[dependabot]

Bumps the dependencies group with 41 updates in the / directory:

Package	From	To
@better-auth/api-key	1.6.29	1.7.5
@better-auth/prisma-adapter	1.6.29	1.7.5
@prisma/adapter-pg	7.9.1	7.10.0
@prisma/client	7.9.1	7.10.0
@prisma/client-runtime-utils	7.9.1	7.10.0
@sentry/nextjs	10.69.0	10.75.2
@supabase/ssr	0.12.4	0.12.7
@supabase/supabase-js	2.111.0	2.117.0
@zxcvbn-ts/core	4.1.2	4.2.0
better-auth	1.6.29	1.7.5
cesium	1.143.0	1.145.0
hls.js	1.6.16	1.7.3
lucide-react	1.28.0	1.47.0
next	16.3.3	16.3.6
pg	8.22.0	8.23.0
@types/pg	8.20.2	8.23.1
prisma	7.9.1	7.10.0
react	19.2.8	19.3.0
@types/react	19.2.18	19.3.0
react-dom	19.2.8	19.3.0
@types/react-dom	19.2.4	19.3.0
resium	1.24.0	1.26.0
undici	8.9.0	8.11.0
ws	8.21.1	8.21.3
zod	4.4.3	4.6.5
zustand	5.0.14	5.0.15
@eslint/compat	2.1.0	2.1.1
@eslint/eslintrc	3.3.6	3.3.7
@pact-foundation/pact	17.0.1	17.1.4
@pact-foundation/pact-cli	18.1.1	18.1.2
@playwright/test	1.62.1	1.63.0
@testing-library/dom	10.4.1	10.4.2
@testing-library/react	16.3.2	16.3.3
@types/node	26.1.2	26.6.2
@types/react	19.2.18	19.3.0
@types/react-dom	19.2.4	19.3.0
@typescript-eslint/eslint-plugin	8.65.0	8.70.1
@typescript-eslint/parser	8.65.0	8.70.1
@vitejs/plugin-react	6.0.5	6.1.1
eslint-config-next	16.2.12	16.3.6
fast-check	4.9.0	4.10.2
supabase	2.111.0	2.117.0
tsx	4.23.13	4.23.15

Updates @better-auth/api-key from 1.6.29 to 1.7.5

Release notes

Sourced from @​better-auth/api-key's releases.

v1.7.5

better-auth

Features

• Added database.schemaName support for direct PostgreSQL connections. (#11203)

Bug Fixes

• Improved server-side logging for Cloudflare Turnstile verification failures. (#11283)
• Fixed PostgreSQL migrations incorrectly identifying tables and views across schemas. (#11270)
• Fixed MySQL index validation for existing string columns. (#11272)
• Removed the unused optional better-sqlite3 peer dependency to prevent installation conflicts. (#11209)

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added database.schemaName support for direct PostgreSQL connections. (#11203)

Bug Fixes

• Fixed database option type inference outside Cloudflare Workers. (#11290)

For detailed changes, see CHANGELOG

@better-auth/cimd

Bug Fixes

• Fixed unnecessary pacing of consecutive CIMD OAuth requests when metadata cannot be cached. (#11161)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed lazy database initialization when using Drizzle relations. (#11263)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Features

• Added database.schemaName support for direct PostgreSQL connections. (#11203)

... (truncated)

Changelog

Sourced from @​better-auth/api-key's changelog.

1.7.5

1.7.4

1.7.3

1.7.2

1.7.1

1.7.0

1.7.0-rc.6

1.7.0-rc.5

1.7.0-rc.4

1.7.0-rc.3

1.7.0-rc.2

1.7.0-rc.1

1.7.0-rc.0

1.7.0-beta.10

1.7.0-beta.9

Patch Changes

• Updated dependencies []:
  • better-auth@1.7.0-beta.9
  • @​better-auth/core@​1.7.0-beta.9

1.7.0-beta.8

Patch Changes

• Updated dependencies [7c7313c, 06daf70, a83152e, 97903c9, 3a79aff]:
  • better-auth@1.7.0-beta.8
  • @​better-auth/core@​1.7.0-beta.8

1.7.0-beta.7

Patch Changes

• Updated dependencies [3d04fab, de8394d]:
  • better-auth@1.7.0-beta.7

... (truncated)

Commits

• 5468e6b chore: release v1.7.5 (#11245)
• 735008f chore: release v1.7.4 (#11216)
• 597d39c chore: release v1.7.3 (#11032)
• c0444dc fix: align OpenAPI required fields with Zod 4.5 (#11066)
• ba12fcd chore: release v1.7.2 (#10870)
• 2344536 chore: release v1.7.1 (#10864)
• f577ec5 chore: exit pre-release mode for v1.7.0
• 69258d1 chore: sync main to next
• e84ec5e chore: release v1.6.30 (#10840)
• bc93b27 chore: release v1.7.0-rc.6 (#10772)
• Additional commits viewable in compare view

Updates @better-auth/prisma-adapter from 1.6.29 to 1.7.5

Release notes

Sourced from @​better-auth/prisma-adapter's releases.

v1.7.5

better-auth

Features

• Added database.schemaName support for direct PostgreSQL connections. (#11203)

Bug Fixes

• Improved server-side logging for Cloudflare Turnstile verification failures. (#11283)
• Fixed PostgreSQL migrations incorrectly identifying tables and views across schemas. (#11270)
• Fixed MySQL index validation for existing string columns. (#11272)
• Removed the unused optional better-sqlite3 peer dependency to prevent installation conflicts. (#11209)

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added database.schemaName support for direct PostgreSQL connections. (#11203)

Bug Fixes

• Fixed database option type inference outside Cloudflare Workers. (#11290)

For detailed changes, see CHANGELOG

@better-auth/cimd

Bug Fixes

• Fixed unnecessary pacing of consecutive CIMD OAuth requests when metadata cannot be cached. (#11161)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed lazy database initialization when using Drizzle relations. (#11263)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Features

• Added database.schemaName support for direct PostgreSQL connections. (#11203)

... (truncated)

Changelog

Sourced from @​better-auth/prisma-adapter's changelog.

1.7.5

1.7.4

1.7.3

Patch Changes

• #11179 352d012 Thanks @​bytaesu! - Validate Drizzle schema objects and generated Prisma client models during initialization, including in production, and report mismatches with guidance for fixing them. These checks do not query the database and cannot detect unapplied migrations.

  For Prisma clients whose model metadata omits nullability, auth generate reports required fields that Better Auth never writes by reading the existing Prisma schema. Set advanced.database.validateSchema: false to disable runtime validation.

1.7.2

1.7.1

1.7.0

1.7.0-rc.6

1.7.0-rc.5

1.7.0-rc.4

1.7.0-rc.3

1.7.0-rc.2

1.7.0-rc.1

1.7.0-rc.0

1.7.0-beta.10

1.7.0-beta.9

Patch Changes

• Updated dependencies []:
  • @​better-auth/core@​1.7.0-beta.9

1.7.0-beta.8

Patch Changes

• Updated dependencies [7c7313c, 97903c9, 3a79aff]:
  • @​better-auth/core@​1.7.0-beta.8

1.7.0-beta.7

... (truncated)

Commits

• 5468e6b chore: release v1.7.5 (#11245)
• 735008f chore: release v1.7.4 (#11216)
• 597d39c chore: release v1.7.3 (#11032)
• 352d012 feat(adapters): register Drizzle and Prisma schema checks (#11179)
• 2220ee7 revert: drop the issuer column and resolve accounts by provider id (#11153)
• ba4840f feat(adapters): expose SQL migration connections (#10966)
• ba12fcd chore: release v1.7.2 (#10870)
• 2344536 chore: release v1.7.1 (#10864)
• f577ec5 chore: exit pre-release mode for v1.7.0
• 69258d1 chore: sync main to next
• Additional commits viewable in compare view

Updates @prisma/adapter-pg from 7.9.1 to 7.10.0

Release notes

Sourced from @​prisma/adapter-pg's releases.

7.10.0

Prisma ORM 7.10.0

Prisma ORM 7.10.0 introduces a compatibility package for running Prisma 7 alongside newer Prisma versions, secures Prisma Studio's local server, and includes fixes across Prisma Client and the PostgreSQL, MariaDB, Neon, SQLite, and Prisma Postgres Serverless adapters.

Highlights

Run Prisma 7 alongside Prisma 8

This release introduces @prisma/prisma7, a compatibility package that lets you retain a matching Prisma 7 CLI and configuration while installing Prisma 8 in the same project.

Once 7.10.0 is released, a side-by-side installation can use:

npm install --save-dev prisma@8 @prisma/prisma7@7.10.0
npm install @prisma/client@7.10.0

Use prisma for the directly installed Prisma 8 CLI and prisma7 for Prisma 7:

npx prisma --version
npx prisma7 --version
npx prisma7 generate
npx prisma7 migrate dev
npx prisma7 db push

Prisma 7 now prefers version-specific configuration files, allowing its configuration to coexist with Prisma 8's prisma.config.* files:

// prisma7.config.ts
import { defineConfig } from '@prisma/prisma7/config'
export default defineConfig({
schema: 'prisma/schema.prisma',
migrations: {
path: 'prisma/migrations',
},
})

Without an explicit --config option, Prisma 7 searches for:

1. Root-level prisma7.config.* files.
2. .config/prisma7.* files.
3. Existing prisma.config.* files as a backwards-compatible fallback.

The supported extensions are .js, .ts, .mjs, .cjs, .mts, and .cts. An explicit config path always takes precedence:

... (truncated)

Commits

• 3fa65ac fix(p2002): correct modelName in nested create unique constraint errors #2959...
• a180209 fix(adapter-pg): map PostgreSQL deadlocks to P2034 (#29717)
• 800f1d1 fix(adapter-pg): preserve constraint name for unique violations (23505) (#29587)
• 7ef2104 fix(postgres): handle SQLSTATE 23001 for RESTRICT violations (#29554)
• See full diff in compare view

Updates @prisma/client from 7.9.1 to 7.10.0

Release notes

Sourced from @​prisma/client's releases.

7.10.0

Prisma ORM 7.10.0

Prisma ORM 7.10.0 introduces a compatibility package for running Prisma 7 alongside newer Prisma versions, secures Prisma Studio's local server, and includes fixes across Prisma Client and the PostgreSQL, MariaDB, Neon, SQLite, and Prisma Postgres Serverless adapters.

Highlights

Run Prisma 7 alongside Prisma 8

This release introduces @prisma/prisma7, a compatibility package that lets you retain a matching Prisma 7 CLI and configuration while installing Prisma 8 in the same project.

Once 7.10.0 is released, a side-by-side installation can use:

npm install --save-dev prisma@8 @prisma/prisma7@7.10.0
npm install @prisma/client@7.10.0

Use prisma for the directly installed Prisma 8 CLI and prisma7 for Prisma 7:

npx prisma --version
npx prisma7 --version
npx prisma7 generate
npx prisma7 migrate dev
npx prisma7 db push

Prisma 7 now prefers version-specific configuration files, allowing its configuration to coexist with Prisma 8's prisma.config.* files:

// prisma7.config.ts
import { defineConfig } from '@prisma/prisma7/config'
export default defineConfig({
schema: 'prisma/schema.prisma',
migrations: {
path: 'prisma/migrations',
},
})

Without an explicit --config option, Prisma 7 searches for:

1. Root-level prisma7.config.* files.
2. .config/prisma7.* files.
3. Existing prisma.config.* files as a backwards-compatible fallback.

The supported extensions are .js, .ts, .mjs, .cjs, .mts, and .cts. An explicit config path always takes precedence:

... (truncated)

Commits

• 05c1b88 Teach Prisma 7 to prefer versioned config files (#30020)
• cf2bc1f Rename prisma7 package to @​prisma/prisma7 (#30002)
• ce5a34c Complete downstream actionable Prisma 7 guidance propagation (#29994)
• 3f13ec6 Complete CLI-owned prisma7 distribution identity (#29969)
• 179ba0c feat(prisma7): add side-by-side CLI wrapper (#29949)
• 3fa65ac fix(p2002): correct modelName in nested create unique constraint errors #2959...
• 6b6d9e9 chore(deps): update engines to 7.10.0-4.0edf323efd1d98336f3f0a68684b56f689b90...
• b64e33c chore(deps): update engines to 7.10.0-3.9d90ce2c89d5c95a1148aef15e5561ab6c490...
• 2046f9b feat(client): expose ModelName to compute function in Result extensions (#29782)
• f2b3abd chore(deps): update engines to 7.10.0-1.6d040c802892de6d56c7e0061b7a10b3e6a0c...
• Additional commits viewable in compare view

Updates @prisma/client-runtime-utils from 7.9.1 to 7.10.0

Release notes

Sourced from @​prisma/client-runtime-utils's releases.

7.10.0

Prisma ORM 7.10.0

Prisma ORM 7.10.0 introduces a compatibility package for running Prisma 7 alongside newer Prisma versions, secures Prisma Studio's local server, and includes fixes across Prisma Client and the PostgreSQL, MariaDB, Neon, SQLite, and Prisma Postgres Serverless adapters.

Highlights

Run Prisma 7 alongside Prisma 8

This release introduces @prisma/prisma7, a compatibility package that lets you retain a matching Prisma 7 CLI and configuration while installing Prisma 8 in the same project.

Once 7.10.0 is released, a side-by-side installation can use:

npm install --save-dev prisma@8 @prisma/prisma7@7.10.0
npm install @prisma/client@7.10.0

Use prisma for the directly installed Prisma 8 CLI and prisma7 for Prisma 7:

npx prisma --version
npx prisma7 --version
npx prisma7 generate
npx prisma7 migrate dev
npx prisma7 db push

Prisma 7 now prefers version-specific configuration files, allowing its configuration to coexist with Prisma 8's prisma.config.* files:

// prisma7.config.ts
import { defineConfig } from '@prisma/prisma7/config'
export default defineConfig({
schema: 'prisma/schema.prisma',
migrations: {
path: 'prisma/migrations',
},
})

Without an explicit --config option, Prisma 7 searches for:

1. Root-level prisma7.config.* files.
2. .config/prisma7.* files.
3. Existing prisma.config.* files as a backwards-compatible fallback.

The supported extensions are .js, .ts, .mjs, .cjs, .mts, and .cts. An explicit config path always takes precedence:

... (truncated)

Commits

• See full diff in compare view

Updates @sentry/nextjs from 10.69.0 to 10.75.2

Release notes

Sourced from @​sentry/nextjs's releases.

10.75.2

• fix(v10/cloudflare): Enforce flush timeout across Workflow lifecycle (#24582)
• fix(v10/core): Apply dataCollection.urlQueryParams to collected URLs and query strings (#24572)
• fix(v10/nextjs): Align tunnel request matching in middleware with tunnel rewrite (#24565)
• fix(v10/node): Stop leaking unhandled rejections on aborted Vercel AI streams (#24563)

Bundle size 📦

Path	Size
@​sentry/browser	27.56 KB
@​sentry/browser - with treeshaking flags	26.04 KB
@​sentry/browser (incl. Tracing)	46.02 KB
@​sentry/browser (incl. Tracing + Span Streaming)	47.77 KB
@​sentry/browser (incl. Tracing, Profiling)	50.67 KB
@​sentry/browser (incl. Tracing, Replay)	84.38 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags	74.28 KB
@​sentry/browser (incl. Tracing, Replay with Canvas)	89 KB
@​sentry/browser (incl. Tracing, Replay, Feedback)	101.33 KB
@​sentry/browser (incl. Feedback)	44.33 KB
@​sentry/browser (incl. sendFeedback)	32.25 KB
@​sentry/browser (incl. FeedbackAsync)	37.27 KB
@​sentry/browser (incl. Metrics)	28.63 KB
@​sentry/browser (incl. Logs)	28.84 KB
@​sentry/browser (incl. Metrics & Logs)	29.52 KB
@​sentry/react	29.32 KB
@​sentry/react (incl. Tracing)	48.28 KB
@​sentry/vue	32.88 KB
@​sentry/vue (incl. Tracing)	47.98 KB
@​sentry/svelte	27.58 KB
CDN Bundle	29.87 KB
CDN Bundle (incl. Tracing)	47.92 KB
CDN Bundle (incl. Logs, Metrics)	31.41 KB
CDN Bundle (incl. Tracing, Logs, Metrics)	49.21 KB
CDN Bundle (incl. Replay, Logs, Metrics)	69.82 KB
CDN Bundle (incl. Tracing, Replay)	84.64 KB
CDN Bundle (incl. Tracing, Replay, Logs, Metrics)	85.87 KB
CDN Bundle (incl. Tracing, Replay, Feedback)	90.31 KB
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics)	91.55 KB
CDN Bundle - uncompressed	88.83 KB
CDN Bundle (incl. Tracing) - uncompressed	144.49 KB
CDN Bundle (incl. Logs, Metrics) - uncompressed	93.43 KB
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed	148.38 KB
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed	215.46 KB
CDN Bundle (incl. Tracing, Replay) - uncompressed	261.12 KB
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed	264.99 KB
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	274.5 KB
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed	278.36 KB
@​sentry/nextjs (client)	50.75 KB
@​sentry/sveltekit (client)	46.46 KB

... (truncated)

Changelog

Sourced from @​sentry/nextjs's changelog.

10.75.2

• fix(v10/cloudflare): Enforce flush timeout across Workflow lifecycle (#24582)
• fix(v10/core): Apply dataCollection.urlQueryParams to collected URLs and query strings (#24572)
• fix(v10/nextjs): Align tunnel request matching in middleware with tunnel rewrite (#24565)
• fix(v10/node): Stop leaking unhandled rejections on aborted Vercel AI streams (#24563)

10.75.1

• fix(v10/cloudflare): Capture telemetry from untraced Durable Object RPC calls (#24512)
• fix(v10/cloudflare): Instrument namespaces returned by jurisdiction() (#24513)
• fix(v10/hono): Allow @​cloudflare/workers-types v5 as peer dependency (#24500)
• fix(v10/nextjs): Resolve Next.js version relative to the SDK when cwd differs (#24475)

10.75.0

Important Changes

• feat(v10/effect): Capture errors through the Effect v4 ErrorReporter API (#24445)

  On Effect v4, Sentry.effectLayer now registers a Sentry ErrorReporter. Failures that pass through Effect.withErrorReporting, ErrorReporter.report or the built-in HTTP and RPC reporting boundaries are captured automatically, with ErrorReporter.ignore, ErrorReporter.severity and ErrorReporter.attributes annotations respected. Nothing changes on Effect v3.

Other Changes

• feat(v10/core): Accept a CollectBehavior shorthand for dataCollection.httpHeaders (#24339)
• fix(v10/browser): Release the XHR virtualError once the request completed (#24307)
• fix(v10/browser-utils): Skip nullish LCP entries in vendored web-vitals (#24349)
• fix(v10/bundler-plugins): Stamp debug IDs onto emitted source maps when disable-upload is set (#24332)
• fix(v10/core): Don't instrument the SDK's own envelope requests (#24276)
• fix(v10/nextjs): Only include emitted chunk directories in Turbopack sourcemap upload (#24295)
• fix(v10/nitro): Import from nitro/h3 instead of h3 directly (#24444)
• fix(v10/node-core): Don't recurse in logAndExitProcess on a broken stdio pipe (#24353)
• fix(v10/nuxt): Detect Nitro version via the app's Nuxt dependency chain (#24025)
• fix(v10/replay): Don't rewrite already-emitted nodes when syncing mirror attributes (#23588)

10.74.0

• feat(v10): Streamline isolation scope handling & reset in isolation scopes (#24152)
• fix(server-utils): Include Gemini reasoning tokens in Vercel AI token usage (#23433)
• fix(v10/browser): Set user_agent.original on all spans for consistent filtering (#24226)
• fix(v10/cloudflare): Auto-instrument classes re-exported from the worker entry (#24181)
• fix(v10/core): Guard loadModule default parameter against ESM scope (#24154)
• fix(v10/core): Match wrapped Facebook Mobile browser errors in DEFAULT_IGNORE_ERRORS (#23877)
• fix(v10/core): Resolve MCP capture policy per operation (#23796)
• fix(v10/nextjs): Fix SDK import crashing under jsdom/happy-dom (#23906)
• fix(v10/nextjs): Keep the Pages Router runtime out of App Router client bundles (#24223)
• fix(v10/nextjs): Register Vercel AI span processors on Next.js (#23773)
• fix(v10/nuxt): Windows file:// for import-in-the-middle hook and isAbsolute for C:\ (#24026)
• fix(v10/profiling-node): Bump @​sentry/node-cpu-profiler to 2.4.4 (#24238)
• fix(v10/sveltekit): Handle SvelteKit 3 error kinds in handleErrorWithSentry (#23995)

... (truncated)

Commits

• faeac9a release: 10.75.2
• 7175b19 meta(changelog): Update changelog for 10.75.2 (#24585)
• 8f5dc60 fix(v10/cloudflare): Enforce flush timeout across Workflow lifecycle (#24582)
• 44506df fix(v10/node): Stop leaking unhandled rejections on aborted Vercel AI streams...
• c0eb753 fix(v10/core): Apply dataCollection.urlQueryParams to collected URLs and qu...
• d525a2f fix(v10/nextjs): Align tunnel request matching in middleware with tunnel rewr...
• 5b03e28 Merge remote-tracking branch 'remotes/origin/release/10.75.1' into v10
• 8025a92 release: 10.75.1
• d1462b2 meta(changelog): Update changelog for 10.75.1 (#24561)
• c8f750f fix(v10/cloudflare): Capture telemetry from untraced Durable Object RPC calls...
• Additional commits viewable in compare view

Updates @supabase/ssr from 0.12.4 to 0.12.7

Release notes

Sourced from @​supabase/ssr's releases.

v0.12.7

0.12.7 (2026-09-08)

Bug Fixes

• apply non-browser defaults when cookies only sets encode (#294) (9d6e2a5)

v0.12.7-rc.162

What's Changed

• chore: add workflow for autoclosing stale issues by @​mandarini in supabase/ssr#292
• fix: apply non-browser defaults when cookies only sets encode by @​PhuocOng in supabase/ssr#294

Full Changelog: supabase/ssr@v0.12.6...v0.12.7-rc.162

v0.12.6

0.12.6 (2026-09-04)

Bug Fixes

• avoid duplicate cache headers per server client (#283) (af750e2)

v0.12.6-rc.158

What's Changed

• chore: update @​supabase/supabase-js to v2.114.0 by @​supabase-libs-pr-manager[bot] in supabase/ssr#289
• build(deps): bump actions/deploy-pages from 5.0.0 to 5.0.1 by @​dependabot[bot] in supabase/ssr#290
• fix: avoid duplicate cache headers per server client by @​dhruvxvaishnav in supabase/ssr#283
• docs: fix typos in tsdoc and design doc by @​PhuocOng in supabase/ssr#288

New Contributors

• @​dhruvxvaishnav made their first contribution in supabase/ssr#283
• @​PhuocOng made their first contribution in supabase/ssr#288

Full Changelog: supabase/ssr@v0.12.5...v0.12.6-rc.158

v0.12.5

0.12.5 (2026-08-24)

Bug Fixes

• warn when auth.storage is ignored by createBrowserClient/createServerClient (#284) (c1700f2), closes #142

v0.12.5-rc.154

What's Changed

• docs: add React Router middleware example by @​sornapudisuresh in supabase/ssr#274
• build(deps): bump pnpm/action-setup from 6.0.9 to 6.0.10 by @​dependabot[bot] in supabase/ssr#280
• build(deps): bump postcss from 8.5.15 to 8.5.25 in the npm_and_yarn group across 1 directory by @​dependabot[bot] in supabase/ssr#281

... (truncated)

Changelog

Sourced from @​supabase/ssr's changelog.

0.12.7 (2026-09-08)

Bug Fixes

• apply non-browser defaults when cookies only sets encode (#294) (9d6e2a5)

0.12.6 (2026-09-04)

Bug Fixes

• avoid duplicate cache headers per server client (#283) (af750e2)

0.12.5 (2026-08-24)

Bug Fixes

• warn when auth.storage is ignored by createBrowserClient/createServerClient (#284) (c1700f2), closes #142

Commits

• 9b28f49 chore(main): release 0.12.7 (#295)
• 9d6e2a5 fix: apply non-browser defaults when cookies only sets encode (#294)
• 4ed9f65 chore: add workflow for autoclosing stale issues (#292)
• 71c33a7 chore(main): release 0.12.6 (#291)
• c7c7e68 docs: fix typos in tsdoc and design doc (#288)
• af750e2 fix: avoid duplicate cache headers per server client (#283)
• 905c7c3 build(deps): bump actions/deploy-pages from 5.0.0 to 5.0.1 (#290)
• 9e2564d chore: update @​supabase/supabase-js to v2.114.0 (#289)
• c5310fd chore(main): release 0.12.5 (#286)
• c1700f2 fix: warn when auth.storage is ignored by createBrowserClient/createServerCli...
• Additional commits viewable in compare view

Updates @supabase/supabase-js from 2.111.0 to 2.117.0

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.117.0

2.117.0 (2026-09-22)

🚀 Features

• auth: forward options.mediation to navigator.credentials.get in signInWithPasskey (#2675)
• auth: enable passkey API by default and deprecate experimental passkey opt-in (#2695)

❤️ Thank You

• fadymak
• James Argarin
• Katerina Skroumpelou

v2.117.0-canary.1

2.117.0-canary.1 (2026-09-22)

🚀 Features

• auth: enable passkey API by default and deprecate experimental passkey opt-in (#2695)

❤️ Thank You

• fadymak

v2.117.0-canary.0

2.117.0-canary.0 (2026-09-17)

🚀 Features

• auth: forward options.mediation to navigator.credentials.get in signInWithPasskey (#2675)

❤️ Thank You

• James Argarin
• Katerina Skroumpelou

v2.116.0

2.116.0 (2026-09-07)

🚀 Features

• auth: add MFA recovery codes API (#2676)
• storage: add bucket lifecycle configuration (#2659)
• storage: topk 10k support (#2667)
• storage: add versionId support to create URL methods (#2678)

🩹 Fixes

• auth: silence commit-guard-discarded refresh in initial session (#2668)

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.117.0 (2026-09-22)

🚀 Features

• auth: enable passkey API by default and deprecate experimental passkey opt-in (#2695)

❤️ Thank You

• fadymak

2.116.0 (2026-09-07)

🚀 Features

• auth: add MFA recovery codes API (#2676)

🩹 Fixes

• supabase: warn when schema is passed outside db options (#2663)

❤️ Thank You

• fadymak
• Katerina Skroumpelou @​mandarini

2.115.0 (2026-09-03)

🚀 Features

• postgrest: add getOpenApiSpec() (#2651)

❤️ Thank You

• Katerina Skroumpelou @​mandarini

2.114.0 (2026-09-02)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.113.0 (2026-09-02)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.112.4 (2026-08-24)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.112.3 (2026-08-11)

🩹 Fixes

... (truncated)

Commits

• cc45ccf feat(auth): enable passkey API by default and deprecate experimental passkey ...
• c511286 docs(realtime): document relationship of accessToken() and heartbeat (#2680)
• 84af33f chore(release): version 2.116.0 changelogs (#2679)
• 5aedaab feat(auth): add MFA recovery codes API (#2676)
• e4f675a fix(supabase): warn when schema is passed outside db options (#2663)
• dbe7679 chore(release): version 2.115.0 changelogs (#2664)
• 3eb6193 docs(supabase): clarify db.schema needs the second generic (#2662)
• 92fb8ba feat(postgrest): add getOpenApiSpec() (#2651)
• aef432b chore(release): version 2.114.0 changelogs (#2653)
• 67b07b0 chore(release): version 2.113.0 changelogs (#2650)
• Additional commits viewable in compare view

Updates @zxcvbn-ts/core from 4.1.2 to 4.2.0

Commits

• 642ef8f Publish
• 25f7aec feat: improve language packages
• ac0ef46 feat: Improve language packages (#341)
• 6771284 fix: remove shared reference from feedback (#340)
• 557b595 fix: escape user input regex (#339)
• 58809a2 Feat: add Russian language support (#333)
• 7e78d64 fix(package): set correct repository url (#336)
• 59333b6 feat: improve performance (#335)
• ac667c6 feat: Add runtime checks (#334)
• a57dbee feat(tests): add more tests
• Additional commits viewable in compare view

Updates better-auth from 1.6.29 to 1.7.5

Release notes

Sourced from better-auth's releases.

v1.7.5

better-auth

Features

• Added database.schemaName support for direct PostgreSQL connections. (#11203)

Bug Fixes

• Improved server-side logging for Cloudflare Turnstile verification failures. (#11283)
• Fixed PostgreSQL migrations incorrectly identifying tables and views across schemas. (#11270)
• Fixed MySQL index validation for existing string columns. (#11272)
• Removed the unused optional better-sqlite3 peer dependency to prevent installation conflicts. (#11209)

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added database.schemaName support for direct PostgreSQL connections. (

[silvertakana]

@dependabot rebase

[dependabot]

Looks like this PR is already up-to-date with main! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[silvertakana]

Recording where this one stands, so it is not a mystery later.

Two separate problems, neither of them the update itself:

1. It conflicts with main and a rebase did not clear it, so it cannot merge in this state.
2. security/snyk fails on this pull request and passes on every other open one, so something in these 41 updates trips a security scan.

It is deliberately not auto-merged: the automation here only merges a dependency update once every check has completed green, and this one has not. A person needs to look at the scan result. The weekly dependency digest also lists it.

[silvertakana]

@dependabot recreate

[github-actions]

Left for a person rather than auto-merged: failing checks: automerge. Patch and minor updates merge themselves once every check has completed green; this one is listed in the weekly dependency digest.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.