1.6. Later 1.7 releases dropped it and refuse to +// boot while a NOT NULL column they never write is present, so every +// deployment created on 1.3.0 threw at boot and could not sign in. +// Reproduced against a database written by 1.7.2 before the fix. let root: string; @@ -30,47 +32,77 @@ async function boot() { return auth; } -/** Turn a fresh 1.7 account table into the shape 1.6 left behind. */ -async function reshapeTo16() { +const KEPT = `id, accountId, providerId, userId, accessToken, refreshToken, idToken, + accessTokenExpiresAt, refreshTokenExpiresAt, scope, password, createdAt, updatedAt`; + +/** Rebuild the account table with the given `issuer` column definition and indexes. */ +async function reshape(issuer: string | null, indexes: string[] = []) { const { db } = await import("./db"); const d = db(); d.exec(` - CREATE TABLE account_16 AS SELECT id, accountId, providerId, userId, accessToken, refreshToken, idToken, - accessTokenExpiresAt, refreshTokenExpiresAt, scope, password, createdAt, updatedAt FROM account; + CREATE TABLE account_old AS SELECT * FROM account; DROP TABLE account; - ALTER TABLE account_16 RENAME TO account; + CREATE TABLE account ("id" text not null primary key, ${issuer ? `"issuer" ${issuer},` : ""} + "accountId" text not null, "providerId" text not null, + "userId" text not null references "user" ("id") on delete cascade, + "accessToken" text, "refreshToken" text, "idToken" text, "accessTokenExpiresAt" date, + "refreshTokenExpiresAt" date, "scope" text, "password" text, "createdAt" date not null, + "updatedAt" date not null); + INSERT INTO account (${issuer ? "issuer, " : ""}${KEPT}) + SELECT ${issuer ? "'local:credential', " : ""}${KEPT} FROM account_old; + DROP TABLE account_old; + CREATE INDEX "account_userId_idx" on "account" ("userId"); + ${indexes.join(";\n")} `); - const columns = (d.prepare("PRAGMA table_info(account)").all() as { name: string }[]).map((c) => c.name); - expect(columns).not.toContain("issuer"); return d; } -describe("upgrading a claimed 1.6 database", () => { - it("migrates, backfills the issuer, and the admin can still sign in", async () => { - const auth = await boot(); - await auth.api.signUpEmail({ - body: { email: "admin@example.com", password: "the-original-password", name: "Admin" }, - }); - const d = await reshapeTo16(); +const columns = (d: { prepare(sql: string): { all(): unknown[] } }) => + (d.prepare("PRAGMA table_info(account)").all() as { name: string }[]).map((c) => c.name); + +async function signUp() { + const auth = await boot(); + await auth.api.signUpEmail({ + body: { email: "admin@example.com", password: "the-original-password", name: "Admin" }, + }); +} + +async function expectSignIn(auth: Awaited>) { + const res = await auth.api.signInEmail({ + body: { email: "admin@example.com", password: "the-original-password" }, + }); + expect(res.user.email).toBe("admin@example.com"); +} +describe("upgrading the account table", () => { + it("drops the issuer column and index a 1.7.2 database has, and the admin can still sign in", async () => { + await signUp(); + const d = await reshape("text not null", [ + 'CREATE UNIQUE INDEX "account_issuer_accountId_uidx" on "account" ("issuer", "accountId")', + ]); const log = vi.spyOn(console, "log").mockImplementation(() => {}); const upgraded = await boot(); - expect(log).toHaveBeenCalledWith(expect.stringMatching(/added issuer/)); - expect(d.prepare("SELECT issuer FROM account").all()).toEqual([{ issuer: "local:credential" }]); + expect(log).toHaveBeenCalledWith(expect.stringMatching(/removed issuer/)); + expect(columns(d)).not.toContain("issuer"); + await expectSignIn(upgraded); + }); - const res = await upgraded.api.signInEmail({ - body: { email: "admin@example.com", password: "the-original-password" }, - }); - expect(res.user.email).toBe("admin@example.com"); + it("drops the column NoteMesh 1.3.0 backfilled on a database upgraded from 1.6", async () => { + await signUp(); + const d = await reshape("text not null default 'local:credential'", [ + 'CREATE UNIQUE INDEX "account_issuer_accountId_uidx" on "account" ("issuer", "accountId")', + ]); + const upgraded = await boot(); + expect(columns(d)).not.toContain("issuer"); + await expectSignIn(upgraded); }); - it("leaves a database that already has the column alone", async () => { - const auth = await boot(); - await auth.api.signUpEmail({ - body: { email: "admin@example.com", password: "the-original-password", name: "Admin" }, - }); + it("boots a 1.6 database, which never had the column", async () => { + await signUp(); + await reshape(null); const log = vi.spyOn(console, "log").mockImplementation(() => {}); - await boot(); - expect(log).not.toHaveBeenCalledWith(expect.stringMatching(/added issuer/)); + const upgraded = await boot(); + expect(log).not.toHaveBeenCalledWith(expect.stringMatching(/removed issuer/)); + await expectSignIn(upgraded); }); }); diff --git a/src/server/auth.ts b/src/server/auth.ts index c74d0b17..5104ff7b 100644 --- a/src/server/auth.ts +++ b/src/server/auth.ts @@ -253,28 +253,37 @@ let migrated = false; // Creates/updates Better Auth's own tables (user, session, account, // apikey, OAuth client/token tables) inside app.sqlite. Runs once per boot. -// Better Auth 1.7 added `issuer` to the account table: NOT NULL, no default. -// Its migrator refuses to add such a column to a populated table rather than -// invent a value, so a deployment upgraded from 1.6 — one admin row — would -// throw here on every boot and never sign in again. This server knows the -// value: every account it creates is an email-and-password one, which 1.7 -// records as "local:credential". Added with that backfill before the -// migrator runs, so it finds the column present and only adds its index. -// Reproduced and pinned against a 1.6-shaped populated table in -// auth-upgrade.test.ts. -function backfillAccountIssuer(): void { +// Better Auth 1.7.0–1.7.2 added a required `issuer` column to the account +// table, with a unique index on (issuer, accountId); later 1.7 releases took +// it out again. They never write it, and refuse to boot while the store has a +// NOT NULL column they don't write, so every deployment created on those +// versions would throw here and never sign in again. Deployments upgraded +// from 1.6 got the column from an earlier version of this function, with a +// default. Either way the value carries nothing: every account this server +// creates is an email-and-password one, recorded as "local:credential". So +// the index and the column come out before the migrator runs. Reproduced +// against a database written by 1.7.2 and pinned in auth-upgrade.test.ts. +function dropAccountIssuer(): void { const d = db(); const table = d.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'account'").get(); if (!table) return; const columns = d.prepare("PRAGMA table_info(account)").all() as { name: string }[]; - if (columns.some((c) => c.name === "issuer")) return; - d.exec("ALTER TABLE account ADD COLUMN issuer TEXT NOT NULL DEFAULT 'local:credential'"); - console.log("[auth] account table: added issuer for the Better Auth 1.7 upgrade"); + if (!columns.some((c) => c.name === "issuer")) return; + const indexes = d.prepare("PRAGMA index_list(account)").all() as { name: string; origin: string }[]; + d.transaction(() => { + for (const { name, origin } of indexes) { + if (origin !== "c") continue; + const cols = d.prepare("SELECT name FROM pragma_index_info(?)").all(name) as { name: string }[]; + if (cols.some((c) => c.name === "issuer")) d.exec(`DROP INDEX "${name.replaceAll('"', '""')}"`); + } + d.exec("ALTER TABLE account DROP COLUMN issuer"); + })(); + console.log("[auth] account table: removed issuer, which Better Auth no longer uses"); } export async function runAuthMigrations() { if (migrated) return; - backfillAccountIssuer(); + dropAccountIssuer(); const { runMigrations } = await getMigrations(auth.options); await runMigrations(); // The guard on the user table can only be created once Better Auth has diff --git a/src/server/mcp/server.ts b/src/server/mcp/server.ts index db38cd3c..fa2e35fd 100644 --- a/src/server/mcp/server.ts +++ b/src/server/mcp/server.ts @@ -268,7 +268,7 @@ export function createMcpServer(access: McpAccess, req: RequestInfo = {}): McpSe // Reported to every client on connect, so it is the deployment's version // rather than a number that happens to live here. A test keeps it in step // with package.json. - version: "1.3.0", + version: "1.3.1", }); const writable = access.write;