chore(deps): bump the npm-deps group across 1 directory with 10 updates by dependabot[bot] · Pull Request #24 · codebar/auth

dependabot · 2026-05-28T11:12:53Z

Bumps the npm-deps group with 10 updates in the / directory:

Package	From	To
@hono/node-server	`2.0.0`	`2.0.3`
better-auth	`1.6.5`	`1.6.11`
better-sqlite3	`12.9.0`	`12.10.0`
date-fns	`4.1.0`	`4.2.1`
hono	`4.12.14`	`4.12.21`
pg	`8.20.0`	`8.21.0`
eslint	`10.2.0`	`10.4.0`
fallow	`2.40.3`	`2.76.0`
globals	`17.5.0`	`17.6.0`
tap	`21.7.0`	`21.7.4`

Updates @hono/node-server from 2.0.0 to 2.0.3

Release notes

Sourced from @hono/node-server's releases.

v2.0.3

What's Changed

chore(ci): update GitHub Actions versions by @BlankParticle in honojs/node-server#352

docs: Align the ServeStaticOptions comment with the current spec by @kakkokari-gtyih in honojs/node-server#356

fix: preserve headers mutated after raw Response construction by @abdulmunimjemal in honojs/node-server#357

New Contributors

@kakkokari-gtyih made their first contribution in honojs/node-server#356

@abdulmunimjemal made their first contribution in honojs/node-server#357

Full Changelog: honojs/node-server@v2.0.2...v2.0.3

v2.0.2

What's Changed

fix(serve-static): stop using file birthtime for Date header by @usualoma in honojs/node-server#350

fix: handle serveStatic stream fallback backpressure by @usualoma in honojs/node-server#351

Full Changelog: honojs/node-server@v2.0.1...v2.0.2

v2.0.1

What's Changed

fix: forward Hono response headers during WebSocket upgrade by @gentamura in honojs/node-server#346

New Contributors

@gentamura made their first contribution in honojs/node-server#346

Full Changelog: honojs/node-server@v2.0.0...v2.0.1

Commits

9d87987 2.0.3
9463250 fix: preserve headers mutated after raw Response construction (#357)
cee5e81 docs: Align the ServeStaticOption command with the current specification (#...
4aa0650 chore(ci): update GitHub Actions versions (#352)
808159c 2.0.2
1a9748e fix: handle serveStatic stream fallback backpressure (#351)
54d1bcd fix(serve-static): stop using file birthtime for Date header (#350)
9138a80 2.0.1
0ed7656 fix: forward Hono response headers during WebSocket upgrade (#346)
See full diff in compare view

Updates better-auth from 1.6.5 to 1.6.11

Release notes

Sourced from better-auth's releases.

v1.6.11

better-auth

Bug Fixes

Added an error code to the change-email-disabled response to help clients identify the rejection reason (#8948)

Fixed access-control role statement types so predefined organization roles expose only their configured permissions in TypeScript (#9507)

Fixed the anonymous plugin to correctly call onLinkAccount when email verification triggers auto sign-in (#9548)

Fixed device authorization to bind pending codes to the verifying session, preventing any authenticated user from approving or denying another user's device code (#9573)

Fixed a race condition in the magic-link plugin that allowed concurrent requests to mint multiple sessions from the same single-use token (#9572)

Fixed the oidc-provider and mcp plugins to require client_secret for confidential clients on refresh token grants and use constant-time secret comparison (#9576)

Hardened oidc-provider and mcp plugins to follow OAuth 2.1: removed "none" from advertised signing algorithms, defaulted plain PKCE off, and rejected incomplete PKCE parameters (#9575)

Fixed an invitation takeover vulnerability by enabling requireEmailVerificationOnInvitation by default and extending the verification gate to getInvitation and listUserInvitations (#9577)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

Fixed a race condition in the OAuth authorization-code grant that allowed concurrent token-exchange requests to mint multiple token sets from the same authorization code

Fixed a race condition in OAuth refresh-token rotation that allowed concurrent requests to fork refresh token families, and added a unique constraint on oauthRefreshToken.token

Fixed OAuth account linking to require a verified local email before linking an OAuth identity to a local account (#9578)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

Fixed an invalid import list in the instrumentation module (#9582)

Widened advanced.ipAddress.ipv6Subnet to accept any valid IPv6 prefix length (0-128) instead of a narrow set of values (#9545)

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

Fixed session cleanup to run when admin, anonymous, or SCIM operations delete a user (#9162)

Fixed generateSCIMToken to reject providerId values that collide with built-in account providers, preventing tokens from authenticating against unintended accounts (#9579)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

Fixed SSO provider registration to require an org admin or owner role, preventing any organization member from registering providers (#9220)

Fixed an SSRF vulnerability by validating user-supplied OIDC endpoint URLs against a public-routable host allowlist at provider registration and update (#9574)

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.6.11

Patch Changes

#9568 0cbddb8 Thanks @gustavovalverde! - Add internalAdapter.consumeVerificationValue(identifier): atomically consume a verification row keyed by identifier. The first concurrent caller receives the row; later racers receive null. Backed by a new DBAdapter.consumeOne primitive implemented natively per adapter (memory, mongo, drizzle, kysely, prisma), with a transaction(findMany + delete) factory fallback. SecondaryStorage.getAndDelete is added as an optional companion; Redis ships it via an atomic Lua get-and-delete operation for compatibility with Redis versions before 6.2.

#9162 a26333b Thanks @ping-maxwell! - fix: cleanup sessions when admin, anonymous, or SCIM deletes a user

#9573 99a254a Thanks @gustavovalverde! - fix(device-authorization): require verify-time ownership claim for approve/deny

Pending device codes were not bound to the user who entered the code on the verification page until approval, leaving a window where any authenticated user could approve or deny another user's pending code by knowing the user_code. GET /device now claims the pending row for the calling session, and POST /device/approve and POST /device/deny require the calling session to match the claimed owner. Custom verification pages must be served to an authenticated session for the flow to succeed.

#8948 ee93485 Thanks @ping-maxwell! - fix: add error code to change-email-disabled

#9572 5f09d56 Thanks @gustavovalverde! - Fix race condition in the magic-link plugin's verify handler that allowed two concurrent requests to mint two sessions from the same single-use token. The handler now consumes the verification row atomically via internalAdapter.consumeVerificationValue, so a given magic link mints at most one session regardless of concurrency. The allowedAttempts option is retained for backward compatibility but no longer multiplies successful redemptions; tokens are single-use. The second-redeem error code changes from ATTEMPTS_EXCEEDED to INVALID_TOKEN (the token no longer exists after consumption).

b4bc65a Thanks @gustavovalverde! - Fix race condition in the OAuth authorization-code grant: two concurrent token-exchange requests sharing the same code could both pass the find step before either delete completed and each mint an independent access/refresh/id token set. The authorization_code handler in @better-auth/oauth-provider, plus the legacy oidc-provider and mcp plugins in better-auth, now consume the verification row atomically via internalAdapter.consumeVerificationValue. The first caller mints tokens; concurrent racers receive invalid_grant (RFC 6749 §5.2). Malformed-verification-value branches in @better-auth/oauth-provider previously returned a project-specific invalid_verification code; those are now invalid_grant so spec-compliant clients can branch on the standard code.

#9578 da7e50b Thanks @gustavovalverde! - handleOAuthUserInfo (used by every social provider, generic-oauth, oauth-proxy, SSO OIDC and SAML, and idToken sign-in) implicitly linked a returning OAuth identity into a local user row whenever the IdP's email_verified claim was true or the provider was trusted. The local row's own emailVerified flag was read only to flip it after linking, never as a precondition. POST /sign-up/email creates rows with emailVerified: false for any caller, so an attacker who pre-registered a victim's email at the application could wait for the legitimate user's first OAuth sign-in: the IdP's verified claim was treated as ownership proof, and the victim's IdP identity was linked into the attacker-owned row.

The implicit-link gate now requires dbUser.user.emailVerified === true in addition to the provider trust check by default. A new account.accountLinking.requireLocalEmailVerified option (default true) is the public surface for this gate. Apps whose users sign up via OAuth without verifying their email locally can opt back into the legacy behavior with account: { accountLinking: { requireLocalEmailVerified: false } }; understand the takeover risk before doing so. The option is @deprecated; a FIXME at each gate site points at the next-minor follow-up on next that drops the option and makes the gate unconditional.

The one-tap plugin honored its own copy of the gate and was updated identically: requireLocalEmailVerified and accountLinking.disableImplicitLinking both apply on /one-tap/callback. The email_verified claim from the Google ID token is now normalized via toBoolean so a string "false" is treated as falsy.

Test fixtures across admin, oidc-provider, mcp, generic-oauth, last-login-method, and oauth-provider suites now mark users emailVerified: true via a databaseHooks.user.create.before hook (or the disableTestUser opt-in on the oauth-provider RP) so the suites continue to exercise their role/flow logic rather than the new gate.

#9507 a1c9f3c Thanks @GautamBytes! - Preserve exact access-control role statement types so predefined organization roles expose only their configured permissions in TypeScript.

#9577 23094a6 Thanks @gustavovalverde! - The organization plugin's invitation recipient endpoints (acceptInvitation, rejectInvitation, getInvitation, listUserInvitations) treated invitation.email.toLowerCase() === session.user.email.toLowerCase() as proof that the calling user owned the invited address. A session-authenticated user whose email matched but was never verified passed the gate, so anyone who could pre-register an unverified account at a victim's email could accept invitations addressed to that email. The requireEmailVerificationOnInvitation opt-in option closed the gap only when explicitly enabled and did not protect getInvitation or listUserInvitations at all.

The gate is now applied on all four recipient endpoints and the requireEmailVerificationOnInvitation option default flips from false to true so existing apps are secure by default. Apps that intentionally accept invitations from unverified accounts can keep the legacy permissive behavior with organization({ requireEmailVerificationOnInvitation: false }), but they should understand the takeover risk before doing so. Server-side calls to listUserInvitations with ctx.query.email and no session continue to bypass the gate (the caller is trusted).

The option is @deprecated. The next-minor release on next removes it entirely and makes the gate unconditional.

#9548 142b86c Thanks @dipan-ck! - anonymous plugin now correctly calls onLinkAccount when email verification triggers auto sign-in

#9576 1f2ff42 Thanks @gustavovalverde! - fix(oidc-provider, mcp): authenticate confidential clients on refresh_token grant and harden secret comparison

Refresh-token grants on the legacy oidc-provider and mcp plugins now require the registered client_secret from confidential clients, matching the authorization_code path. Public clients (where code_verifier substitutes for the secret on the auth-code grant) continue to skip secret validation. Secret comparisons across both plugins now use constant-time equality. The /mcp/token endpoint no longer emits a wildcard CORS Access-Control-Allow-Origin: * header.

These plugins are deprecated in favor of @better-auth/oauth-provider, which is unaffected. New deployments should adopt the replacement; this patch keeps existing deployments protected while migrating.

#9575 699b09a Thanks @gustavovalverde! - fix(oidc-provider, mcp): drop "none" from advertised signing algorithms, default allowPlainCodeChallengeMethod to false, and reject missing PKCE method

The legacy oidc-provider and mcp plugins now follow OAuth 2.1 (RFC 9700) on three protocol gates:

id_token_signing_alg_values_supported (oidc-provider, mcp) and resource_signing_alg_values_supported (mcp) no longer include "none". Relying parties that negotiate from this list will no longer be steered toward unsigned tokens.

allowPlainCodeChallengeMethod defaults to false. Callers who need plain PKCE must opt in explicitly.

Under the secure default the authorize endpoint no longer silently rewrites a missing code_challenge_method to "plain" before the allowlist check. A request that provides code_challenge without code_challenge_method is now rejected with invalid_request; the inverse case (code_challenge_method without code_challenge) is also rejected so no inconsistent PKCE state is persisted on the authorization code record.

Non-breaking for callers who never relied on "none" advertisement or the plain default. Callers who explicitly set allowPlainCodeChallengeMethod: true keep plain on the allowlist and retain the legacy "missing method defaults to plain" behavior for backward compatibility, so existing integrations that opted into plain PKCE continue to work. The next-minor on next will drop both the plain allowlist entry and this fallback; until then, the option is the single explicit knob for legacy behavior. Migrate to @better-auth/oauth-provider for the canonical, spec-aligned implementation.

... (truncated)

Commits

f41514e chore: release v1.6.11 (#9532)
699b09a fix(oidc-provider, mcp): drop "none" alg, default plain PKCE off, reject miss...
b4bc65a Merge commit from fork
a1c9f3c fix(access): preserve exact role statement types (#9507)
da7e50b fix(oauth): block OAuth linking to unverified local accounts (#9578)
23094a6 fix(organization): default-on requireEmailVerificationOnInvitation & extend...
1f2ff42 fix(oidc-provider, mcp): authenticate confidential clients on refresh_token g...
5f09d56 fix(magic-link): consume verification token atomically on verify (#9572)
99a254a fix(device-authorization): bind approval to verifier session (#9573)
0cbddb8 refactor(db): rename claimOne adapter primitive to consumeOne (#9568)
Additional commits viewable in compare view

Updates better-sqlite3 from 12.9.0 to 12.10.0

Release notes

Sourced from better-sqlite3's releases.

v12.10.0

What's Changed

Update SQLite to version 3.53.1 by @JoshuaWise in WiseLibs/better-sqlite3#1467

Add support for Node.js v26 prebuilds and remove EOL builds (Node.js v20, v23) by @m4heshd in WiseLibs/better-sqlite3#1468

Temporarily rollback support for Electron v42 prebuilds by @m4heshd in WiseLibs/better-sqlite3#1470

Enable percentile functions by @Maxime-J in WiseLibs/better-sqlite3#1447

Full Changelog: WiseLibs/better-sqlite3@v12.9.1...v12.10.0

v12.9.1

⚠️CAUTION: NOT A VIABLE RELEASE

Electron v39+ prebuilds are not building successfully at the moment. Stick to v12.9.0 for now.

What's Changed

Enable percentile functions by @Maxime-J in WiseLibs/better-sqlite3#1447

Add support for electron v42 prebuilds by @m4heshd in WiseLibs/better-sqlite3#1466

New Contributors

@Maxime-J made their first contribution in WiseLibs/better-sqlite3#1447

Full Changelog: WiseLibs/better-sqlite3@v12.9.0...v12.9.1

Commits

d8885f9 12.10.0
3f89324 Temporarily rollback support for Electron v42 prebuilds (#1470)
a640028 Add support for Node.js v26 prebuilds and remove EOL builds (#1468)
a69f03c Update SQLite to version 3.53.1 (#1467)
d116f32 12.9.1
04d9b65 Add support for electron v42 prebuilds (#1466)
ef7d940 Enable percentile functions (#1447)
See full diff in compare view

Updates date-fns from 4.1.0 to 4.2.1

Release notes

Sourced from date-fns's releases.

v4.2.1

Fixed

Fixed type definitions missing in v4.2.0 due to TypeScript misconfiguration.

v4.2.0

This is a minor release in all senses, it only includes documentation updates (first of many) that points to the new You Don't Need date-fns* page.

* Not really

Changed

Added Temporal API references to the JSDoc annotations of add, addBusinessDays, and addDays.

Changelog

Sourced from date-fns's changelog.

v4.2.1 - 2026-05-19

Fixed

Fixed type definitions missing in v4.2.0 due to TypeScript misconfiguration.

v4.2.0 - 2026-05-18

This is a minor release in all senses, it only includes documentation updates (first of many) that points to the new You Don't Need date-fns* page.

* Not really

Changed

Added Temporal API references to the JSDoc annotations of add, addBusinessDays, and addDays.

Commits

87635a8 Fix missing type definitions, promote to v4.2.1 (closed #4190)
3d4ca4b Update browserslist
562c485 Promote to v4.2.0
3709c02 Make steps into the Temporal-first future
07592b9 Upgrade Node.js types, upgrade TypeScript
09ece22 Upgrade Vitest
c37c22e Set up Oxfmt as the default formatter
d40bb80 Upgrade mise setup
dd66398 Fix tz tests workflow
ef962f8 Adjust smoke tests
Additional commits viewable in compare view

Updates hono from 4.12.14 to 4.12.21

Release notes

Sourced from hono's releases.

v4.12.21

Security fixes

This release includes fixes for the following security issues:

app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

Affects: app.mount(). Fixes prefix stripping using the raw URL pathname instead of the decoded path, where percent-encoded characters in the mount prefix or path could cause the prefix to be removed at the wrong position, resulting in the sub-application receiving an incorrect path. GHSA-2gcr-mfcq-wcc3

IP Restriction bypasses static deny rules for non-canonical IPv6

Affects: hono/ip-restriction. Fixes IP address comparison using string equality, where non-canonical IPv6 representations of a denied address — such as compressed forms or hex-notation IPv4-mapped addresses — could bypass static deny rules. GHSA-xrhx-7g5j-rcj5

Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

Affects: hono/cookie. Fixes missing validation of sameSite and priority options against injection characters (;, \r, \n), where user-controlled input passed to either option could inject additional attributes into the Set-Cookie response header. GHSA-3hrh-pfw6-9m5x

JWT middleware accepts any Authorization scheme, not only Bearer

Affects: hono/jwt, hono/jwk. Fixes missing scheme validation in the Authorization header, where any two-part header value was accepted regardless of the scheme name, allowing non-Bearer schemes to pass JWT authentication. GHSA-f577-qrjj-4474

Users who use app.mount(), hono/ip-restriction, hono/cookie, or hono/jwt/hono/jwk are encouraged to upgrade to this version.

v4.12.20

What's Changed

fix(route): preserve the base path of the mounted route() app by @usualoma in honojs/hono#4942

fix(jsx): widen jsx and jsxFn children to Child[] by @ashunar0 in honojs/hono#4947

New Contributors

@ashunar0 made their first contribution in honojs/hono#4947

Full Changelog: honojs/hono@v4.12.19...v4.12.20

v4.12.19

What's Changed

ci: pin GitHub Actions to SHAs by @yusukebe in honojs/hono#4932

fix(serveStatic): make options parameter optional in all adapters by @mixelburg in honojs/hono#4934

fix(cookie): return the first cookie when there are multiple cookies with the same name by @usualoma in honojs/hono#4922

feat(bearer-auth): make bearerAuth generic for typed context in verifyToken by @justinnais in honojs/hono#4913

feat(cache): key cache entries by configured vary headers by @usualoma in honojs/hono#4915

feat(request): add bytes() by @yusukebe in honojs/hono#4921

fix(stream): upgrade @hono/node-server to v2 and fix abort handling by @yusukebe in honojs/hono#4940

New Contributors

@justinnais made their first contribution in honojs/hono#4913

Full Changelog: honojs/hono@v4.12.18...v4.12.19

... (truncated)

Commits

a83ddb8 4.12.21
6cbb025 Merge commit from fork
c831020 Merge commit from fork
905aedb Merge commit from fork
5463db2 Merge commit from fork
c657a39 4.12.20
eb2d0c2 fix(jsx): widen jsx and jsxFn children to Child[] (#4947)
dcabbec fix(route): preserve the base path of the mounted route() app (#4942)
7e62bcd 4.12.19
e2f252a fix(stream): upgrade @hono/node-server to v2 and fix abort handling (#4940)
Additional commits viewable in compare view

Updates pg from 8.20.0 to 8.21.0

Changelog

Sourced from pg's changelog.

pg@8.21.0

Handle SASL SCRAM server error responses properly.

Add support for node@26.

Add scramMaxIterations config option.

Add client.getTransactionStatus() method.

Commits

544b1ce Publish
cc03fa5 Add scramMaxIterations option to limit SCRAM iteration count (#3677)
f776327 Remove compatibility code for unsupported versions of Node (<16) (#3678)
f252870 cleanup: pg utils (#3675)
c8da6ab Assorted test cleanup (#3673)
fa47e73 fix: Client#end callback being called multiple times when first is no-op (#...
88a7e60 cleanup: Move declaration to more natural place
2095247 cleanup: Combine duplicated code in Client#query and avoid unneeded early n...
0ac3edd fix: apply SASLprep (RFC 4013) to passwords before SCRAM-SHA-256 PBKDF2 (#3669)
be880d4 Assorted test fixes and cleanup (#3672)
Additional commits viewable in compare view

Updates eslint from 10.2.0 to 10.4.0

Release notes

Sourced from eslint's releases.

v10.4.0

Features

1a45ec5 feat: check sequence expressions in for-direction (#20701) (kuldeep kumar)

450040b feat: add includeIgnoreFile() to eslint/config (#20735) (Kirk Waiblinger)

Bug Fixes

544c0c3 fix: escape code path DOT labels in debug output (#20866) (Pixel998)

6799431 fix: update dependency @eslint/config-helpers to ^0.6.0 (#20850) (renovate[bot])

f078fef fix: handle non-array deprecated rule replacements (#20825) (xbinaryx)

Documentation

7e52a71 docs: add mention of @eslint-react/eslint-plugin (#20869) (Pavel)

db3468b docs: tweak wording around ambiguous CJS-vs-ESM config (#20865) (Kirk Waiblinger)

9084664 docs: Update README (GitHub Actions Bot)

9cc7387 docs: Update README (GitHub Actions Bot)

3d7b548 docs: Update README (GitHub Actions Bot)

191ec3c docs: Update README (GitHub Actions Bot)

Chores

6616856 chore: upgrade knip to v6 (#20875) (Pixel998)

d13b084 ci: ensure auto-created PRs run CI (#20860) (lumir)

e71c7af ci: bump pnpm/action-setup from 6.0.5 to 6.0.7 (#20862) (dependabot[bot])

d84393d test: add unit tests for SuppressionsService.applySuppressions() (#20863) (kuldeep kumar)

24db8cb test: add tests for SuppressionsService.save() (#20802) (kuldeep kumar)

2ef0549 chore: update ecosystem plugins (#20857) (github-actions[bot])

a429791 ci: remove eslint-webpack-plugin types integration test (#20668) (Milos Djermanovic)

9e37386 chore: replace recast with range approach in code-sample-minimizer (#20682) (Copilot)

0dd1f9f test: disable warning for vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER (#20845) (Francesco Trotta)

9da3c7b refactor: remove deprecated meta.language and migrate meta.dialects (#20716) (Pixel998)

2099ed1 refactor: add meta.defaultOptions to more rules, enable linting (#20800) (xbinaryx)

f1dfbc9 chore: update ecosystem plugins (#20836) (github-actions[bot])

c759413 ci: bump pnpm/action-setup from 6.0.3 to 6.0.5 (#20843) (dependabot[bot])

5b817d6 test: add unit tests for lib/shared/ast-utils (#20838) (kuldeep kumar)

1c13ae3 test: add unit tests for lib/shared/severity (#20835) (kuldeep kumar)

v10.3.0

Features

379571a feat: add suggestions for no-unused-private-class-members (#20773) (sethamus)

Bug Fixes

b6ae5cf fix: handle unavailable require cache (#20812) (Simon Podlipsky)

6fb3685 fix: rule suggestions cause continuation in class body (#20787) (Milos Djermanovic)

Documentation

32cc7ab docs: fix typos in docs and comments (#20809) (Tanuj Kanti)

7f47937 docs: Update README (GitHub Actions Bot)

Chores

d32235e ci: use pnpm in eslint-flat-config-utils type integration test (#20826) (Francesco Trotta)

3ffb14e chore: clean up typos in comments and JSDoc (#20821) (Pixel998)

... (truncated)

Commits

452c401 10.4.0
b6417e8 Build: changelog update for 10.4.0
6616856 chore: upgrade knip to v6 (#20875)
d13b084 ci: ensure auto-created PRs run CI (#20860)
7e52a71 docs: add mention of @eslint-react/eslint-plugin (#20869)
e71c7af ci: bump pnpm/action-setup from 6.0.5 to 6.0.7 (#20862)
544c0c3 fix: escape code path DOT labels in debug output (#20866)
db3468b docs: tweak wording around ambiguous CJS-vs-ESM config (#20865)
d84393d test: add unit tests for SuppressionsService.applySuppressions() (#20863)
9084664 docs: Update README
Additional commits viewable in compare view

Updates fallow from 2.40.3 to 2.76.0

Release notes

Sourced from fallow's releases.

v2.76.0: --diff-file scopes every finding, schema-derive ladder lands, fallow_core deprecated

Highlights

--diff-file now filters every finding, not just the runtime-coverage section. A single flag scopes unused-export, complexity hotspot, clone family, boundary violation, and runtime-coverage findings to lines inside an added hunk, so the JSON total_issues already matches what your PR introduces. CI pipelines previously running a downstream jq filter (filter-changed.jq) can drop it; the --diff-stdin alias accepts gh pr diff | fallow audit --diff-file -. Closes #424.

fallow fix knows about pnpm-catalog comment blocks. A new fix.catalog.deletePrecedingComments knob (auto default, plus always / never) deletes a contiguous YAML comment block when removing the catalog entry it documents, with two escape hatches: a # fallow-keep marker on any line and an auto-policy banner heuristic for # === React 18 pins ===-style headers. The JSON action gains an entry_line field alongside line so annotators can pick either anchor unambiguously. Closes #360.

fallow fix creates .fallowrc.json when no fallow config exists. Previously the duplicate-export add-to-config fix told you to run fallow init first, then re-run fallow fix --yes. Now the fixer materialises the same framework-aware scaffolding fallow init would emit, layers your ignoreExports rules on top, and skips when invoked from a monorepo subpackage (with a targeted error pointing at the workspace root). --dry-run previews the write as a unified diff in both human and JSON modes. Closes #332.

Architecture boundaries: opt-in allowTypeOnly lets type-only imports cross zones. { from: "featureB", allowTypeOnly: ["featureA"] } allows import type {...}, inline import { type Foo } (when every named specifier carries the type qualifier), and export type { Foo } from "..." across zones without a runtime dependency. Mixed-specifier imports still fire. Strictly additive: omitting the field preserves pre-feature behavior. Closes #365. Thanks @DrJonki.

Angular component complexity rollup. fallow health --complexity (and audit, combined) now emits a synthetic <component> finding per Angular component whose class function findings AND template both cleared the cyclomatic / cognitive thresholds. The rollup sums worst_class_method + template and ships a component_rollup payload so the breakdown stays visible. Component-inherited CRAP provenance also lands on synthetic \<template> findings via the inverse templateUrl edge, with coverage_source: "estimated_component_inherited" and inherited_from on the wire. Closes #234. Refs #186 tier 1.

autoDiscover parent zones now auto-allow their discovered children. Top-level barrels (src/features/index.ts) can re-export feature modules without false-positive cross-zone violations. The Bulletproof preset gains patterns: ["src/features/**"] on the features zone so non-barrel top-level files (src/features/types.ts) classify under the parent zone and still obey the features rule. Closes #372.

fallow list --boundaries --format json surfaces the logical group name for autoDiscover zones. Config UIs and Sankey renderers no longer need to reconstruct the grouping from the features/<child> naming convention; a parallel logical_groups[] array carries name, children, auto_discover, status, source_zone_index, file_count, plus byte-accurate config-patch metadata. Closes #373.

Schema-derive ladder shipped

Issue #384 closes in this release. Every object-shaped --format json envelope (AuditOutput, CheckOutput, CombinedOutput, DupesOutput, HealthOutput, ExplainOutput, CoverageSetupOutput, CoverageAnalyzeOutput, ReviewEnvelopeOutput, ReviewReconcileOutput, ListBoundariesOutput) is now a variant of a typed FallowOutput enum derived from Rust source via schemars. The document-root oneOf block in docs/output-schema.json is regenerated instead of hand-maintained, and every legacy inject_*_actions JSON post-pass in report/json.rs is retired in favour of typed *Finding envelope wrappers that flatten the bare payload and carry actions: T[] natively. Wire shape is byte-identical (verified against vue-core, vite, preact, zod, next.js); the codegen-derived TS contracts in editors/vscode/src/generated/output-contract.d.ts and npm/fallow/types/output-contract.d.ts expose FallowOutput as a discriminated union, plus backwards-compat aliases for the bare names that json-schema-to-typescript dedupes away.

fallow_core deprecated for external consumers

Per ADR-008, the top-level entry points (analyze, analyze_with_usages, analyze_with_trace, analyze_retaining_modules, analyze_with_parse_result, analyze_project), the fallow_core::analyze::* detector helpers, and the feature-flag helpers (collect_feature_flags, correlate_with_dead_code) now carry #[deprecated(since = "2.76.0")] annotations pointing external consumers at fallow_cli::programmatic. Workspace path-dependency callers continue to compile via #[expect(deprecated)]Description has been truncated

Bumps the npm-deps group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@hono/node-server](https://github.com/honojs/node-server) | `2.0.0` | `2.0.3` | | [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.6.5` | `1.6.11` | | [better-sqlite3](https://github.com/WiseLibs/better-sqlite3) | `12.9.0` | `12.10.0` | | [date-fns](https://github.com/date-fns/date-fns) | `4.1.0` | `4.2.1` | | [hono](https://github.com/honojs/hono) | `4.12.14` | `4.12.21` | | [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.20.0` | `8.21.0` | | [eslint](https://github.com/eslint/eslint) | `10.2.0` | `10.4.0` | | [fallow](https://github.com/fallow-rs/fallow) | `2.40.3` | `2.76.0` | | [globals](https://github.com/sindresorhus/globals) | `17.5.0` | `17.6.0` | | [tap](https://github.com/tapjs/tapjs) | `21.7.0` | `21.7.4` | Updates `@hono/node-server` from 2.0.0 to 2.0.3 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v2.0.0...v2.0.3) Updates `better-auth` from 1.6.5 to 1.6.11 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/better-auth@1.6.11/packages/better-auth) Updates `better-sqlite3` from 12.9.0 to 12.10.0 - [Release notes](https://github.com/WiseLibs/better-sqlite3/releases) - [Commits](WiseLibs/better-sqlite3@v12.9.0...v12.10.0) Updates `date-fns` from 4.1.0 to 4.2.1 - [Release notes](https://github.com/date-fns/date-fns/releases) - [Changelog](https://github.com/date-fns/date-fns/blob/v4.2.1/CHANGELOG.md) - [Commits](date-fns/date-fns@v4.1.0...v4.2.1) Updates `hono` from 4.12.14 to 4.12.21 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.14...v4.12.21) Updates `pg` from 8.20.0 to 8.21.0 - [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md) - [Commits](https://github.com/brianc/node-postgres/commits/pg@8.21.0/packages/pg) Updates `eslint` from 10.2.0 to 10.4.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.2.0...v10.4.0) Updates `fallow` from 2.40.3 to 2.76.0 - [Release notes](https://github.com/fallow-rs/fallow/releases) - [Changelog](https://github.com/fallow-rs/fallow/blob/main/CHANGELOG.md) - [Commits](fallow-rs/fallow@v2.40.3...v2.76.0) Updates `globals` from 17.5.0 to 17.6.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](sindresorhus/globals@v17.5.0...v17.6.0) Updates `tap` from 21.7.0 to 21.7.4 - [Release notes](https://github.com/tapjs/tapjs/releases) - [Commits](https://github.com/tapjs/tapjs/compare/tap@21.7.0...tap@21.7.4) --- updated-dependencies: - dependency-name: "@hono/node-server" dependency-version: 2.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-deps - dependency-name: better-auth dependency-version: 1.6.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-deps - dependency-name: better-sqlite3 dependency-version: 12.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: date-fns dependency-version: 4.2.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: hono dependency-version: 4.12.21 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-deps - dependency-name: pg dependency-version: 8.21.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: eslint dependency-version: 10.4.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: fallow dependency-version: 2.76.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: globals dependency-version: 17.6.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: tap dependency-version: 21.7.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-deps ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 28, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the npm-deps group across 1 directory with 10 updates#24

chore(deps): bump the npm-deps group across 1 directory with 10 updates#24
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-deps-04f5b3da3b

dependabot Bot commented on behalf of github May 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github May 28, 2026

v2.0.3

What's Changed

New Contributors

v2.0.2

What's Changed

v2.0.1

What's Changed

New Contributors

v1.6.11

better-auth

Bug Fixes

@better-auth/oauth-provider

Bug Fixes

@better-auth/core

Bug Fixes

@better-auth/scim

Bug Fixes

@better-auth/sso

Bug Fixes

1.6.11

Patch Changes

v12.10.0

What's Changed

v12.9.1

⚠️CAUTION: NOT A VIABLE RELEASE

What's Changed

New Contributors

v4.2.1

Fixed

v4.2.0

Changed

v4.2.1 - 2026-05-19

Fixed

v4.2.0 - 2026-05-18

Changed

v4.12.21

Security fixes

app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

IP Restriction bypasses static deny rules for non-canonical IPv6

Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

JWT middleware accepts any Authorization scheme, not only Bearer

v4.12.20

What's Changed

New Contributors

v4.12.19

What's Changed

New Contributors

pg@8.21.0

v10.4.0

Features

Bug Fixes

Documentation

Chores

v10.3.0

Features

Bug Fixes

Documentation

Chores

v2.76.0: --diff-file scopes every finding, schema-derive ladder lands, fallow_core deprecated

Highlights

Schema-derive ladder shipped

fallow_core deprecated for external consumers

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`better-auth`

`@better-auth/oauth-provider`

`@better-auth/core`

`@better-auth/scim`

`@better-auth/sso`

`fallow_core` deprecated for external consumers