Skip to content

chore(deps): bump the npm group across 1 directory with 13 updates#15

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/apps/web/npm-3f6803ed8c
Closed

chore(deps): bump the npm group across 1 directory with 13 updates#15
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/apps/web/npm-3f6803ed8c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 11, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the npm group with 13 updates in the /apps/web directory:

Package From To
@better-auth/infra 0.1.9-beta.1 0.2.0
@better-auth/utils 0.3.1 0.4.0
@tanstack/react-hotkeys 0.3.3 0.9.1
@vercel/analytics 1.6.1 2.0.1
auth 1.5.0-beta.18 1.6.2
better-auth 1.5.1 1.6.2
foxact 0.2.55 0.3.0
inngest 3.52.7 4.2.1
lucide-react 0.575.0 1.8.0
next 16.1.6 16.2.3
react 19.2.4 19.2.5
react-dom 19.2.4 19.2.5
shiki 3.23.0 4.0.2

Updates @better-auth/infra from 0.1.9-beta.1 to 0.2.0

Commits

Updates @better-auth/utils from 0.3.1 to 0.4.0

Release notes

Sourced from @​better-auth/utils's releases.

v0.4.0

   🚀 Features

    View changes on GitHub
Commits

Updates @tanstack/react-hotkeys from 0.3.3 to 0.9.1

Release notes

Sourced from @​tanstack/react-hotkeys's releases.

@​tanstack/react-hotkeys@​0.9.1

Patch Changes

  • Updated dependencies [0e46137]:
    • @​tanstack/hotkeys@​0.7.1

@​tanstack/react-hotkeys@​0.9.0

Minor Changes

  • feat: options.meta with name and descriptions by default and new useHotkeysRegistrations hooks (#95)

Patch Changes

  • Updated dependencies [63bfa22]:
    • @​tanstack/hotkeys@​0.7.0

@​tanstack/react-hotkeys@​0.8.4

Patch Changes

  • Updated dependencies [b04c88e]:
    • @​tanstack/hotkeys@​0.6.4

@​tanstack/react-hotkeys@​0.8.3

Patch Changes

  • Updated dependencies [1999147]:
    • @​tanstack/hotkeys@​0.6.3

@​tanstack/react-hotkeys@​0.8.2

Patch Changes

  • Updated dependencies [6939ac7]:
    • @​tanstack/hotkeys@​0.6.2

@​tanstack/react-hotkeys@​0.8.1

Patch Changes

  • chore: upgrade tanstack store version (19a960f)

  • Updated dependencies [19a960f]:

    • @​tanstack/hotkeys@​0.6.1

@​tanstack/react-hotkeys@​0.7.0

Minor Changes

  • Add plural sequence APIs (useHotkeySequences, createHotkeySequences, createHotkeySequencesAttachment, injectHotkeySequences) and align enabled across adapters: disabled registrations stay in the manager for devtools, only core dispatch is skipped, and toggling enabled updates handles via setOptions instead of churning unregister/register. (#80)

@​tanstack/react-hotkeys-devtools@​0.6.6

Patch Changes

... (truncated)

Changelog

Sourced from @​tanstack/react-hotkeys's changelog.

0.9.1

Patch Changes

  • Updated dependencies [0e46137]:
    • @​tanstack/hotkeys@​0.7.1

0.9.0

Minor Changes

  • feat: options.meta with name and descriptions by default and new useHotkeysRegistrations hooks (#95)

Patch Changes

  • Updated dependencies [63bfa22]:
    • @​tanstack/hotkeys@​0.7.0

0.8.4

Patch Changes

  • Updated dependencies [b04c88e]:
    • @​tanstack/hotkeys@​0.6.4

0.8.3

Patch Changes

  • Updated dependencies [1999147]:
    • @​tanstack/hotkeys@​0.6.3

0.8.2

Patch Changes

  • Updated dependencies [6939ac7]:
    • @​tanstack/hotkeys@​0.6.2

0.8.1

Patch Changes

  • chore: upgrade tanstack store version (19a960f)

  • Updated dependencies [19a960f]:

    • @​tanstack/hotkeys@​0.6.1

0.8.0

... (truncated)

Commits

Updates @vercel/analytics from 1.6.1 to 2.0.1

Release notes

Sourced from @​vercel/analytics's releases.

v2.0.1

What's Changed

New Contributors

Full Changelog: vercel/analytics@v2.0.0...v2.0.1

v2.0.0

What's Changed

Breaking Changes

  • License changed from MPL-2.0 to MIT (#170)
  • Nuxt: introduce module support. If you need to configure it, load injectAnalytics() from @vercel/analytics/nuxt/runtime (#183)

Features

  • feat: load dynamic configuration (#184) — analytics config can now be loaded dynamically

Bug Fixes

  • fix: src and endpoint paths do not work when relative (#186)

Full Changelog: vercel/speed-insights@1.6.1...2.0.0

v2.0.0-canary.1

Canary release for testing 2.0.0 changes

Commits

Updates auth from 1.5.0-beta.18 to 1.6.2

Release notes

Sourced from auth's releases.

v1.6.2

better-auth

❗ Breaking Changes

  • Prevented unverified TOTP enrollment from blocking sign-in (#8711)

Migration: Adds a verified column to the twoFactor table (defaults to true). Existing rows are unaffected. No data migration required.

Features

  • Included enabled 2FA methods in sign-in redirect response (#8772)

Bug Fixes

  • Fixed OAuth state verification against cookie-stored nonce to prevent CSRF (#8949)
  • Fixed infinite router refresh loops in nextCookies() by replacing cookie probe with header-based RSC detection (#9059)
  • Fixed cross-provider account collision in link-social callback (#8983)
  • Included RelayState in signed SAML AuthnRequests (#9058)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

  • Fixed multi-valued query params collapsing through prompt redirects (#9060)
  • Rejected skip_consent at schema level in dynamic client registration (#8998)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

  • Fixed SAMLResponse decoding failures caused by line-wrapped base64 (#8968)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​aarmful, @​cyphercodes, @​dvanmali, @​gustavovalverde, @​jaydeep-pipaliya, @​ping-maxwell

Full changelog: v1.6.1...v1.6.2

v1.6.1

better-auth

Bug Fixes

... (truncated)

Changelog

Sourced from auth's changelog.

1.6.2

Patch Changes

1.6.1

Patch Changes

1.6.0

Minor Changes

Patch Changes

1.6.0-beta.0

Minor Changes

Patch Changes

Commits
  • 700d298 chore: version packages (#9052)
  • e78a7b1 fix(two-factor): prevent unverified TOTP enrollment from gating sign-in (#8711)
  • 85bb710 chore: version packages (#9018)
  • d666a03 chore: exit pre-release mode for v1.6.0
  • 73beda2 chore: version packages (beta) (#8945)
  • 77ead28 chore: reset package versions to 1.5.6 (#8930)
  • e089ce1 chore(knip): fix CI blind spots and remove dead code (#8888)
  • e80cc38 fix: turbo caching, enforce lockfile integrity, expand pre-commit hooks (#8892)
  • 04e91d1 perf(build): reduce published package sizes (#8884)
  • d0b62a0 feat(cli): migrate MCP server URL to mcp.better-auth.com (#8747)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for auth since your current version.


Updates better-auth from 1.5.1 to 1.6.2

Release notes

Sourced from better-auth's releases.

v1.6.2

better-auth

❗ Breaking Changes

  • Prevented unverified TOTP enrollment from blocking sign-in (#8711)

Migration: Adds a verified column to the twoFactor table (defaults to true). Existing rows are unaffected. No data migration required.

Features

  • Included enabled 2FA methods in sign-in redirect response (#8772)

Bug Fixes

  • Fixed OAuth state verification against cookie-stored nonce to prevent CSRF (#8949)
  • Fixed infinite router refresh loops in nextCookies() by replacing cookie probe with header-based RSC detection (#9059)
  • Fixed cross-provider account collision in link-social callback (#8983)
  • Included RelayState in signed SAML AuthnRequests (#9058)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

  • Fixed multi-valued query params collapsing through prompt redirects (#9060)
  • Rejected skip_consent at schema level in dynamic client registration (#8998)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

  • Fixed SAMLResponse decoding failures caused by line-wrapped base64 (#8968)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​aarmful, @​cyphercodes, @​dvanmali, @​gustavovalverde, @​jaydeep-pipaliya, @​ping-maxwell

Full changelog: v1.6.1...v1.6.2

v1.6.1

better-auth

Bug Fixes

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.6.2

Patch Changes

  • #8949 9deb793 Thanks @​ping-maxwell! - security: verify OAuth state parameter against cookie-stored nonce to prevent CSRF on cookie-backed flows

  • #8983 2cbcb9b Thanks @​jaydeep-pipaliya! - fix(oauth2): prevent cross-provider account collision in link-social callback

    The link-social callback used findAccount(accountId) which matched by account ID across all providers. When two providers return the same numeric ID (e.g. both Google and GitHub assign 99999), the lookup could match the wrong provider's account, causing a spurious account_already_linked_to_different_user error or silently updating the wrong account's tokens.

    Replaced with findAccountByProviderId(accountId, providerId) to scope the lookup to the correct provider, matching the pattern already used in the generic OAuth plugin.

  • #9059 b20fa42 Thanks @​gustavovalverde! - fix(next-js): replace cookie probe with header-based RSC detection in nextCookies() to prevent infinite router refresh loops and eliminate leaked __better-auth-cookie-store cookie. Also fix two-factor enrollment flows to set the new session cookie before deleting the old session.

  • #9058 608d8c3 Thanks @​gustavovalverde! - fix(sso): include RelayState in signed SAML AuthnRequests per SAML 2.0 Bindings §3.4.4.1

    • RelayState is now passed to samlify's ServiceProvider constructor so it is included in the redirect binding signature. Previously it was appended after the signature, causing spec-compliant IdPs to reject signed AuthnRequests.
    • authnRequestsSigned: true without a private key now throws instead of silently sending unsigned requests.

  • #8772 8409843 Thanks @​aarmful! - feat(two-factor): include enabled 2fa methods in sign-in redirect response

    The 2FA sign-in redirect now returns twoFactorMethods (e.g. ["totp", "otp"]) so frontends can render the correct verification UI without guessing. The onTwoFactorRedirect client callback receives twoFactorMethods as a context parameter.

    • TOTP is included only when the user has a verified TOTP secret and TOTP is not disabled in config.
    • OTP is included when otpOptions.sendOTP is configured.
    • Unverified TOTP enrollments are excluded from the methods list.

  • #8711 e78a7b1 Thanks @​aarmful! - fix(two-factor): prevent unverified TOTP enrollment from gating sign-in

    Adds a verified boolean column to the twoFactor table that tracks whether a TOTP secret has been confirmed by the user.

    • First-time enrollment: enableTwoFactor creates the row with verified: false. The row is promoted to verified: true only after verifyTOTP succeeds with a valid code.
    • Re-enrollment (calling enableTwoFactor when TOTP is already verified): the new row preserves verified: true, so the user is never locked out of sign-in while rotating their TOTP secret.
    • Sign-in: verifyTOTP rejects rows where verified === false, preventing abandoned enrollments from blocking authentication. Backup codes and OTP are unaffected and work as fallbacks during unfinished enrollment.

    Migration: The new column defaults to true, so existing twoFactor rows are treated as verified. No data migration is required. skipVerificationOnEnable: true is also unaffected — the row is created as verified: true in that mode.

  • Updated dependencies []:

    • @​better-auth/core@​1.6.2
    • @​better-auth/drizzle-adapter@​1.6.2
    • @​better-auth/kysely-adapter@​1.6.2
    • @​better-auth/memory-adapter@​1.6.2
    • @​better-auth/mongo-adapter@​1.6.2
    • @​better-auth/prisma-adapter@​1.6.2
    • @​better-auth/telemetry@​1.6.2

1.6.1

Patch Changes

... (truncated)

Commits
  • 700d298 chore: version packages (#9052)
  • b20fa42 fix(next-js): replace cookie probe with header-based RSC detection in nextCoo...
  • 2cbcb9b fix(oauth2): prevent cross-provider account collision in link-social callback...
  • 9deb793 fix: cookie store strategy should verify oauth state (#8949)
  • 8409843 feat(two-factor): include enabled 2fa methods in sign-in redirect response (#...
  • e78a7b1 fix(two-factor): prevent unverified TOTP enrollment from gating sign-in (#8711)
  • 85bb710 chore: version packages (#9018)
  • 7495830 fix(api): restore getSession accessibility in generic Auth<O> context (#9017)
  • 2e537df fix: endpoint instrumentation to always use route template (#9023)
  • f61ad1c fix: use INVALID_PASSWORD for all checkPassword failures (#8902)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for better-auth since your current version.


Updates foxact from 0.2.55 to 0.3.0

Release notes

Sourced from foxact's releases.

0.3.0

BREAKING CHANGES

  • Remove foxact/use-next-link
    • This hook was implemented before Next.js useLinkStatus API was implemented, which you should use instead.
  • Remove foxact/use-next-pathname
    • You can import usePathname from next/navigation in your Next.js Pages Router app (yes that's supported).
  • Remove foxact/use-react-router-enable-concurrent-navigation
    • The hook was implemented before React Router had implemented the native concurrent navigation support, which is enabled by default now in React Router v7. If you are on React Router v6, enable v7_startTransition flag instead.
  • Remove foxact/use-react-router-is-match
Commits

Updates inngest from 3.52.7 to 4.2.1

Release notes

Sourced from inngest's releases.

inngest@4.2.1

Patch Changes

inngest@4.2.0

Minor Changes

inngest@4.1.2

Patch Changes

inngest@4.1.1

Patch Changes

inngest@4.1.0

Minor Changes

inngest@4.0.5

Patch Changes

inngest@4.0.4

Patch Changes

inngest@4.0.3

Patch Changes

... (truncated)

Changelog

Sourced from inngest's changelog.

4.2.1

Patch Changes

4.2.0

Minor Changes

4.1.2

Patch Changes

4.1.1

Patch Changes

4.1.0

Minor Changes

4.0.5

Patch Changes

4.0.4

Patch Changes

... (truncated)

Commits

Updates lucide-react from 0.575.0 to 1.8.0

Release notes

Sourced from lucide-react's releases.

Version 1.8.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.7.0...1.8.0

Version 1.7.0

What's Changed

@dependabot
chore(deps): bump the npm group across 1 directory with 13 updates
8a3e931 
Bumps the npm group with 13 updates in the /apps/web directory:

| Package | From | To |
| --- | --- | --- |
| [@better-auth/infra](https://github.com/better-auth/better-auth-infra/tree/HEAD/packages/infra) | `0.1.9-beta.1` | `0.2.0` |
| [@better-auth/utils](https://github.com/better-auth/utils) | `0.3.1` | `0.4.0` |
| [@tanstack/react-hotkeys](https://github.com/TanStack/hotkeys/tree/HEAD/packages/react-hotkeys) | `0.3.3` | `0.9.1` |
| [@vercel/analytics](https://github.com/vercel/analytics/tree/HEAD/packages/web) | `1.6.1` | `2.0.1` |
| [auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/cli) | `1.5.0-beta.18` | `1.6.2` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.5.1` | `1.6.2` |
| [foxact](https://github.com/SukkaW/foxact) | `0.2.55` | `0.3.0` |
| [inngest](https://github.com/inngest/inngest-js/tree/HEAD/packages/inngest) | `3.52.7` | `4.2.1` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `0.575.0` | `1.8.0` |
| [next](https://github.com/vercel/next.js) | `16.1.6` | `16.2.3` |
| [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `19.2.4` | `19.2.5` |
| [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `19.2.4` | `19.2.5` |
| [shiki](https://github.com/shikijs/shiki/tree/HEAD/packages/shiki) | `3.23.0` | `4.0.2` |



Updates `@better-auth/infra` from 0.1.9-beta.1 to 0.2.0
- [Commits](https://github.com/better-auth/better-auth-infra/commits/HEAD/packages/infra)

Updates `@better-auth/utils` from 0.3.1 to 0.4.0
- [Release notes](https://github.com/better-auth/utils/releases)
- [Commits](better-auth/utils@v0.3.1...v0.4.0)

Updates `@tanstack/react-hotkeys` from 0.3.3 to 0.9.1
- [Release notes](https://github.com/TanStack/hotkeys/releases)
- [Changelog](https://github.com/TanStack/hotkeys/blob/main/packages/react-hotkeys/CHANGELOG.md)
- [Commits](https://github.com/TanStack/hotkeys/commits/@tanstack/react-hotkeys@0.9.1/packages/react-hotkeys)

Updates `@vercel/analytics` from 1.6.1 to 2.0.1
- [Release notes](https://github.com/vercel/analytics/releases)
- [Commits](https://github.com/vercel/analytics/commits/v2.0.1/packages/web)

Updates `auth` from 1.5.0-beta.18 to 1.6.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/cli/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/auth@1.6.2/packages/cli)

Updates `better-auth` from 1.5.1 to 1.6.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/better-auth@1.6.2/packages/better-auth)

Updates `foxact` from 0.2.55 to 0.3.0
- [Release notes](https://github.com/SukkaW/foxact/releases)
- [Commits](SukkaW/foxact@0.2.55...0.3.0)

Updates `inngest` from 3.52.7 to 4.2.1
- [Release notes](https://github.com/inngest/inngest-js/releases)
- [Changelog](https://github.com/inngest/inngest-js/blob/main/packages/inngest/CHANGELOG.md)
- [Commits](https://github.com/inngest/inngest-js/commits/inngest@4.2.1/packages/inngest)

Updates `lucide-react` from 0.575.0 to 1.8.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.8.0/packages/lucide-react)

Updates `next` from 16.1.6 to 16.2.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v16.1.6...v16.2.3)

Updates `react` from 19.2.4 to 19.2.5
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.5/packages/react)

Updates `react-dom` from 19.2.4 to 19.2.5
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.5/packages/react-dom)

Updates `shiki` from 3.23.0 to 4.0.2
- [Release notes](https://github.com/shikijs/shiki/releases)
- [Commits](https://github.com/shikijs/shiki/commits/v4.0.2/packages/shiki)

---
updated-dependencies:
- dependency-name: "@better-auth/infra"
  dependency-version: 0.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@better-auth/utils"
  dependency-version: 0.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@tanstack/react-hotkeys"
  dependency-version: 0.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@vercel/analytics"
  dependency-version: 2.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm
- dependency-name: auth
  dependency-version: 1.6.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: better-auth
  dependency-version: 1.6.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: foxact
  dependency-version: 0.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: inngest
  dependency-version: 4.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm
- dependency-name: lucide-react
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm
- dependency-name: next
  dependency-version: 16.2.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: react
  dependency-version: 19.2.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: react-dom
  dependency-version: 19.2.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: shiki
  dependency-version: 4.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 11, 2026
@sonarqubecloud

sonarqubecloud Bot commented Apr 11, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@codecov

codecov Bot commented Apr 11, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@dependabot @github

dependabot Bot commented on behalf of github Apr 18, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Apr 18, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/apps/web/npm-3f6803ed8c branch April 18, 2026 05:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants