From 5549da23f7c7e94e7e64e4487a02af80b9607c71 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 29 Oct 2026 19:54:19 +0000 Subject: [PATCH 1/3] Clear dependency security advisories pnpm audit reported 54 advisories (3 critical, 19 high). 53 are cleared: - better-auth and plugins 1.7.2 -> 1.7.14, @modelcontextprotocol/sdk -> 1.32.2, solid-js -> 1.9.17, vitest -> 4.1.12, zod 3 -> 4.6.7 - pnpm overrides for transitive fixes (hono, @hono/node-server, fast-uri, qs, brace-expansion, seroval, proxy-addr, body-parser, ip-address, vite, follow-redirects, node-forge, source-map-js, serialize-javascript, js-yaml) The low-severity deepmerge advisory has no fixed release. Better Auth 1.7.3+ dropped the account.issuer column that 1.7.0-1.7.2 required and refuses to boot while it is present, which would have broken every deployment created on NoteMesh 1.3.0. The server now drops the column and its index before migrating. Reproduced against a database written by 1.7.2; tests cover the 1.7.2, backfilled-1.6 and 1.6 shapes. Better Auth also now validates the schema on every API call, so the RPC gate runs auth migrations before getSession, as the other entry points do. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01CgKUWtS6SvWsfLoeX4snXa --- CHANGELOG.md | 28 ++ package.json | 16 +- pnpm-lock.yaml | 685 ++++++++++++++++---------------- pnpm-workspace.yaml | 19 +- src/routes/api/rpc/[fn].ts | 7 +- src/server/auth-upgrade.test.ts | 96 +++-- src/server/auth.ts | 37 +- 7 files changed, 481 insertions(+), 407 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 67355bde..bd276d86 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -44,6 +44,34 @@ Two labels appear inside entries: If a release is quiet, that is the information. The intent is that the rare entry needing your attention cannot get lost among routine ones. +## Unreleased + +**Taking this update:** redeploy. Nothing else. + +### Fixed + +- **Security** — dependencies updated to clear 53 of the 54 advisories `pnpm + audit` reported (3 critical, 19 high). The ones that reach the running + server: Better Auth to 1.7.14 (OAuth state reusable as a magic link; OAuth + proxy sign-in as another user), the MCP SDK to 1.32 (bearer-token and + per-session checks in the HTTP transport), seroval (deserialization of + attacker-chosen callables), and Express's `proxy-addr` and `body-parser` + (IP spoofing, DoS). zod moves to 4. The rest are build and test tooling. + The one left, a low-severity `deepmerge` advisory used only at build time, + has no fixed release yet. + +- **Upgrade safety** — Better Auth 1.7.3 and later remove the account table's + `issuer` column, which 1.7.0–1.7.2 required, and refuse to start while it + is there. Every deployment set up on 1.3.0 has it. The server now drops the + column and its index before migrating; the value was the same constant on + every row here, so nothing is lost. Tested against a database written by + 1.3.0 and one upgraded from 1.2. + +- Better Auth now checks the database schema on every call. The dashboard's + request gate called it before the auth tables were created, so on a + brand-new instance its first request would have failed with a 500. The gate + now creates the tables first, as every other entry point already did. + ## 1.3.0 — 2026-09-09 **Taking this update:** redeploy, then restart or reconnect your MCP client so it diff --git a/package.json b/package.json index 2324ebe9..385db399 100644 --- a/package.json +++ b/package.json @@ -1,7 +1,7 @@ { "name": "notemesh", "version": "1.3.0", - "description": "Personal Obsidian vault MCP server — Railway template", + "description": "Personal Obsidian vault MCP server \u2014 Railway template", "type": "module", "private": true, "packageManager": "pnpm@11.16.0", @@ -19,24 +19,24 @@ "test:watch": "vitest" }, "dependencies": { - "@better-auth/api-key": "1.7.2", - "@better-auth/oauth-provider": "1.7.2", - "@modelcontextprotocol/sdk": "^1.30.0", + "@better-auth/api-key": "1.7.14", + "@better-auth/oauth-provider": "1.7.14", + "@modelcontextprotocol/sdk": "^1.32.2", "@picocss/pico": "^2.1.1", "@solidjs/meta": "^0.29.4", "@solidjs/router": "^0.15.3", "@solidjs/start": "^1.3.2", - "better-auth": "1.7.2", + "better-auth": "1.7.14", "better-sqlite3": "^13.0.2", "chokidar": "^5.0.0", "execa": "^10.0.0", "fetch-to-node": "^2.1.0", "jose": "^6.2.4", "obsidian-headless": "0.0.14", - "solid-js": "^1.9.7", + "solid-js": "^1.9.17", "vinxi": "^0.5.11", "yaml": "2.9.0", - "zod": "^3.25.0" + "zod": "^4.6.7" }, "devDependencies": { "@eslint/js": "^9.39.5", @@ -48,7 +48,7 @@ "globals": "^17.9.0", "typescript": "^5.8.0", "typescript-eslint": "^8.66.0", - "vitest": "^4.1.10" + "vitest": "^4.1.12" }, "engines": { "node": ">=24" diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 079c1ff0..7395e452 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -6,10 +6,21 @@ settings: overrides: h3: ^1.15.11 - hono: ^4.12.34 - fast-uri: ^3.1.6 - qs: ^6.16.0 - brace-expansion: ^2.1.4 + hono: ^4.13.11 + '@hono/node-server': ^2.1.3 + fast-uri: ^3.1.9 + qs: ^6.16.1 + brace-expansion: ^2.1.7 + seroval: ^1.6.10 + proxy-addr: ^2.0.8 + body-parser: ^2.4.0 + ip-address: ^10.7.4 + vite: ^6.4.4 + follow-redirects: ^1.16.1 + node-forge: ^1.4.1 + source-map-js: ^1.2.2 + serialize-javascript: ^7.1.3 + js-yaml@4: ^4.3.2 nanoid: ^3.3.17 importers: @@ -17,29 +28,29 @@ importers: .: dependencies: '@better-auth/api-key': - specifier: 1.7.2 - version: 1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)(better-auth@1.7.2(better-sqlite3@13.0.2)(solid-js@1.9.14)(vitest@4.1.10(@types/node@22.20.1)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))))(better-call@1.4.0(zod@3.25.76)) + specifier: 1.7.14 + version: 1.7.14(@better-auth/core@1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.1)(better-auth@1.7.14(solid-js@1.9.17)(vitest@4.1.12(@types/node@22.20.1)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))))(better-call@1.4.4(zod@4.6.7)) '@better-auth/oauth-provider': - specifier: 1.7.2 - version: 1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-auth@1.7.2(better-sqlite3@13.0.2)(solid-js@1.9.14)(vitest@4.1.10(@types/node@22.20.1)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))))(better-call@1.4.0(zod@3.25.76)) + specifier: 1.7.14 + version: 1.7.14(@better-auth/core@1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-auth@1.7.14(solid-js@1.9.17)(vitest@4.1.12(@types/node@22.20.1)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))))(better-call@1.4.4(zod@4.6.7)) '@modelcontextprotocol/sdk': - specifier: ^1.30.0 - version: 1.30.0(supports-color@10.2.2)(zod@3.25.76) + specifier: ^1.32.2 + version: 1.32.2(supports-color@10.2.2)(zod@4.6.7) '@picocss/pico': specifier: ^2.1.1 version: 2.1.1 '@solidjs/meta': specifier: ^0.29.4 - version: 0.29.4(solid-js@1.9.14) + version: 0.29.4(solid-js@1.9.17) '@solidjs/router': specifier: ^0.15.3 - version: 0.15.4(solid-js@1.9.14) + version: 0.15.4(solid-js@1.9.17) '@solidjs/start': specifier: ^1.3.2 - version: 1.3.2(solid-js@1.9.14)(supports-color@10.2.2)(vinxi@0.5.11(@parcel/watcher@2.6.0)(@types/node@22.20.1)(better-sqlite3@13.0.2)(db0@0.3.4(better-sqlite3@13.0.2))(debug@4.4.3(supports-color@10.2.2))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(supports-color@10.2.2)(terser@5.49.0)(yaml@2.9.0))(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) + version: 1.3.2(solid-js@1.9.17)(supports-color@10.2.2)(vinxi@0.5.11(@parcel/watcher@2.6.0)(@types/node@22.20.1)(better-sqlite3@13.0.2)(db0@0.3.4(better-sqlite3@13.0.2))(debug@4.4.3(supports-color@10.2.2))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(supports-color@10.2.2)(terser@5.49.0)(yaml@2.9.0))(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) better-auth: - specifier: 1.7.2 - version: 1.7.2(better-sqlite3@13.0.2)(solid-js@1.9.14)(vitest@4.1.10(@types/node@22.20.1)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))) + specifier: 1.7.14 + version: 1.7.14(solid-js@1.9.17)(vitest@4.1.12(@types/node@22.20.1)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))) better-sqlite3: specifier: ^13.0.2 version: 13.0.2 @@ -59,8 +70,8 @@ importers: specifier: 0.0.14 version: 0.0.14 solid-js: - specifier: ^1.9.7 - version: 1.9.14 + specifier: ^1.9.17 + version: 1.9.17 vinxi: specifier: ^0.5.11 version: 0.5.11(@parcel/watcher@2.6.0)(@types/node@22.20.1)(better-sqlite3@13.0.2)(db0@0.3.4(better-sqlite3@13.0.2))(debug@4.4.3(supports-color@10.2.2))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(supports-color@10.2.2)(terser@5.49.0)(yaml@2.9.0) @@ -68,8 +79,8 @@ importers: specifier: 2.9.0 version: 2.9.0 zod: - specifier: ^3.25.0 - version: 3.25.76 + specifier: ^4.6.7 + version: 4.6.7 devDependencies: '@eslint/js': specifier: ^9.39.5 @@ -99,8 +110,8 @@ importers: specifier: ^8.66.0 version: 8.66.0(eslint@9.39.5(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@5.9.3) vitest: - specifier: ^4.1.10 - version: 4.1.10(@types/node@22.20.1)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) + specifier: ^4.1.12 + version: 4.1.12(@types/node@22.20.1)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) packages: @@ -195,81 +206,78 @@ packages: resolution: {integrity: sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA==} engines: {node: '>=6.9.0'} - '@better-auth/api-key@1.7.2': - resolution: {integrity: sha512-jih45wZaQ83lVYdChSnasxb8iax8p7AYetZ/XiImA9Yuag+cqmLBsaLPNvds5aZV18hLpmvzVkuzf7H/k1X88g==} + '@better-auth/api-key@1.7.14': + resolution: {integrity: sha512-4eKtRgzsHdti+w47nEMaSKm6Hu3fIFlnge6ha6wfKx3Go4uKQoVhhg2PRqUR9/+bPcRKKzPwsfvDIhCKCTaO6g==} peerDependencies: - '@better-auth/core': ^1.7.2 - '@better-auth/utils': 0.4.2 - better-auth: ^1.7.2 - better-call: 1.4.0 + '@better-auth/core': ^1.7.14 + '@better-auth/utils': ^0.4.2 || ^0.5.0 + better-auth: ^1.7.14 + better-call: 1.4.4 - '@better-auth/core@1.7.2': - resolution: {integrity: sha512-j0nM4ygsWbF/fcYRoKtDn8gn8uLXkmC+075HqSqsJEAV828cJR9bvYBCUQ1zmxNyRBk6Iz/qXsA0Zm2oksiOTg==} + '@better-auth/core@1.7.14': + resolution: {integrity: sha512-ByhdrGVwp/el+hoTYKSVOHIH23/lQj9TQ1txdGcWOg22tnfr3hJ6ukzySooeYj/R36XsQgBhkJqIp8mKsNeErA==} peerDependencies: - '@better-auth/utils': 0.4.2 - '@better-fetch/fetch': 1.3.1 - '@cloudflare/workers-types': '>=4' + '@better-auth/utils': ^0.4.2 || ^0.5.0 + '@better-fetch/fetch': 1.3.3 '@opentelemetry/api': ^1.9.0 - better-call: 1.4.0 + better-call: 1.4.4 jose: ^6.1.0 kysely: ^0.28.5 || ^0.29.0 nanostores: ^1.0.1 peerDependenciesMeta: - '@cloudflare/workers-types': - optional: true '@opentelemetry/api': optional: true - '@better-auth/drizzle-adapter@1.7.2': - resolution: {integrity: sha512-A5wE10PIv3aS5LGePecEHntQylKy6OOF17B4dqlE0DwJeqU/IOBSd7/LZhMop9cNJ3WFjKMpazVSf91yYM/NFg==} + '@better-auth/drizzle-adapter@1.7.14': + resolution: {integrity: sha512-5RC8Ec5Ur15FWsS4As9/VrlRbB3+9EfShxIpA5A1FcD6IgPxFvzQNkAm2+FYx9LUSqx47NPf9hBTG2GUCMP9Ig==} peerDependencies: - '@better-auth/core': ^1.7.2 - '@better-auth/utils': 0.4.2 + '@better-auth/core': ^1.7.14 + '@better-auth/utils': ^0.4.2 || ^0.5.0 drizzle-orm: ^0.45.2 || >=1.0.0-rc.1 <2.0.0 peerDependenciesMeta: drizzle-orm: optional: true - '@better-auth/kysely-adapter@1.7.2': - resolution: {integrity: sha512-LYdSRLOvZiF+6S0UThu+wE/Qxsq9P2jQs7ZKkY6BIBJqUjYyxVDmi8HFcantBvWWW1/BeQCSsD7YVDG4gICMIQ==} + '@better-auth/kysely-adapter@1.7.14': + resolution: {integrity: sha512-4wkqj8a8JVpWDYLlgzfbk7eOaWCFkL6HHQd6CLamFKaC8vNsXew1x4v5dE5O6dGr8j4g5qMISS+BAvOuIvBevg==} peerDependencies: - '@better-auth/core': ^1.7.2 - '@better-auth/utils': 0.4.2 + '@better-auth/core': ^1.7.14 + '@better-auth/utils': ^0.4.2 || ^0.5.0 kysely: ^0.28.17 || ^0.29.0 peerDependenciesMeta: kysely: optional: true - '@better-auth/memory-adapter@1.7.2': - resolution: {integrity: sha512-0q1SXMzm5esH9L0xVuM6IxCk59E4G+3HySX4My9gvEwqtmUobykn+iuc/si3Y4xwUO7JODqQ5o+/pPcLDDMIrA==} + '@better-auth/memory-adapter@1.7.14': + resolution: {integrity: sha512-Ojv9BcmFyHuTHha9ZM/NUW1ut9J84wLngta+07Es0Ejn8kekqP5aHBpZd5Z8AvADs5iJUOWvQGFmGlPWAKJgBg==} peerDependencies: - '@better-auth/core': ^1.7.2 - '@better-auth/utils': 0.4.2 + '@better-auth/core': ^1.7.14 + '@better-auth/utils': ^0.4.2 || ^0.5.0 - '@better-auth/mongo-adapter@1.7.2': - resolution: {integrity: sha512-4879SmUWHUs0OYlvHoCFbycZ7i1bqytkcgAUdt9RLQMvZ5H3LRMTgax2YVlGZEXgwNjY/X7xAoXOecWLhlQWeA==} + '@better-auth/mongo-adapter@1.7.14': + resolution: {integrity: sha512-6IA0RSPZFMdRwwnLZ9oWnDIiD0y0o0azTHUfa01BNU2AFJgMDkeiASUV3bKcJBskzQoyQrff74eFYTsTSeeVUQ==} peerDependencies: - '@better-auth/core': ^1.7.2 - '@better-auth/utils': 0.4.2 + '@better-auth/core': ^1.7.14 + '@better-auth/utils': ^0.4.2 || ^0.5.0 mongodb: ^6.0.0 || ^7.0.0 peerDependenciesMeta: mongodb: optional: true - '@better-auth/oauth-provider@1.7.2': - resolution: {integrity: sha512-td7FnUz3lLKXFXN+0RbZe3ygaHqxpRqDG+gxbfSZbztbVfG7vuZtR4ba3uccsodAw7anchhIg2xwVP1/zlcxcw==} + '@better-auth/oauth-provider@1.7.14': + resolution: {integrity: sha512-ey5PmiL4HcJ8CI65xZ3B9LSmRMziF+CNBuzAXx8oJujrItQ7UrEuDr6EAa+nKLQflexRL0AJMXqT7EYObWZxhg==} peerDependencies: - '@better-auth/core': ^1.7.2 - '@better-auth/utils': 0.4.2 - '@better-fetch/fetch': 1.3.1 - better-auth: ^1.7.2 - better-call: 1.4.0 - - '@better-auth/prisma-adapter@1.7.2': - resolution: {integrity: sha512-mXTr/83WrNWLrvzIjtgDgdu9iXhOcSG1+qBQOAKlbGSFiOB+z4IMRneQ2wmMOiB8mKY9qGkClVUjKRFXqtHnFQ==} + '@better-auth/core': ^1.7.14 + '@better-auth/utils': ^0.4.2 || ^0.5.0 + '@better-fetch/fetch': 1.3.3 + better-auth: ^1.7.14 + better-call: 1.4.4 + + '@better-auth/prisma-adapter@1.7.14': + resolution: {integrity: sha512-mF6t5xqeZNWzUe0ErmrSdzQmtslJscmu9X8Mp5QmROlpnnAzvSc70RILu8lHms8CePt7N34+KRH1QvYjGFrVGQ==} peerDependencies: - '@better-auth/core': ^1.7.2 - '@better-auth/utils': 0.4.2 + '@better-auth/core': ^1.7.14 + '@better-auth/utils': ^0.4.2 || ^0.5.0 '@prisma/client': ^5.0.0 || ^6.0.0 || ^7.0.0 prisma: ^5.0.0 || ^6.0.0 || ^7.0.0 peerDependenciesMeta: @@ -278,21 +286,18 @@ packages: prisma: optional: true - '@better-auth/telemetry@1.7.2': - resolution: {integrity: sha512-LcWu+O0zrxYDQj8E36vfkJwGPW4k9ZDA/rCo0zST6ihzL+juR7pBowoZIM9E6tK0Vit52mf6412bGT4XM4eTjQ==} + '@better-auth/telemetry@1.7.14': + resolution: {integrity: sha512-PtKFzsH7gje/WJuUPDjckOoNFazsq8NMt3AdiXIPzHl7tZULcNGTKAX8K7+yn0rG6cO/4mtMgpOjhtilElOnmg==} peerDependencies: - '@better-auth/core': ^1.7.2 - '@better-auth/utils': 0.4.2 - '@better-fetch/fetch': 1.3.1 - - '@better-auth/utils@0.4.2': - resolution: {integrity: sha512-AUxrvu+HaaODsUyzDxFgwd/8RZ1yZaYo42LXKSrU2oGgR38pS1ij8nqQKNgtTWoYGpNevNXtCfgTy6loHveW9A==} + '@better-auth/core': ^1.7.14 + '@better-auth/utils': ^0.4.2 || ^0.5.0 + '@better-fetch/fetch': 1.3.3 - '@better-auth/utils@0.5.0': - resolution: {integrity: sha512-BL8W4EfIZFwlu0r54m3v1ztjDhu6dDe/amLTm0xybmbZaNgYUqhD3SjpAsnq0q8YD6/ki4iwIgxJNLP/N3TxiA==} + '@better-auth/utils@0.5.1': + resolution: {integrity: sha512-WETqw5vQ52uQ/xwWR4E8rTgT6fDEr/wnS+otDNkBCa/69281FCF32OKDdQUcahMCnjsvqXBNiEvAQHFB0EVRRg==} - '@better-fetch/fetch@1.3.1': - resolution: {integrity: sha512-ABkD1WhyfPZprKRQI3bhATjeiFuNWC9PXhfGWqL+sg/gKrM977oFrYkdb4msM3hgUGonr7KlOsOFT5TU2rht9g==} + '@better-fetch/fetch@1.3.3': + resolution: {integrity: sha512-U6SlDt/GUWtK2JAxS/NhdoYTEim+EL1G5byz2TUj83KjLZBUpYzb5SmX0aXaCnbGkAjFKnV/o/0+cyXMbEcqqg==} '@cloudflare/kv-asset-handler@0.4.2': resolution: {integrity: sha512-SIOD2DxrRRwQ+jgzlXCqoEFiKOFqaPjhnNTGKXSRLvp1HiOvapLaFG2kEr9dYQTYe8rKrd9uvDUzmAITeNyaHQ==} @@ -654,11 +659,11 @@ packages: resolution: {integrity: sha512-43/qtrDUokr7LJqoF2c3+RInu/t4zfrpYdoSDfYyhg52rwLV6TnOvdG4fXm7IkSB3wErkcmJS9iEhjVtOSEjjA==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} - '@hono/node-server@2.0.12': - resolution: {integrity: sha512-eWpQYr67tqJLeaSUl0Q+TquuYfUdTibpOJlUMV2FfUP7+KqCC5TufnwnlXL6mobZBJbGAYRd7ZvEBDCbLInjhg==} + '@hono/node-server@2.1.5': + resolution: {integrity: sha512-MgP/I06GdvsilDspMk/qmRzpk8LOUStP6jFAbSRi40W09DhoyUn+Mj7eyKICPqeYKybOjVFLVIAQzvu1bfIa7Q==} engines: {node: '>=20'} peerDependencies: - hono: ^4.12.34 + hono: ^4.13.11 '@humanfs/core@0.19.2': resolution: {integrity: sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==} @@ -715,8 +720,8 @@ packages: engines: {node: '>=18'} hasBin: true - '@modelcontextprotocol/sdk@1.30.0': - resolution: {integrity: sha512-xKd8OIzlqNzcqcNumGAa6g+PW2kjD5vrpcKOnfldAUPP3j7lnqMPwlTXQm8gF+UwH72z0lqaRbjr9hqGz0eITA==} + '@modelcontextprotocol/sdk@1.32.2': + resolution: {integrity: sha512-SWsVtH/0vULSQStoZ6xxH2K09Li8fXYTMC64ZeogCdpZ3XSi1eCPOByV1OpuJxuI3OcmHhosDWYyii07tpPsLw==} engines: {node: '>=18'} peerDependencies: '@cfworker/json-schema': ^4.1.1 @@ -745,10 +750,6 @@ packages: resolution: {integrity: sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==} engines: {node: '>= 8'} - '@opentelemetry/semantic-conventions@1.43.0': - resolution: {integrity: sha512-eSYWTm620tTk45EKSedaUL8MFYI8hW164hIXsgIHyxu3VobUB3fFCu5t0hQby6OoWRPsG1KkKUG2M5UadiLiVg==} - engines: {node: '>=14'} - '@parcel/watcher-android-arm64@2.6.0': resolution: {integrity: sha512-trgpLSCKRC/huFjXX/Smh+0sWe4+YtKfktIToiMl59ghz7z+qkH6kMvNnUbLyRs9N11t8l4svSCs1+5B3rOAhA==} engines: {node: '>= 10.0.0'} @@ -1131,7 +1132,7 @@ packages: resolution: {integrity: sha512-B9z/HbF7gJBaRHieyX7f2uQ4LpLLAVAEutBZipH6w+CYD6RHRJvSVPzECGHF7icFhNWTiJQL2QR6K07s59yzEw==} engines: {node: '>=12'} peerDependencies: - vite: '>=6.0.0' + vite: ^6.4.4 '@tanstack/router-utils@1.162.2': resolution: {integrity: sha512-hTWqJtqIFFdvuCl8WXNyrodp2L9zo2G37xKRrcVmVRWpAB2h+U1LuRAfS4tsFTiWOIoE/B+WDVFB8JpoEdw6jQ==} @@ -1270,34 +1271,34 @@ packages: peerDependencies: vinxi: ^0.5.5 - '@vitest/expect@4.1.10': - resolution: {integrity: sha512-YsCn+qAk1GWjQOWFEsEcL2gNQ0zmVmQu3T03qP6UyjhtmdtwtbuI+DASn/7iQB3HGTXkdBwGddzxPlmiql5vlA==} + '@vitest/expect@4.1.12': + resolution: {integrity: sha512-vFlTt+YEu9WBpNjdGayNmlMVzrWPi1+sv853/7t2FU7hpO5gAFBKHzQmkCq5Xjpr+evegF2994LQT3hF3mRlqQ==} - '@vitest/mocker@4.1.10': - resolution: {integrity: sha512-v0xaezt+DKEmKfaxg133ldzADrwLGd7Ze1MfQQTYfvs8OqZIwbxyxaYURivwV7sWy5fqn3rH5uOrSp07bp44Ow==} + '@vitest/mocker@4.1.12': + resolution: {integrity: sha512-fKShNpKZzupWZuY0z7egydvL0sqW4INEZBEExMBMAa6izlENEVHwoXgdaTCaBZ5fwlr4xf2o1wXC83n9RpO+NA==} peerDependencies: msw: ^2.4.9 - vite: ^6.0.0 || ^7.0.0 || ^8.0.0 + vite: ^6.4.4 peerDependenciesMeta: msw: optional: true vite: optional: true - '@vitest/pretty-format@4.1.10': - resolution: {integrity: sha512-W1HsjSH4MXQ9YfmmhLAoIYf1HRfekQCGngeIgcei6MP5QQGWUe0gkopdZQaVCFO+JDJMrAJGwa5pRpNpvy4P8Q==} + '@vitest/pretty-format@4.1.12': + resolution: {integrity: sha512-XW9O8+Mxx4VpCtkYdMJLZQQwsVryP9wk7cPKDxtXFfwSak6yRh5+2fep/Y0XF/ElBvJHq8bcYdi6aeuai0opZA==} - '@vitest/runner@4.1.10': - resolution: {integrity: sha512-IKI6kpIH+LmpROplyLwBBaCfMgOZOMsygVa6BARD6ahA04VRuJSa6OaVG7kRvSEMD870Vd91rSSw0eegtWyLGg==} + '@vitest/runner@4.1.12': + resolution: {integrity: sha512-NKlVKCr5QnCe8jijdMnmkpHHU+WTqiLFR6G0pHji9uRjXK9xJl1k1nTw6F3pOOj2PDcsDt2GKQMI7wIsaT491w==} - '@vitest/snapshot@4.1.10': - resolution: {integrity: sha512-xRkfOT1qpTAi/Ti4Y1LtfRc3kEuqxGw59eN2jN9pRWMtS/XDevekhcFSqvQqjUNGksfjMJu3Y+oJ+4Ypn2OaJw==} + '@vitest/snapshot@4.1.12': + resolution: {integrity: sha512-ko1y1Qgb/slzQ9mr+b89Cuqud8WG1TKtsPD8r7ZUBdvVOGt85Af2HwCqHujrhwJq95hs/9RM7fcAPg57o1vlzw==} - '@vitest/spy@4.1.10': - resolution: {integrity: sha512-PLf/Ugvoq5wO/b4rwYCR1h2PSIdXz7wnkQFMiUpLdtM7l6pqVFcQIBEHyT1+l+cj7mNwAfZHzqXqDyjvOuwbDw==} + '@vitest/spy@4.1.12': + resolution: {integrity: sha512-RGq9x4JNGNTZHEJxvN0oSiJjeSCExm0n2gZKKJZHY9cX5AVA6M7VJILBT3ZJ/tJ/0J9uWT7fETV9/btoi//vSg==} - '@vitest/utils@4.1.10': - resolution: {integrity: sha512-fy9am/HWxbaGt/Sawrp90vt6Y6jQwf1RX77cz3uwoJwJVMli/e1IEwRPnMNJ7vKfPTwo0diXifkpPvwH9v7nGA==} + '@vitest/utils@4.1.12': + resolution: {integrity: sha512-Q3awXrwOfEV+qc3WmO5ONyE0yO7Q1gQ9/oyHxGLZ/pl7N3NO/ZztqQwKLuwMkV+CA1JYSIeO3gkHnRDIo4AVaA==} abbrev@3.0.1: resolution: {integrity: sha512-AO2ac6pjRB3SJmGJo+v5/aK6Omggp6fsLrs6wN9bd35ulu4cCwaAU9+7ZhXjeqHVkaHThLuzH0nZr0YpCDhygg==} @@ -1482,15 +1483,14 @@ packages: engines: {node: '>=6.0.0'} hasBin: true - better-auth@1.7.2: - resolution: {integrity: sha512-gKapKBEvYIGcMxi74RjQ7EbFLiqyQt58vdoJmL1qAlWSkY1Bc2Vqshl524/3u1NxauiOU03M/Ebh762Brmac9A==} + better-auth@1.7.14: + resolution: {integrity: sha512-QxDCI0pOCCHDYmruisKhKyrvOJ6Icv9xg0RA6ZUysfKFXENYwhNNpwUlkE/NmViH2nDMgkKcymmLr55pnpR9vw==} peerDependencies: '@lynx-js/react': '*' '@prisma/client': ^5.0.0 || ^6.0.0 || ^7.0.0 - '@sveltejs/kit': ^2.0.0 + '@sveltejs/kit': ^2.0.0 || ^3.0.0 '@tanstack/react-start': ^1.0.0 '@tanstack/solid-start': ^1.0.0 - better-sqlite3: ^12.0.0 drizzle-kit: '>=0.31.4 || >=1.0.0-beta.1' drizzle-orm: ^0.45.2 || >=1.0.0-rc.1 <2.0.0 mongodb: ^6.0.0 || ^7.0.0 @@ -1502,7 +1502,7 @@ packages: react-dom: ^18.0.0 || ^19.0.0 solid-js: ^1.0.0 svelte: ^4.0.0 || ^5.0.0 - vitest: ^2.0.0 || ^3.0.0 || ^4.0.0 + vitest: ^2.0.0 || ^3.0.0 || ^4.0.0 || ^5.0.0 vue: ^3.0.0 peerDependenciesMeta: '@lynx-js/react': @@ -1515,8 +1515,6 @@ packages: optional: true '@tanstack/solid-start': optional: true - better-sqlite3: - optional: true drizzle-kit: optional: true drizzle-orm: @@ -1544,8 +1542,8 @@ packages: vue: optional: true - better-call@1.4.0: - resolution: {integrity: sha512-bBKOT4vv1kZLDgxVePdilk/Jwkn+dtRRsmi3DzHcDP+WnswyVl6dR59l2HEeP/0cB+bDoopASAesWDPIdd/zZA==} + better-call@1.4.4: + resolution: {integrity: sha512-Gq4XdGFy4dmUxFEAX2nj0ycFcFbD9ZWh8YROouZoyXeF1M11TpYbplk0pDByTFF8Wz+MYa6W9052c9m7dD+mfw==} peerDependencies: zod: ^4.0.0 peerDependenciesMeta: @@ -1566,16 +1564,16 @@ packages: bl@4.1.0: resolution: {integrity: sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==} - body-parser@2.3.0: - resolution: {integrity: sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==} + body-parser@2.4.0: + resolution: {integrity: sha512-Ifk1KcLrxaGt1occQagQNFNNOqRt1LFuehEnHHzB8Z6cRgIxRU1TBaiIsUiCdA+gy5PL7Y1IX31DNKkRmxtXjQ==} engines: {node: '>=18'} boxen@8.0.1: resolution: {integrity: sha512-F3PH5k5juxom4xktynS7MoFY+NUWH5LC4CnH11YB8NPew+HLpmBLCybSAEyb2F+4pRXhuhWqFesoQd6DAyc2hw==} engines: {node: '>=18'} - brace-expansion@2.1.4: - resolution: {integrity: sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==} + brace-expansion@2.1.7: + resolution: {integrity: sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==} braces@3.0.3: resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==} @@ -1741,6 +1739,10 @@ packages: resolution: {integrity: sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==} engines: {node: '>=18'} + content-type@2.1.0: + resolution: {integrity: sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==} + engines: {node: '>=18'} + convert-source-map@2.0.0: resolution: {integrity: sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==} @@ -2135,8 +2137,8 @@ packages: fast-levenshtein@2.0.6: resolution: {integrity: sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==} - fast-uri@3.1.7: - resolution: {integrity: sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==} + fast-uri@3.1.9: + resolution: {integrity: sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==} fastq@1.20.1: resolution: {integrity: sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==} @@ -2183,8 +2185,8 @@ packages: flatted@3.4.4: resolution: {integrity: sha512-5+ybhBZANEJxaH3X5evAFatUxLfEHSr7n6kYJ+1Qd0mUqr4eu9gIf6GDbWHf8RJijHrjjO8G+la14SlL2SeS1Q==} - follow-redirects@1.16.0: - resolution: {integrity: sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==} + follow-redirects@1.16.2: + resolution: {integrity: sha512-/kVP2U8z596Ia0gwFrwyIeo74ta5aVmSeU1FfAUMAmcEP5EP7zydmag3SLiN64NaRKef3lxsq7i/g7ltJQDGow==} engines: {node: '>=4.0'} peerDependencies: debug: '*' @@ -2323,8 +2325,8 @@ packages: hast-util-whitespace@3.0.0: resolution: {integrity: sha512-88JUN06ipLwsnv+dVn+OIYOvAuvBMy/Qoi6O7mQHxdPXpjy+Cd6xRkWwux7DKO+4sYILtLBRIKgsdpS2gQc7qw==} - hono@4.12.34: - resolution: {integrity: sha512-GqXJqY/xJkJmuloTrnV1ZEXG3fqte+VjkUqoRNZXcrUidiUOP4fMSIHHY4tsqZBK++kVyWmt/AAfSUuy57/eSA==} + hono@4.13.14: + resolution: {integrity: sha512-yhRLQ21U6qa9Hsu2N7Qcbh8tE+WKEcoErjIo56LeSGiGXGp9sA7UpE86Ui9uexb61KakiGwuHMn2QdV7w6i6kQ==} engines: {node: '>=16.9.0'} hookable@5.5.3: @@ -2406,8 +2408,8 @@ packages: resolution: {integrity: sha512-ehuGcf94bQXhfagULNXrJdfnWO38v070jxSx/qE87Kjzmu2fU7ro5EFAb+OPituLqgfyuQaym5DlrNydW2sJ9A==} engines: {node: '>=12.22.0'} - ip-address@10.3.1: - resolution: {integrity: sha512-1e9d3kb97NHJTIJDZW9rKqW2h6+dFa50Dy0fpPSMQp2ADje5gvKsXmdiK6dwY5t76TaTt5+P5N1Y/LoToIxP6g==} + ip-address@10.7.5: + resolution: {integrity: sha512-t2v0rkILYv9WXmSL7TpAaU3HXgaFYOPUcH3QHgwQ++gpJuH3bqyMy4Fvt/DJCTKwzH3Cf+bAp5W/mFL39KPLzA==} engines: {node: '>= 12'} ipaddr.js@1.9.1: @@ -2530,8 +2532,8 @@ packages: js-tokens@9.0.1: resolution: {integrity: sha512-mxa9E9ITFOt0ban3j6L5MpjwegGz6lBQmM1IJkWeBZGcMxto50+eWdjC/52xDbS2vy0k7vIMK0Fe2wfL9OQSpQ==} - js-yaml@4.3.1: - resolution: {integrity: sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==} + js-yaml@4.3.2: + resolution: {integrity: sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==} hasBin: true jsesc@3.1.0: @@ -2799,8 +2801,8 @@ packages: encoding: optional: true - node-forge@1.4.0: - resolution: {integrity: sha512-LarFH0+6VfriEhqMMcLX2F7SwSXeWwnEAJEsYm5QKWchiVYVvJyV9v7UDvUv+w5HO23ZpQTXDv/GxdDdMyOuoQ==} + node-forge@1.4.2: + resolution: {integrity: sha512-rRtAR5XLJ8gCKd9du4qrKAsgCG1ObGP4gLeNJMa4vYSeq4bmBMOJk5IHkrviBV0q7uoAJlVd8HEQYQSVUb4FGQ==} engines: {node: '>= 6.13.0'} node-gyp-build@4.8.4: @@ -3007,8 +3009,8 @@ packages: property-information@7.2.0: resolution: {integrity: sha512-IAtzIB6sUiWaJYrX9smp3V46pBGbBeLFRGdh25kg1334VcBlD8HzhPeNIWQH9zhGmo2itIe25EHt9dQP7G5hmg==} - proxy-addr@2.0.7: - resolution: {integrity: sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==} + proxy-addr@2.0.8: + resolution: {integrity: sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==} engines: {node: '>= 0.10'} pump@3.0.4: @@ -3018,8 +3020,8 @@ packages: resolution: {integrity: sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==} engines: {node: '>=6'} - qs@6.16.0: - resolution: {integrity: sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==} + qs@6.17.0: + resolution: {integrity: sha512-5LK5BZ2XDHMvcUJaf0CQ5HL3aVgKbpklvByC7qLSxYkfE8COEEbJg5xCHWCTqzqi0Gs4Jn5Mv5v3R38W6edscA==} engines: {node: '>=0.6'} quansync@0.2.11: @@ -3178,19 +3180,25 @@ packages: resolution: {integrity: sha512-1gnZf7DFcoIcajTjTwjwuDjzuz4PPcY2StKPlsGAQ1+YH20IRVrBaXSWmdjowTJ6u8Rc01PoYOGHXfP1mYcZNQ==} engines: {node: '>= 18'} - serialize-javascript@7.0.7: - resolution: {integrity: sha512-YAy8Od6KV+uuwUuU50np8fGB/Aues6Y0nAhA9y/hId74PlKUcme4pXcBD46NWKr1Q4osN/iseZ17YqO1XfmI8g==} + serialize-javascript@7.1.4: + resolution: {integrity: sha512-FqlEuoTq/zRmA4Lg6aOqyH3lCHbUtCB0bmHCeFniX2GBdDqMJM3FwdvEhlE5Pim1dlt2FfBdVPmUNNiGhhKqpw==} engines: {node: '>=20.0.0'} seroval-plugins@1.5.6: resolution: {integrity: sha512-HXuLAX2pu/UByPpaeo/TaMfvMIi+1QqIoPJYCcAtU8QkVNwgR6MPlGuCQTErV1JwraaMbYaWVIBX7mppzGLATQ==} engines: {node: '>=10'} peerDependencies: - seroval: ^1.0 + seroval: ^1.6.10 - seroval@1.5.6: - resolution: {integrity: sha512-rVQVWjjSvlINzaQPZH5JFqsqEsIWdTxY3iJZCnTL/5gQbXIRooVZKI60tVCkOVfzcRPejboxO2t0P89dg5mQaA==} + seroval-plugins@1.6.12: + resolution: {integrity: sha512-+reiwp/lYxiyctSrdvX7OQ1YLrcbWYgBiZrhSFL+V43b0/DGRLNVSDyZINbQe+tWplPOI2fw2dPrdv6hcc09kQ==} engines: {node: '>=10'} + peerDependencies: + seroval: ^1.6.10 + + seroval@1.7.3: + resolution: {integrity: sha512-fYkZS/GrMJhj1CW+IDoPlILRmYl5/S9L/OYju/sA2K/HQ3G5JBWDZHxaUWVZV/0hfAC2n1+9ysBRDtqMbMXvzA==} + engines: {node: '>=20'} serve-placeholder@2.0.2: resolution: {integrity: sha512-/TMG8SboeiQbZJWRlfTCqMs2DD3SZgWp0kDQePz9yUuCnDfDh/92gf7/PxGhzXTKBIPASIHxFcZndoNbp6QOLQ==} @@ -3257,8 +3265,8 @@ packages: resolution: {integrity: sha512-RQsvleCbF8cVHEv+xuDGaA4pOizFqJ0GgjtMSRo6oP8pnN7WsigHgVGey6aILRBKv4W2YOMHLqbKdnB6hpB9fw==} engines: {node: '>=20.0.0'} - solid-js@1.9.14: - resolution: {integrity: sha512-sAEXC0Kk0S1EDg+8ysEWJDbYhA3RRoEjwuySUGlKIemeo0I5YZfOyumNjNs9Sv3y2nmhD+0rW66ag2HsMuQiGQ==} + solid-js@1.9.17: + resolution: {integrity: sha512-4GAmLOWPfNV8H9Jfn2LSFTpNEG6jiOKPiwd5lnLGQtehHaX6l3TOLzJqQ7mqwB/3k1Yy3zyumFVopmc/tm34ow==} solid-refresh@0.6.3: resolution: {integrity: sha512-F3aPsX6hVw9ttm5LYlth8Q15x6MlI/J3Dn+o3EQyRTtTxidepSTwAYdozt01/YA+7ObcciagGEyXIopGZzQtbA==} @@ -3271,8 +3279,8 @@ packages: peerDependencies: solid-js: ^1.7 - source-map-js@1.2.1: - resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==} + source-map-js@1.2.2: + resolution: {integrity: sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==} engines: {node: '>=0.10.0'} source-map-support@0.5.21: @@ -3575,7 +3583,7 @@ packages: rolldown: '*' rollup: '*' unloader: '*' - vite: '*' + vite: ^6.4.4 webpack: '*' peerDependenciesMeta: '@farmfe/core': @@ -3708,13 +3716,13 @@ packages: peerDependencies: '@testing-library/jest-dom': ^5.16.6 || ^5.17.0 || ^6.0.0 || ^7.0.0 solid-js: ^1.7.2 - vite: ^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0 || ^9.0.0 + vite: ^6.4.4 peerDependenciesMeta: '@testing-library/jest-dom': optional: true - vite@6.4.3: - resolution: {integrity: sha512-NTKlcQjlAK7MlQoyb6LgaqHc8sso/pVyUJYWMws3jg21uTJw/LddqIFPcPqP6PzpgbIcZyKI85sFE4HBrQDA8A==} + vite@6.4.5: + resolution: {integrity: sha512-4enwjFfi4IwtEh0w+jPzpLVOFQiPHmmzPxcHXQOyEur47o6u0jE573DmGpjA+7irXoMLYRZD5ZaFUEneS3abPg==} engines: {node: ^18.0.0 || ^20.0.0 || >=22.0.0} hasBin: true peerDependencies: @@ -3756,28 +3764,28 @@ packages: vitefu@1.1.3: resolution: {integrity: sha512-ub4okH7Z5KLjb6hDyjqrGXqWtWvoYdU3IGm/NorpgHncKoLTCfRIbvlhBm7r0YstIaQRYlp4yEbFqDcKSzXSSg==} peerDependencies: - vite: ^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0 + vite: ^6.4.4 peerDependenciesMeta: vite: optional: true - vitest@4.1.10: - resolution: {integrity: sha512-R9jUTe5S4Qb0HCd4TNqpC7oGcrMssMRGXLW80ubjWsW9VH5GF8y1Y0SFLY9AbqSk6nt0PnOx4H4WNJYZ13GUPw==} + vitest@4.1.12: + resolution: {integrity: sha512-5eWdz2yb3ajxWF3C8C4TjkXl7FGm3n2E/VlazALrQHzK7nYMSGFnCZto0bbPNl77AwkOZVLk0YnBAejUu0NiWA==} engines: {node: ^20.0.0 || ^22.0.0 || >=24.0.0} hasBin: true peerDependencies: '@edge-runtime/vm': '*' '@opentelemetry/api': ^1.9.0 '@types/node': ^20.0.0 || ^22.0.0 || >=24.0.0 - '@vitest/browser-playwright': 4.1.10 - '@vitest/browser-preview': 4.1.10 - '@vitest/browser-webdriverio': 4.1.10 - '@vitest/coverage-istanbul': 4.1.10 - '@vitest/coverage-v8': 4.1.10 - '@vitest/ui': 4.1.10 + '@vitest/browser-playwright': 4.1.12 + '@vitest/browser-preview': 4.1.12 + '@vitest/browser-webdriverio': ^4.1.11 + '@vitest/coverage-istanbul': 4.1.12 + '@vitest/coverage-v8': 4.1.12 + '@vitest/ui': 4.1.12 happy-dom: '*' jsdom: '*' - vite: ^6.0.0 || ^7.0.0 || ^8.0.0 + vite: ^6.4.4 peerDependenciesMeta: '@edge-runtime/vm': optional: true @@ -3905,11 +3913,8 @@ packages: peerDependencies: zod: ^3.25.28 || ^4 - zod@3.25.76: - resolution: {integrity: sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==} - - zod@4.4.3: - resolution: {integrity: sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==} + zod@4.6.7: + resolution: {integrity: sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==} zwitch@2.0.4: resolution: {integrity: sha512-bXE4cR/kVZhKZX/RjPEflHaKVhUVl85noU3v6b8apfQEc1x4A+zBxjZ4lN8LqGd6WZ3dl98pY4o717VFmoPp+A==} @@ -4038,78 +4043,73 @@ snapshots: '@babel/helper-string-parser': 7.29.7 '@babel/helper-validator-identifier': 7.29.7 - '@better-auth/api-key@1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)(better-auth@1.7.2(better-sqlite3@13.0.2)(solid-js@1.9.14)(vitest@4.1.10(@types/node@22.20.1)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))))(better-call@1.4.0(zod@3.25.76))': + '@better-auth/api-key@1.7.14(@better-auth/core@1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.1)(better-auth@1.7.14(solid-js@1.9.17)(vitest@4.1.12(@types/node@22.20.1)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))))(better-call@1.4.4(zod@4.6.7))': dependencies: - '@better-auth/core': 1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) - '@better-auth/utils': 0.4.2 - better-auth: 1.7.2(better-sqlite3@13.0.2)(solid-js@1.9.14)(vitest@4.1.10(@types/node@22.20.1)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))) - better-call: 1.4.0(zod@3.25.76) - zod: 4.4.3 + '@better-auth/core': 1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) + '@better-auth/utils': 0.5.1 + better-auth: 1.7.14(solid-js@1.9.17)(vitest@4.1.12(@types/node@22.20.1)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))) + better-call: 1.4.4(zod@4.6.7) + zod: 4.6.7 - '@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1)': + '@better-auth/core@1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1)': dependencies: - '@better-auth/utils': 0.4.2 - '@better-fetch/fetch': 1.3.1 - '@opentelemetry/semantic-conventions': 1.43.0 + '@better-auth/utils': 0.5.1 + '@better-fetch/fetch': 1.3.3 '@standard-schema/spec': 1.1.0 - better-call: 1.4.0(zod@3.25.76) + better-call: 1.4.4(zod@4.6.7) jose: 6.2.4 kysely: 0.29.4 nanostores: 1.4.1 - zod: 4.4.3 + zod: 4.6.7 - '@better-auth/drizzle-adapter@1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)': + '@better-auth/drizzle-adapter@1.7.14(@better-auth/core@1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.1)': dependencies: - '@better-auth/core': 1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) - '@better-auth/utils': 0.4.2 + '@better-auth/core': 1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) + '@better-auth/utils': 0.5.1 - '@better-auth/kysely-adapter@1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)(kysely@0.29.4)': + '@better-auth/kysely-adapter@1.7.14(@better-auth/core@1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.1)(kysely@0.29.4)': dependencies: - '@better-auth/core': 1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) - '@better-auth/utils': 0.4.2 + '@better-auth/core': 1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) + '@better-auth/utils': 0.5.1 optionalDependencies: kysely: 0.29.4 - '@better-auth/memory-adapter@1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)': + '@better-auth/memory-adapter@1.7.14(@better-auth/core@1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.1)': dependencies: - '@better-auth/core': 1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) - '@better-auth/utils': 0.4.2 + '@better-auth/core': 1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) + '@better-auth/utils': 0.5.1 - '@better-auth/mongo-adapter@1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)': + '@better-auth/mongo-adapter@1.7.14(@better-auth/core@1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.1)': dependencies: - '@better-auth/core': 1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) - '@better-auth/utils': 0.4.2 + '@better-auth/core': 1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) + '@better-auth/utils': 0.5.1 - '@better-auth/oauth-provider@1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-auth@1.7.2(better-sqlite3@13.0.2)(solid-js@1.9.14)(vitest@4.1.10(@types/node@22.20.1)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))))(better-call@1.4.0(zod@3.25.76))': + '@better-auth/oauth-provider@1.7.14(@better-auth/core@1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-auth@1.7.14(solid-js@1.9.17)(vitest@4.1.12(@types/node@22.20.1)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))))(better-call@1.4.4(zod@4.6.7))': dependencies: - '@better-auth/core': 1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) - '@better-auth/utils': 0.4.2 - '@better-fetch/fetch': 1.3.1 - better-auth: 1.7.2(better-sqlite3@13.0.2)(solid-js@1.9.14)(vitest@4.1.10(@types/node@22.20.1)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))) - better-call: 1.4.0(zod@3.25.76) + '@better-auth/core': 1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) + '@better-auth/utils': 0.5.1 + '@better-fetch/fetch': 1.3.3 + better-auth: 1.7.14(solid-js@1.9.17)(vitest@4.1.12(@types/node@22.20.1)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))) + better-call: 1.4.4(zod@4.6.7) jose: 6.2.4 - zod: 4.4.3 + zod: 4.6.7 - '@better-auth/prisma-adapter@1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)': + '@better-auth/prisma-adapter@1.7.14(@better-auth/core@1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.1)': dependencies: - '@better-auth/core': 1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) - '@better-auth/utils': 0.4.2 + '@better-auth/core': 1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) + '@better-auth/utils': 0.5.1 - '@better-auth/telemetry@1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)': + '@better-auth/telemetry@1.7.14(@better-auth/core@1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)': dependencies: - '@better-auth/core': 1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) - '@better-auth/utils': 0.4.2 - '@better-fetch/fetch': 1.3.1 + '@better-auth/core': 1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) + '@better-auth/utils': 0.5.1 + '@better-fetch/fetch': 1.3.3 - '@better-auth/utils@0.4.2': + '@better-auth/utils@0.5.1': dependencies: '@noble/hashes': 2.2.0 - '@better-auth/utils@0.5.0': - dependencies: - '@noble/hashes': 2.2.0 - - '@better-fetch/fetch@1.3.1': {} + '@better-fetch/fetch@1.3.3': {} '@cloudflare/kv-asset-handler@0.4.2': {} @@ -4307,7 +4307,7 @@ snapshots: globals: 14.0.0 ignore: 5.3.2 import-fresh: 3.3.1 - js-yaml: 4.3.1 + js-yaml: 4.3.2 minimatch: 3.1.5 strip-json-comments: 3.1.1 transitivePeerDependencies: @@ -4322,9 +4322,9 @@ snapshots: '@eslint/core': 0.17.0 levn: 0.4.1 - '@hono/node-server@2.0.12(hono@4.12.34)': + '@hono/node-server@2.1.5(hono@4.13.14)': dependencies: - hono: 4.12.34 + hono: 4.13.14 '@humanfs/core@0.19.2': dependencies: @@ -4394,9 +4394,9 @@ snapshots: - encoding - supports-color - '@modelcontextprotocol/sdk@1.30.0(supports-color@10.2.2)(zod@3.25.76)': + '@modelcontextprotocol/sdk@1.32.2(supports-color@10.2.2)(zod@4.6.7)': dependencies: - '@hono/node-server': 2.0.12(hono@4.12.34) + '@hono/node-server': 2.1.5(hono@4.13.14) ajv: 8.20.0 ajv-formats: 3.0.1(ajv@8.20.0) content-type: 1.0.5 @@ -4406,13 +4406,13 @@ snapshots: eventsource-parser: 3.1.0 express: 5.2.1(supports-color@10.2.2) express-rate-limit: 8.6.1(express@5.2.1(supports-color@10.2.2))(supports-color@10.2.2) - hono: 4.12.34 + hono: 4.13.14 jose: 6.2.4 json-schema-typed: 8.0.2 pkce-challenge: 5.0.1 raw-body: 3.0.2 - zod: 3.25.76 - zod-to-json-schema: 3.25.2(zod@3.25.76) + zod: 4.6.7 + zod-to-json-schema: 3.25.2(zod@4.6.7) transitivePeerDependencies: - supports-color @@ -4432,8 +4432,6 @@ snapshots: '@nodelib/fs.scandir': 2.1.5 fastq: 1.20.1 - '@opentelemetry/semantic-conventions@1.43.0': {} - '@parcel/watcher-android-arm64@2.6.0': optional: true @@ -4570,7 +4568,7 @@ snapshots: '@rollup/plugin-terser@1.0.0(rollup@4.62.3)': dependencies: - serialize-javascript: 7.0.7 + serialize-javascript: 7.1.4 smob: 1.6.2 terser: 5.49.0 optionalDependencies: @@ -4700,17 +4698,17 @@ snapshots: '@sindresorhus/merge-streams@4.0.0': {} - '@solidjs/meta@0.29.4(solid-js@1.9.14)': + '@solidjs/meta@0.29.4(solid-js@1.9.17)': dependencies: - solid-js: 1.9.14 + solid-js: 1.9.17 - '@solidjs/router@0.15.4(solid-js@1.9.14)': + '@solidjs/router@0.15.4(solid-js@1.9.17)': dependencies: - solid-js: 1.9.14 + solid-js: 1.9.17 - '@solidjs/start@1.3.2(solid-js@1.9.14)(supports-color@10.2.2)(vinxi@0.5.11(@parcel/watcher@2.6.0)(@types/node@22.20.1)(better-sqlite3@13.0.2)(db0@0.3.4(better-sqlite3@13.0.2))(debug@4.4.3(supports-color@10.2.2))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(supports-color@10.2.2)(terser@5.49.0)(yaml@2.9.0))(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))': + '@solidjs/start@1.3.2(solid-js@1.9.17)(supports-color@10.2.2)(vinxi@0.5.11(@parcel/watcher@2.6.0)(@types/node@22.20.1)(better-sqlite3@13.0.2)(db0@0.3.4(better-sqlite3@13.0.2))(debug@4.4.3(supports-color@10.2.2))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(supports-color@10.2.2)(terser@5.49.0)(yaml@2.9.0))(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))': dependencies: - '@tanstack/server-functions-plugin': 1.121.21(supports-color@10.2.2)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) + '@tanstack/server-functions-plugin': 1.121.21(supports-color@10.2.2)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) '@vinxi/plugin-directives': 0.5.1(vinxi@0.5.11(@parcel/watcher@2.6.0)(@types/node@22.20.1)(better-sqlite3@13.0.2)(db0@0.3.4(better-sqlite3@13.0.2))(debug@4.4.3(supports-color@10.2.2))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(supports-color@10.2.2)(terser@5.49.0)(yaml@2.9.0)) '@vinxi/server-components': 0.5.1(vinxi@0.5.11(@parcel/watcher@2.6.0)(@types/node@22.20.1)(better-sqlite3@13.0.2)(db0@0.3.4(better-sqlite3@13.0.2))(debug@4.4.3(supports-color@10.2.2))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(supports-color@10.2.2)(terser@5.49.0)(yaml@2.9.0)) cookie-es: 2.0.1 @@ -4718,14 +4716,14 @@ snapshots: error-stack-parser: 2.1.4 html-to-image: 1.11.13 radix3: 1.1.2 - seroval: 1.5.6 - seroval-plugins: 1.5.6(seroval@1.5.6) + seroval: 1.7.3 + seroval-plugins: 1.5.6(seroval@1.7.3) shiki: 1.29.2 - source-map-js: 1.2.1 - terracotta: 1.1.1(solid-js@1.9.14) + source-map-js: 1.2.2 + terracotta: 1.1.1(solid-js@1.9.17) tinyglobby: 0.2.17 vinxi: 0.5.11(@parcel/watcher@2.6.0)(@types/node@22.20.1)(better-sqlite3@13.0.2)(db0@0.3.4(better-sqlite3@13.0.2))(debug@4.4.3(supports-color@10.2.2))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(supports-color@10.2.2)(terser@5.49.0)(yaml@2.9.0) - vite-plugin-solid: 2.11.14(solid-js@1.9.14)(supports-color@10.2.2)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) + vite-plugin-solid: 2.11.14(solid-js@1.9.17)(supports-color@10.2.2)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) transitivePeerDependencies: - '@testing-library/jest-dom' - solid-js @@ -4736,7 +4734,7 @@ snapshots: '@standard-schema/spec@1.1.0': {} - '@tanstack/directive-functions-plugin@1.121.21(supports-color@10.2.2)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))': + '@tanstack/directive-functions-plugin@1.121.21(supports-color@10.2.2)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))': dependencies: '@babel/code-frame': 7.26.2 '@babel/core': 7.29.7(supports-color@10.2.2) @@ -4745,7 +4743,7 @@ snapshots: '@tanstack/router-utils': 1.162.2(supports-color@10.2.2) babel-dead-code-elimination: 1.0.12(supports-color@10.2.2) tiny-invariant: 1.3.3 - vite: 6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0) + vite: 6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0) transitivePeerDependencies: - supports-color @@ -4762,7 +4760,7 @@ snapshots: transitivePeerDependencies: - supports-color - '@tanstack/server-functions-plugin@1.121.21(supports-color@10.2.2)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))': + '@tanstack/server-functions-plugin@1.121.21(supports-color@10.2.2)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))': dependencies: '@babel/code-frame': 7.26.2 '@babel/core': 7.29.7(supports-color@10.2.2) @@ -4771,7 +4769,7 @@ snapshots: '@babel/template': 7.29.7 '@babel/traverse': 7.29.7(supports-color@10.2.2) '@babel/types': 7.29.7 - '@tanstack/directive-functions-plugin': 1.121.21(supports-color@10.2.2)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) + '@tanstack/directive-functions-plugin': 1.121.21(supports-color@10.2.2)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) babel-dead-code-elimination: 1.0.12(supports-color@10.2.2) tiny-invariant: 1.3.3 transitivePeerDependencies: @@ -4961,7 +4959,7 @@ snapshots: http-shutdown: 1.2.2 jiti: 1.21.7 mlly: 1.8.2 - node-forge: 1.4.0 + node-forge: 1.4.2 pathe: 1.1.2 std-env: 3.10.0 ufo: 1.6.4 @@ -4992,44 +4990,44 @@ snapshots: recast: 0.23.12 vinxi: 0.5.11(@parcel/watcher@2.6.0)(@types/node@22.20.1)(better-sqlite3@13.0.2)(db0@0.3.4(better-sqlite3@13.0.2))(debug@4.4.3(supports-color@10.2.2))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(supports-color@10.2.2)(terser@5.49.0)(yaml@2.9.0) - '@vitest/expect@4.1.10': + '@vitest/expect@4.1.12': dependencies: '@standard-schema/spec': 1.1.0 '@types/chai': 5.2.3 - '@vitest/spy': 4.1.10 - '@vitest/utils': 4.1.10 + '@vitest/spy': 4.1.12 + '@vitest/utils': 4.1.12 chai: 6.2.2 tinyrainbow: 3.1.1 - '@vitest/mocker@4.1.10(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))': + '@vitest/mocker@4.1.12(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))': dependencies: - '@vitest/spy': 4.1.10 + '@vitest/spy': 4.1.12 estree-walker: 3.0.3 magic-string: 0.30.21 optionalDependencies: - vite: 6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0) + vite: 6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0) - '@vitest/pretty-format@4.1.10': + '@vitest/pretty-format@4.1.12': dependencies: tinyrainbow: 3.1.1 - '@vitest/runner@4.1.10': + '@vitest/runner@4.1.12': dependencies: - '@vitest/utils': 4.1.10 + '@vitest/utils': 4.1.12 pathe: 2.0.3 - '@vitest/snapshot@4.1.10': + '@vitest/snapshot@4.1.12': dependencies: - '@vitest/pretty-format': 4.1.10 - '@vitest/utils': 4.1.10 + '@vitest/pretty-format': 4.1.12 + '@vitest/utils': 4.1.12 magic-string: 0.30.21 pathe: 2.0.3 - '@vitest/spy@4.1.10': {} + '@vitest/spy@4.1.12': {} - '@vitest/utils@4.1.10': + '@vitest/utils@4.1.12': dependencies: - '@vitest/pretty-format': 4.1.10 + '@vitest/pretty-format': 4.1.12 convert-source-map: 2.0.0 tinyrainbow: 3.1.1 @@ -5078,7 +5076,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.7 + fast-uri: 3.1.9 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -5161,12 +5159,12 @@ snapshots: html-entities: 2.3.3 parse5: 7.3.0 - babel-preset-solid@1.9.12(@babel/core@7.29.7(supports-color@10.2.2))(solid-js@1.9.14): + babel-preset-solid@1.9.12(@babel/core@7.29.7(supports-color@10.2.2))(solid-js@1.9.17): dependencies: '@babel/core': 7.29.7(supports-color@10.2.2) babel-plugin-jsx-dom-expressions: 0.40.7(@babel/core@7.29.7(supports-color@10.2.2)) optionalDependencies: - solid-js: 1.9.14 + solid-js: 1.9.17 balanced-match@1.0.2: {} @@ -5203,50 +5201,39 @@ snapshots: baseline-browser-mapping@2.11.6: {} - better-auth@1.7.2(better-sqlite3@13.0.2)(solid-js@1.9.14)(vitest@4.1.10(@types/node@22.20.1)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))): - dependencies: - '@better-auth/core': 1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) - '@better-auth/drizzle-adapter': 1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2) - '@better-auth/kysely-adapter': 1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)(kysely@0.29.4) - '@better-auth/memory-adapter': 1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2) - '@better-auth/mongo-adapter': 1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2) - '@better-auth/prisma-adapter': 1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2) - '@better-auth/telemetry': 1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1) - '@better-auth/utils': 0.4.2 - '@better-fetch/fetch': 1.3.1 + better-auth@1.7.14(solid-js@1.9.17)(vitest@4.1.12(@types/node@22.20.1)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0))): + dependencies: + '@better-auth/core': 1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) + '@better-auth/drizzle-adapter': 1.7.14(@better-auth/core@1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.1) + '@better-auth/kysely-adapter': 1.7.14(@better-auth/core@1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.1)(kysely@0.29.4) + '@better-auth/memory-adapter': 1.7.14(@better-auth/core@1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.1) + '@better-auth/mongo-adapter': 1.7.14(@better-auth/core@1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.1) + '@better-auth/prisma-adapter': 1.7.14(@better-auth/core@1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.1) + '@better-auth/telemetry': 1.7.14(@better-auth/core@1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3) + '@better-auth/utils': 0.5.1 + '@better-fetch/fetch': 1.3.3 '@noble/ciphers': 2.2.0 '@noble/hashes': 2.2.0 - better-call: 1.4.0(zod@4.4.3) + better-call: 1.4.4(zod@4.6.7) defu: 6.1.7 jose: 6.2.4 kysely: 0.29.4 nanostores: 1.4.1 - zod: 4.4.3 + zod: 4.6.7 optionalDependencies: - better-sqlite3: 13.0.2 - solid-js: 1.9.14 - vitest: 4.1.10(@types/node@22.20.1)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) + solid-js: 1.9.17 + vitest: 4.1.12(@types/node@22.20.1)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) transitivePeerDependencies: - - '@cloudflare/workers-types' - '@opentelemetry/api' - better-call@1.4.0(zod@3.25.76): + better-call@1.4.4(zod@4.6.7): dependencies: - '@better-auth/utils': 0.5.0 - '@better-fetch/fetch': 1.3.1 + '@better-auth/utils': 0.5.1 + '@better-fetch/fetch': 1.3.3 rou3: 0.9.2 set-cookie-parser: 3.1.2 optionalDependencies: - zod: 3.25.76 - - better-call@1.4.0(zod@4.4.3): - dependencies: - '@better-auth/utils': 0.5.0 - '@better-fetch/fetch': 1.3.1 - rou3: 0.9.2 - set-cookie-parser: 3.1.2 - optionalDependencies: - zod: 4.4.3 + zod: 4.6.7 better-sqlite3@12.11.1: dependencies: @@ -5267,15 +5254,15 @@ snapshots: inherits: 2.0.4 readable-stream: 3.6.2 - body-parser@2.3.0(supports-color@10.2.2): + body-parser@2.4.0(supports-color@10.2.2): dependencies: bytes: 3.1.2 - content-type: 2.0.0 + content-type: 2.1.0 debug: 4.4.3(supports-color@10.2.2) http-errors: 2.0.1 iconv-lite: 0.7.3 on-finished: 2.4.1 - qs: 6.16.0 + qs: 6.17.0 raw-body: 3.0.2 type-is: 2.1.0 transitivePeerDependencies: @@ -5292,7 +5279,7 @@ snapshots: widest-line: 5.0.0 wrap-ansi: 9.0.2 - brace-expansion@2.1.4: + brace-expansion@2.1.7: dependencies: balanced-match: 1.0.2 @@ -5446,6 +5433,8 @@ snapshots: content-type@2.0.0: {} + content-type@2.1.0: {} + convert-source-map@2.0.0: {} cookie-es@1.2.3: {} @@ -5815,14 +5804,14 @@ snapshots: dependencies: debug: 4.4.3(supports-color@10.2.2) express: 5.2.1(supports-color@10.2.2) - ip-address: 10.3.1 + ip-address: 10.7.5 transitivePeerDependencies: - supports-color express@5.2.1(supports-color@10.2.2): dependencies: accepts: 2.0.0 - body-parser: 2.3.0(supports-color@10.2.2) + body-parser: 2.4.0(supports-color@10.2.2) content-disposition: 1.1.0 content-type: 1.0.5 cookie: 0.7.2 @@ -5840,8 +5829,8 @@ snapshots: on-finished: 2.4.1 once: 1.4.0 parseurl: 1.3.3 - proxy-addr: 2.0.7 - qs: 6.16.0 + proxy-addr: 2.0.8 + qs: 6.17.0 range-parser: 1.3.0 router: 2.2.0(supports-color@10.2.2) send: 1.2.1(supports-color@10.2.2) @@ -5870,7 +5859,7 @@ snapshots: fast-levenshtein@2.0.6: {} - fast-uri@3.1.7: {} + fast-uri@3.1.9: {} fastq@1.20.1: dependencies: @@ -5919,7 +5908,7 @@ snapshots: flatted@3.4.4: {} - follow-redirects@1.16.0(debug@4.4.3(supports-color@10.2.2)): + follow-redirects@1.16.2(debug@4.4.3(supports-color@10.2.2)): optionalDependencies: debug: 4.4.3(supports-color@10.2.2) @@ -6063,7 +6052,7 @@ snapshots: dependencies: '@types/hast': 3.0.5 - hono@4.12.34: {} + hono@4.13.14: {} hookable@5.5.3: {} @@ -6086,7 +6075,7 @@ snapshots: http-proxy@1.18.1(debug@4.4.3(supports-color@10.2.2)): dependencies: eventemitter3: 4.0.7 - follow-redirects: 1.16.0(debug@4.4.3(supports-color@10.2.2)) + follow-redirects: 1.16.2(debug@4.4.3(supports-color@10.2.2)) requires-port: 1.0.0 transitivePeerDependencies: - debug @@ -6141,7 +6130,7 @@ snapshots: transitivePeerDependencies: - supports-color - ip-address@10.3.1: {} + ip-address@10.7.5: {} ipaddr.js@1.9.1: {} @@ -6225,7 +6214,7 @@ snapshots: js-tokens@9.0.1: {} - js-yaml@4.3.1: + js-yaml@4.3.2: dependencies: argparse: 2.0.1 @@ -6279,7 +6268,7 @@ snapshots: h3: 1.15.11 http-shutdown: 1.2.2 jiti: 2.7.0 - node-forge: 1.4.0 + node-forge: 1.4.2 pathe: 2.0.3 std-env: 4.2.0 tinyclip: 0.1.15 @@ -6327,7 +6316,7 @@ snapshots: dependencies: '@babel/parser': 7.29.7 '@babel/types': 7.29.7 - source-map-js: 1.2.1 + source-map-js: 1.2.2 math-intrinsics@1.1.0: {} @@ -6395,19 +6384,19 @@ snapshots: minimatch@10.2.6: dependencies: - brace-expansion: 2.1.4 + brace-expansion: 2.1.7 minimatch@3.1.5: dependencies: - brace-expansion: 2.1.4 + brace-expansion: 2.1.7 minimatch@5.1.9: dependencies: - brace-expansion: 2.1.4 + brace-expansion: 2.1.7 minimatch@9.0.9: dependencies: - brace-expansion: 2.1.4 + brace-expansion: 2.1.7 minimist@1.2.8: {} @@ -6440,7 +6429,7 @@ snapshots: negotiator@1.0.0: {} - nitropack@2.13.4(@parcel/watcher@2.6.0)(better-sqlite3@13.0.2)(supports-color@10.2.2)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)): + nitropack@2.13.4(@parcel/watcher@2.6.0)(better-sqlite3@13.0.2)(supports-color@10.2.2)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)): dependencies: '@cloudflare/kv-asset-handler': 0.4.2 '@rollup/plugin-alias': 6.0.0(rollup@4.62.3) @@ -6505,7 +6494,7 @@ snapshots: uncrypto: 0.1.3 unctx: 2.5.0 unenv: 2.0.0-rc.24 - unimport: 6.3.1(esbuild@0.28.1)(rollup@4.62.3)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) + unimport: 6.3.1(esbuild@0.28.1)(rollup@4.62.3)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) unplugin-utils: 0.3.2 unstorage: 1.17.5(db0@0.3.4(better-sqlite3@13.0.2))(ioredis@5.11.1(supports-color@10.2.2)) untyped: 2.0.0 @@ -6566,7 +6555,7 @@ snapshots: dependencies: whatwg-url: 5.0.0 - node-forge@1.4.0: {} + node-forge@1.4.2: {} node-gyp-build@4.8.4: {} @@ -6726,7 +6715,7 @@ snapshots: dependencies: nanoid: 3.3.18 picocolors: 1.1.1 - source-map-js: 1.2.1 + source-map-js: 1.2.2 powershell-utils@0.1.0: {} @@ -6759,7 +6748,7 @@ snapshots: property-information@7.2.0: {} - proxy-addr@2.0.7: + proxy-addr@2.0.8: dependencies: forwarded: 0.2.0 ipaddr.js: 1.9.1 @@ -6771,7 +6760,7 @@ snapshots: punycode@2.3.1: {} - qs@6.16.0: + qs@6.17.0: dependencies: es-define-property: 1.0.1 side-channel: 1.1.1 @@ -6983,13 +6972,17 @@ snapshots: transitivePeerDependencies: - supports-color - serialize-javascript@7.0.7: {} + serialize-javascript@7.1.4: {} - seroval-plugins@1.5.6(seroval@1.5.6): + seroval-plugins@1.5.6(seroval@1.7.3): dependencies: - seroval: 1.5.6 + seroval: 1.7.3 - seroval@1.5.6: {} + seroval-plugins@1.6.12(seroval@1.7.3): + dependencies: + seroval: 1.7.3 + + seroval@1.7.3: {} serve-placeholder@2.0.2: dependencies: @@ -7078,26 +7071,26 @@ snapshots: smob@1.6.2: {} - solid-js@1.9.14: + solid-js@1.9.17: dependencies: csstype: 3.2.3 - seroval: 1.5.6 - seroval-plugins: 1.5.6(seroval@1.5.6) + seroval: 1.7.3 + seroval-plugins: 1.6.12(seroval@1.7.3) - solid-refresh@0.6.3(solid-js@1.9.14)(supports-color@10.2.2): + solid-refresh@0.6.3(solid-js@1.9.17)(supports-color@10.2.2): dependencies: '@babel/generator': 7.29.7 '@babel/helper-module-imports': 7.29.7(supports-color@10.2.2) '@babel/types': 7.29.7 - solid-js: 1.9.14 + solid-js: 1.9.17 transitivePeerDependencies: - supports-color - solid-use@0.9.1(solid-js@1.9.14): + solid-use@0.9.1(solid-js@1.9.17): dependencies: - solid-js: 1.9.14 + solid-js: 1.9.17 - source-map-js@1.2.1: {} + source-map-js@1.2.2: {} source-map-support@0.5.21: dependencies: @@ -7244,10 +7237,10 @@ snapshots: - bare-abort-controller - react-native-b4a - terracotta@1.1.1(solid-js@1.9.14): + terracotta@1.1.1(solid-js@1.9.17): dependencies: - solid-js: 1.9.14 - solid-use: 0.9.1(solid-js@1.9.14) + solid-js: 1.9.17 + solid-use: 0.9.1(solid-js@1.9.17) terser@5.49.0: dependencies: @@ -7359,7 +7352,7 @@ snapshots: unicorn-magic@0.4.0: {} - unimport@6.3.1(esbuild@0.28.1)(rollup@4.62.3)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)): + unimport@6.3.1(esbuild@0.28.1)(rollup@4.62.3)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)): dependencies: acorn: 8.18.0 escape-string-regexp: 5.0.0 @@ -7373,7 +7366,7 @@ snapshots: scule: 1.3.0 strip-literal: 3.1.0 tinyglobby: 0.2.17 - unplugin: 3.3.0(esbuild@0.28.1)(rollup@4.62.3)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) + unplugin: 3.3.0(esbuild@0.28.1)(rollup@4.62.3)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) unplugin-utils: 0.3.2 transitivePeerDependencies: - '@farmfe/core' @@ -7422,7 +7415,7 @@ snapshots: picomatch: 4.0.5 webpack-virtual-modules: 0.6.2 - unplugin@3.3.0(esbuild@0.28.1)(rollup@4.62.3)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)): + unplugin@3.3.0(esbuild@0.28.1)(rollup@4.62.3)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)): dependencies: '@jridgewell/remapping': 2.3.5 picomatch: 4.0.5 @@ -7430,7 +7423,7 @@ snapshots: optionalDependencies: esbuild: 0.28.1 rollup: 4.62.3 - vite: 6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0) + vite: 6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0) unstorage@1.17.5(db0@0.3.4(better-sqlite3@13.0.2))(ioredis@5.11.1(supports-color@10.2.2)): dependencies: @@ -7518,7 +7511,7 @@ snapshots: hookable: 5.5.3 http-proxy: 1.18.1(debug@4.4.3(supports-color@10.2.2)) micromatch: 4.0.8 - nitropack: 2.13.4(@parcel/watcher@2.6.0)(better-sqlite3@13.0.2)(supports-color@10.2.2)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) + nitropack: 2.13.4(@parcel/watcher@2.6.0)(better-sqlite3@13.0.2)(supports-color@10.2.2)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) node-fetch-native: 1.6.7 path-to-regexp: 6.3.0 pathe: 1.1.2 @@ -7531,8 +7524,8 @@ snapshots: unctx: 2.5.0 unenv: 1.10.0 unstorage: 1.17.5(db0@0.3.4(better-sqlite3@13.0.2))(ioredis@5.11.1(supports-color@10.2.2)) - vite: 6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0) - zod: 4.4.3 + vite: 6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0) + zod: 4.6.7 transitivePeerDependencies: - '@azure/app-configuration' - '@azure/cosmos' @@ -7587,20 +7580,20 @@ snapshots: - xml2js - yaml - vite-plugin-solid@2.11.14(solid-js@1.9.14)(supports-color@10.2.2)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)): + vite-plugin-solid@2.11.14(solid-js@1.9.17)(supports-color@10.2.2)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)): dependencies: '@babel/core': 7.29.7(supports-color@10.2.2) '@types/babel__core': 7.20.5 - babel-preset-solid: 1.9.12(@babel/core@7.29.7(supports-color@10.2.2))(solid-js@1.9.14) + babel-preset-solid: 1.9.12(@babel/core@7.29.7(supports-color@10.2.2))(solid-js@1.9.17) merge-anything: 5.1.7 - solid-js: 1.9.14 - solid-refresh: 0.6.3(solid-js@1.9.14)(supports-color@10.2.2) - vite: 6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0) - vitefu: 1.1.3(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) + solid-js: 1.9.17 + solid-refresh: 0.6.3(solid-js@1.9.17)(supports-color@10.2.2) + vite: 6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0) + vitefu: 1.1.3(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) transitivePeerDependencies: - supports-color - vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0): + vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0): dependencies: esbuild: 0.25.12 fdir: 6.5.0(picomatch@4.0.5) @@ -7615,19 +7608,19 @@ snapshots: terser: 5.49.0 yaml: 2.9.0 - vitefu@1.1.3(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)): + vitefu@1.1.3(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)): optionalDependencies: - vite: 6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0) + vite: 6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0) - vitest@4.1.10(@types/node@22.20.1)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)): + vitest@4.1.12(@types/node@22.20.1)(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)): dependencies: - '@vitest/expect': 4.1.10 - '@vitest/mocker': 4.1.10(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) - '@vitest/pretty-format': 4.1.10 - '@vitest/runner': 4.1.10 - '@vitest/snapshot': 4.1.10 - '@vitest/spy': 4.1.10 - '@vitest/utils': 4.1.10 + '@vitest/expect': 4.1.12 + '@vitest/mocker': 4.1.12(vite@6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0)) + '@vitest/pretty-format': 4.1.12 + '@vitest/runner': 4.1.12 + '@vitest/snapshot': 4.1.12 + '@vitest/spy': 4.1.12 + '@vitest/utils': 4.1.12 es-module-lexer: 2.3.1 expect-type: 1.4.0 magic-string: 0.30.21 @@ -7639,7 +7632,7 @@ snapshots: tinyexec: 1.3.0 tinyglobby: 0.2.17 tinyrainbow: 3.1.1 - vite: 6.4.3(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0) + vite: 6.4.5(@types/node@22.20.1)(jiti@2.7.0)(terser@5.49.0)(yaml@2.9.0) why-is-node-running: 2.3.0 optionalDependencies: '@types/node': 22.20.1 @@ -7743,12 +7736,10 @@ snapshots: compress-commons: 6.0.2 readable-stream: 4.7.0 - zod-to-json-schema@3.25.2(zod@3.25.76): + zod-to-json-schema@3.25.2(zod@4.6.7): dependencies: - zod: 3.25.76 - - zod@3.25.76: {} + zod: 4.6.7 - zod@4.4.3: {} + zod@4.6.7: {} zwitch@2.0.4: {} diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index ac69e699..77ed0857 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -11,10 +11,21 @@ minimumReleaseAgeExclude: # framework targets rather than jumping to an RC. overrides: h3: ^1.15.11 # path traversal, SSE injection, request smuggling - hono: ^4.12.34 # ReDoS in CORS middleware - fast-uri: ^3.1.6 # host confusion via backslash; 3.1.6 also clears the four 2026 URI-parsing advisories (#62) - qs: ^6.16.0 # prototype pollution and DoS in query parsing, reached only through the MCP SDK's Express (#62) - brace-expansion: ^2.1.4 # DoS via unbounded intermediate arrays + hono: ^4.13.11 # ReDoS in CORS middleware; 4.13.11 also clears parseBody, query, serveStatic and JSX advisories + "@hono/node-server": ^2.1.3 # serveStatic double-decodes the request path + fast-uri: ^3.1.9 # host confusion, scheme spoofing and path equivalence in URI parsing (#62) + qs: ^6.16.1 # prototype pollution and DoS in query parsing, reached only through the MCP SDK's Express (#62) + brace-expansion: ^2.1.7 # DoS via recursion and quadratic expansion + seroval: ^1.6.10 # deserialization of attacker-chosen callables, DoS, script injection + proxy-addr: ^2.0.8 # IP spoofing via IPv4-mapped IPv6 trust check + body-parser: ^2.4.0 # DoS via trailing bytes + ip-address: ^10.7.4 # subnet and link-local misclassification, quadratic zone parsing + vite: ^6.4.4 # fs.allow bypass and launch-editor advisories in the dev server + follow-redirects: ^1.16.1 # cross-origin credential leak on redirect + node-forge: ^1.4.1 # RSA PKCS#1 v1.5 signature forgery + source-map-js: ^1.2.2 # event-loop DoS on crafted source maps + serialize-javascript: ^7.1.3 # XSS via unescaped input + js-yaml@4: ^4.3.2 # CPU DoS via merge keys (ESLint config loader) nanoid: ^3.3.17 # custom generators loop forever when size is zero # CI fails on a high or critical advisory in a production dependency. An diff --git a/src/routes/api/rpc/[fn].ts b/src/routes/api/rpc/[fn].ts index 8703ee55..bd58bce1 100644 --- a/src/routes/api/rpc/[fn].ts +++ b/src/routes/api/rpc/[fn].ts @@ -191,8 +191,11 @@ export async function POST(event: APIEvent) { // // Resolved for every procedure, not only the protected ones, because the // answer also decides whether this request is throttled. A request with no - // cookie never reaches the database for it. - const { auth } = await import("~/server/auth"); + // cookie never reaches the database for it. Better Auth does check the + // schema on every call, though, so the tables must exist first: on a fresh + // instance this can be the first request to reach auth at all. + const { auth, runAuthMigrations } = await import("~/server/auth"); + await runAuthMigrations(); const session = await auth.api.getSession({ headers: event.request.headers }); if (!session) { diff --git a/src/server/auth-upgrade.test.ts b/src/server/auth-upgrade.test.ts index 8d1b1439..66189b3d 100644 --- a/src/server/auth-upgrade.test.ts +++ b/src/server/auth-upgrade.test.ts @@ -3,11 +3,13 @@ import fs from "node:fs"; import os from "node:os"; import path from "node:path"; -// The 1.6 → 1.7 upgrade, on the database an existing deployment has: one -// admin row in an account table without the `issuer` column 1.7 requires. -// Better Auth's migrator refuses to add a required column to a populated -// table, so without the backfill in runAuthMigrations every upgraded -// instance threw at boot and could not sign in. Reproduced before the fix. +// Upgrades to the current Better Auth, from the account tables deployments +// have in the field. 1.6 had no `issuer` column. 1.7.0–1.7.2 added one, NOT +// NULL with a unique index; NoteMesh 1.3.0 backfilled it with a default on +// databases upgraded from 1.6. Later 1.7 releases dropped it and refuse to +// boot while a NOT NULL column they never write is present, so every +// deployment created on 1.3.0 threw at boot and could not sign in. +// Reproduced against a database written by 1.7.2 before the fix. let root: string; @@ -30,47 +32,77 @@ async function boot() { return auth; } -/** Turn a fresh 1.7 account table into the shape 1.6 left behind. */ -async function reshapeTo16() { +const KEPT = `id, accountId, providerId, userId, accessToken, refreshToken, idToken, + accessTokenExpiresAt, refreshTokenExpiresAt, scope, password, createdAt, updatedAt`; + +/** Rebuild the account table with the given `issuer` column definition and indexes. */ +async function reshape(issuer: string | null, indexes: string[] = []) { const { db } = await import("./db"); const d = db(); d.exec(` - CREATE TABLE account_16 AS SELECT id, accountId, providerId, userId, accessToken, refreshToken, idToken, - accessTokenExpiresAt, refreshTokenExpiresAt, scope, password, createdAt, updatedAt FROM account; + CREATE TABLE account_old AS SELECT * FROM account; DROP TABLE account; - ALTER TABLE account_16 RENAME TO account; + CREATE TABLE account ("id" text not null primary key, ${issuer ? `"issuer" ${issuer},` : ""} + "accountId" text not null, "providerId" text not null, + "userId" text not null references "user" ("id") on delete cascade, + "accessToken" text, "refreshToken" text, "idToken" text, "accessTokenExpiresAt" date, + "refreshTokenExpiresAt" date, "scope" text, "password" text, "createdAt" date not null, + "updatedAt" date not null); + INSERT INTO account (${issuer ? "issuer, " : ""}${KEPT}) + SELECT ${issuer ? "'local:credential', " : ""}${KEPT} FROM account_old; + DROP TABLE account_old; + CREATE INDEX "account_userId_idx" on "account" ("userId"); + ${indexes.join(";\n")} `); - const columns = (d.prepare("PRAGMA table_info(account)").all() as { name: string }[]).map((c) => c.name); - expect(columns).not.toContain("issuer"); return d; } -describe("upgrading a claimed 1.6 database", () => { - it("migrates, backfills the issuer, and the admin can still sign in", async () => { - const auth = await boot(); - await auth.api.signUpEmail({ - body: { email: "admin@example.com", password: "the-original-password", name: "Admin" }, - }); - const d = await reshapeTo16(); +const columns = (d: { prepare(sql: string): { all(): unknown[] } }) => + (d.prepare("PRAGMA table_info(account)").all() as { name: string }[]).map((c) => c.name); + +async function signUp() { + const auth = await boot(); + await auth.api.signUpEmail({ + body: { email: "admin@example.com", password: "the-original-password", name: "Admin" }, + }); +} + +async function expectSignIn(auth: Awaited>) { + const res = await auth.api.signInEmail({ + body: { email: "admin@example.com", password: "the-original-password" }, + }); + expect(res.user.email).toBe("admin@example.com"); +} +describe("upgrading the account table", () => { + it("drops the issuer column and index a 1.7.2 database has, and the admin can still sign in", async () => { + await signUp(); + const d = await reshape("text not null", [ + 'CREATE UNIQUE INDEX "account_issuer_accountId_uidx" on "account" ("issuer", "accountId")', + ]); const log = vi.spyOn(console, "log").mockImplementation(() => {}); const upgraded = await boot(); - expect(log).toHaveBeenCalledWith(expect.stringMatching(/added issuer/)); - expect(d.prepare("SELECT issuer FROM account").all()).toEqual([{ issuer: "local:credential" }]); + expect(log).toHaveBeenCalledWith(expect.stringMatching(/removed issuer/)); + expect(columns(d)).not.toContain("issuer"); + await expectSignIn(upgraded); + }); - const res = await upgraded.api.signInEmail({ - body: { email: "admin@example.com", password: "the-original-password" }, - }); - expect(res.user.email).toBe("admin@example.com"); + it("drops the column NoteMesh 1.3.0 backfilled on a database upgraded from 1.6", async () => { + await signUp(); + const d = await reshape("text not null default 'local:credential'", [ + 'CREATE UNIQUE INDEX "account_issuer_accountId_uidx" on "account" ("issuer", "accountId")', + ]); + const upgraded = await boot(); + expect(columns(d)).not.toContain("issuer"); + await expectSignIn(upgraded); }); - it("leaves a database that already has the column alone", async () => { - const auth = await boot(); - await auth.api.signUpEmail({ - body: { email: "admin@example.com", password: "the-original-password", name: "Admin" }, - }); + it("boots a 1.6 database, which never had the column", async () => { + await signUp(); + await reshape(null); const log = vi.spyOn(console, "log").mockImplementation(() => {}); - await boot(); - expect(log).not.toHaveBeenCalledWith(expect.stringMatching(/added issuer/)); + const upgraded = await boot(); + expect(log).not.toHaveBeenCalledWith(expect.stringMatching(/removed issuer/)); + await expectSignIn(upgraded); }); }); diff --git a/src/server/auth.ts b/src/server/auth.ts index c74d0b17..5104ff7b 100644 --- a/src/server/auth.ts +++ b/src/server/auth.ts @@ -253,28 +253,37 @@ let migrated = false; // Creates/updates Better Auth's own tables (user, session, account, // apikey, OAuth client/token tables) inside app.sqlite. Runs once per boot. -// Better Auth 1.7 added `issuer` to the account table: NOT NULL, no default. -// Its migrator refuses to add such a column to a populated table rather than -// invent a value, so a deployment upgraded from 1.6 — one admin row — would -// throw here on every boot and never sign in again. This server knows the -// value: every account it creates is an email-and-password one, which 1.7 -// records as "local:credential". Added with that backfill before the -// migrator runs, so it finds the column present and only adds its index. -// Reproduced and pinned against a 1.6-shaped populated table in -// auth-upgrade.test.ts. -function backfillAccountIssuer(): void { +// Better Auth 1.7.0–1.7.2 added a required `issuer` column to the account +// table, with a unique index on (issuer, accountId); later 1.7 releases took +// it out again. They never write it, and refuse to boot while the store has a +// NOT NULL column they don't write, so every deployment created on those +// versions would throw here and never sign in again. Deployments upgraded +// from 1.6 got the column from an earlier version of this function, with a +// default. Either way the value carries nothing: every account this server +// creates is an email-and-password one, recorded as "local:credential". So +// the index and the column come out before the migrator runs. Reproduced +// against a database written by 1.7.2 and pinned in auth-upgrade.test.ts. +function dropAccountIssuer(): void { const d = db(); const table = d.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'account'").get(); if (!table) return; const columns = d.prepare("PRAGMA table_info(account)").all() as { name: string }[]; - if (columns.some((c) => c.name === "issuer")) return; - d.exec("ALTER TABLE account ADD COLUMN issuer TEXT NOT NULL DEFAULT 'local:credential'"); - console.log("[auth] account table: added issuer for the Better Auth 1.7 upgrade"); + if (!columns.some((c) => c.name === "issuer")) return; + const indexes = d.prepare("PRAGMA index_list(account)").all() as { name: string; origin: string }[]; + d.transaction(() => { + for (const { name, origin } of indexes) { + if (origin !== "c") continue; + const cols = d.prepare("SELECT name FROM pragma_index_info(?)").all(name) as { name: string }[]; + if (cols.some((c) => c.name === "issuer")) d.exec(`DROP INDEX "${name.replaceAll('"', '""')}"`); + } + d.exec("ALTER TABLE account DROP COLUMN issuer"); + })(); + console.log("[auth] account table: removed issuer, which Better Auth no longer uses"); } export async function runAuthMigrations() { if (migrated) return; - backfillAccountIssuer(); + dropAccountIssuer(); const { runMigrations } = await getMigrations(auth.options); await runMigrations(); // The guard on the user table can only be created once Better Auth has From 90c369e59095428ee879f1b0e7b4469777825b64 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 29 Oct 2026 19:54:27 +0000 Subject: [PATCH 2/3] Restore em dash in package.json description Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01CgKUWtS6SvWsfLoeX4snXa --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 385db399..e72bb3e9 100644 --- a/package.json +++ b/package.json @@ -1,7 +1,7 @@ { "name": "notemesh", "version": "1.3.0", - "description": "Personal Obsidian vault MCP server \u2014 Railway template", + "description": "Personal Obsidian vault MCP server — Railway template", "type": "module", "private": true, "packageManager": "pnpm@11.16.0", From 9373490eb18f897580d34e0de8a19f0a996c7856 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 29 Oct 2026 21:24:17 +0000 Subject: [PATCH 3/3] Release 1.3.1 Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01CgKUWtS6SvWsfLoeX4snXa --- CHANGELOG.md | 2 +- package.json | 2 +- src/server/mcp/server.ts | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index bd276d86..b5297291 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -44,7 +44,7 @@ Two labels appear inside entries: If a release is quiet, that is the information. The intent is that the rare entry needing your attention cannot get lost among routine ones. -## Unreleased +## 1.3.1 — 2026-10-29 **Taking this update:** redeploy. Nothing else. diff --git a/package.json b/package.json index e72bb3e9..ba639a11 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "notemesh", - "version": "1.3.0", + "version": "1.3.1", "description": "Personal Obsidian vault MCP server — Railway template", "type": "module", "private": true, diff --git a/src/server/mcp/server.ts b/src/server/mcp/server.ts index db38cd3c..fa2e35fd 100644 --- a/src/server/mcp/server.ts +++ b/src/server/mcp/server.ts @@ -268,7 +268,7 @@ export function createMcpServer(access: McpAccess, req: RequestInfo = {}): McpSe // Reported to every client on connect, so it is the deployment's version // rather than a number that happens to live here. A test keeps it in step // with package.json. - version: "1.3.0", + version: "1.3.1", }); const writable = access.write;