chore(deps)(deps): bump the minor-and-patch group across 1 directory with 40 updates

[dependabot]

Bumps the minor-and-patch group with 40 updates in the / directory:

Package	From	To
esbuild	0.28.1	0.28.2
turbo	2.10.5	2.10.12
@hono/node-server	2.0.10	2.1.1
@hono/zod-validator	0.9.0	0.9.1
@langchain/core	1.2.3	1.2.9
@langchain/openai	1.5.5	1.5.11
better-auth	1.6.23	1.7.2
deepagents	1.11.1	1.13.3
hono	4.12.31	4.13.5
mongodb	7.5.0	7.6.0
mongoose	9.7.4	9.9.4
zod	4.4.3	4.5.4
tsx	4.23.1	4.23.13
@astrojs/starlight	0.41.3	0.42.0
sharp	0.35.3	0.35.4
starlight-image-zoom	0.15.0	0.16.0
@playwright/test	1.61.1	1.62.1
@dagrejs/dagre	3.0.0	3.1.1
@tanstack/react-query	5.101.2	5.102.8
@tanstack/react-router	1.170.18	1.170.32
@xyflow/react	12.11.2	12.11.6
lucide-react	1.25.0	1.40.0
react	19.2.7	19.2.8
@types/react	19.2.17	19.2.18
react-dom	19.2.7	19.2.8
@types/react-dom	19.2.3	19.2.7
recharts	3.9.2	3.10.1
sonner	2.0.7	2.0.8
@tanstack/router-plugin	1.168.23	1.168.35
@vitejs/plugin-react	6.0.3	6.1.1
postcss	8.5.20	8.5.28
vite	8.1.5	8.2.2
@langchain/anthropic	1.5.1	1.5.9
isomorphic-git	1.38.9	1.41.9
langchain	1.5.3	1.5.10
@radix-ui/react-label	2.1.12	2.1.15
@radix-ui/react-separator	1.1.12	1.1.15
@radix-ui/react-slot	1.3.0	1.3.3
@radix-ui/react-tooltip	1.2.13	1.2.16
radix-ui	1.6.3	1.6.7

Updates esbuild from 0.28.1 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x
    bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x

... (truncated)

Commits

• 609683d publish 0.28.2 to npm
• 11b1fe4 add to release notes
• ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
• 04627b6 fix #4498: async TLA checks need a worklist
• 5c15177 disable gopls in the go folder
• fc2ee9b css: adjust parser to allow --foo: {...}
• 209db54 release notes for css nesting bugfix
• c625d31 fix #4497: preserve nested ampersands during minification (#4500)
• 34474e2 better isolation of current part in js parser
• 07f6e8c fix #4507: import assignment tree-shaking bug
• Additional commits viewable in compare view

Updates turbo from 2.10.5 to 2.10.12

Release notes

Sourced from turbo's releases.

Turborepo v2.10.12

What's Changed

Changelog

• chore: Release Turborepo 2.10.11 by @​github-actions[bot] in vercel/turborepo#13765
• feat: Refresh documentation social cards by @​christopherkindl in vercel/turborepo#13764
• fix: Preserve showcase logo sizes by @​christopherkindl in vercel/turborepo#13766
• fix: Refine mobile homepage interactions by @​christopherkindl in vercel/turborepo#13767
• fix: Align homepage KPIs to the right by @​christopherkindl in vercel/turborepo#13769
• fix: Prevent homepage KPI overflow by @​christopherkindl in vercel/turborepo#13770
• chore: Update Geistdocs to 1.20.4 by @​molebox in vercel/turborepo#13771
• perf: Skip unused Package Configuration stats by @​vercel-gh-bot-4[bot] in vercel/turborepo#13746
• chore: Update with-solid example by @​vercel-gh-bot-5[bot] in vercel/turborepo#13752
• chore: Update with-tailwind example by @​vercel-gh-bot-5[bot] in vercel/turborepo#13762
• perf: Stream dry-run JSON output by @​vercel-gh-bot-4[bot] in vercel/turborepo#13760
• chore: Update with-ultracite example by @​vercel-gh-bot-5[bot] in vercel/turborepo#13772
• perf: Merge same-prefix tree-wildcard globs into one directory walk by @​vercel-gh-bot-5[bot] in vercel/turborepo#13763
• chore: Update with-svelte example by @​floriansalihovic in vercel/turborepo#13118
• chore: Add unified agent control plane by @​anthonyshew in vercel/turborepo#13757
• fix: Remove incremental task caching by @​anthonyshew in vercel/turborepo#13773
• chore: Rename agents app to factory by @​anthonyshew in vercel/turborepo#13774
• chore: Update oxlint and oxfmt by @​charpeni in vercel/turborepo#13777
• feat: Add security.txt endpoint by @​charpeni in vercel/turborepo#13778
• feat: Redesign factory control plane by @​anthonyshew in vercel/turborepo#13775
• perf: Replace regex captures with hand-written parsers in berry lockfile identifiers by @​vercel-gh-bot-2[bot] in vercel/turborepo#13776
• chore: Upgrade the factory eve agent to 0.39.3 by @​anthonyshew in vercel/turborepo#13783
• chore: Update with-rsbuild-module-federation example by @​vercel-gh-bot-4[bot] in vercel/turborepo#13786
• perf: Index Berry lockfile resolution overrides by dependency name by @​vercel-gh-bot-5[bot] in vercel/turborepo#13787
• chore: Update remote cache action to v1.1.0 by @​anthonyshew in vercel/turborepo#13789
• docs: Fix reference links and validation by @​charpeni in vercel/turborepo#13784
• feat: Add SSH command affordance for factory sandboxes by @​anthonyshew in vercel/turborepo#13779
• fix: Show invalid affected task glob by @​anthonyshew in vercel/turborepo#13793
• perf: Skip unused repository indexing for package listings by @​vercel-gh-bot-4[bot] in vercel/turborepo#13792
• feat: Rebuild the factory image on every merge to main by @​anthonyshew in vercel/turborepo#13781
• chore: Add full-page terminal SSH sessions to Factory sandbox inventory by @​anthonyshew in vercel/turborepo#13780
• chore: Update with-shell-commands example by @​vercel-gh-bot-4[bot] in vercel/turborepo#13791
• chore: Allow SSH terminal for completed-run sandboxes in Factory by @​anthonyshew in vercel/turborepo#13782
• fix: Decouple graceful shutdown tests from the shell commands example by @​anthonyshew in vercel/turborepo#13799
• feat: Start ad-hoc factory work from the operator page by @​anthonyshew in vercel/turborepo#13798
• chore: Update with-solid example by @​vercel-gh-bot-4[bot] in vercel/turborepo#13797
• fix: Rebuild factory images without custom workflows by @​anthonyshew in vercel/turborepo#13801
• feat: Add factory navigation by @​anthonyshew in vercel/turborepo#13802
• refactor: Migrate Factory styles to Tailwind by @​anthonyshew in vercel/turborepo#13803
• feat: Add durable Factory workspaces by @​anthonyshew in vercel/turborepo#13804
• feat: Stream Factory sandbox as terminal by @​anthonyshew in vercel/turborepo#13807
• fix: Restore Factory workspace creation by @​anthonyshew in vercel/turborepo#13812
• fix: Update Factory session network policy by @​anthonyshew in vercel/turborepo#13814
• fix: Improve Factory terminal line spacing by @​anthonyshew in vercel/turborepo#13815
• fix: Install Factory publishing skill by @​anthonyshew in vercel/turborepo#13817

... (truncated)

Commits

• 53752d4 publish 2.10.12 to registry
• 9d2b03b fix: Run pnpm directly on Windows (#13843)
• c97782b feat: Require high confidence for issue fixes (#13842)
• f153cda chore: Alert Slack for low-confidence issues (#13841)
• e1674e4 chore: Add automatic issue handling (#13840)
• 7107f26 fix: Escape ampersands in RSS feed enclosure URLs (#13839)
• a76330b chore: Handle feedback on Factory pull requests (#13836)
• 3787c06 chore: Use geistdocs 1.23.1 (#13834)
• bbe5406 chore: Skip redundant Factory PR approval (#13837)
• 72805d7 fix: Move model selector to workspace creation (#13835)
• Additional commits viewable in compare view

Updates @hono/node-server from 2.0.10 to 2.1.1

Release notes

Sourced from @​hono/node-server's releases.

v2.1.1

What's Changed

• perf: lazily materialize request headers by @​BlankParticle in honojs/node-server#389

Full Changelog: honojs/node-server@v2.1.0...v2.1.1

v2.1.0

What's Changed

• feat: add Early Hints (HTTP 103) middleware by @​bilal-azam in honojs/node-server#378
• fix(listener): avoid uncaught error when force-closing a non-standard socket by @​mohamedramadan14 in honojs/node-server#383

New Contributors

• @​bilal-azam made their first contribution in honojs/node-server#378
• @​mohamedramadan14 made their first contribution in honojs/node-server#383

Full Changelog: honojs/node-server@v2.0.12...v2.1.0

v2.0.12

What's Changed

• test: replace supertest by @​BlankParticle in honojs/node-server#379
• fix(response): copy headers when init is a foreign Response by @​yusukebe in honojs/node-server#382

Full Changelog: honojs/node-server@v2.0.11...v2.0.12

v2.0.11

What's Changed

• test: use a custom helper for path traversal tests by @​BlankParticle in honojs/node-server#377
• perf(request): fast-path QUERY methods by @​usualoma in honojs/node-server#376
• perf(request): fast-path PATCH method by @​yusukebe in honojs/node-server#380

Full Changelog: honojs/node-server@v2.0.10...v2.0.11

Commits

• 73c03ad 2.1.1
• 5515aa0 perf: lazily materialize request headers (#389)
• 82ba34e 2.1.0
• 1f2909a fix(listener): avoid uncaught error when force-closing a non-standard socket ...
• 977a242 feat: add Early Hints (HTTP 103) middleware (#378)
• a813b6c 2.0.12
• caf48ba fix(response): copy headers when init is a foreign Response (#382)
• 3b1dd68 test: replace supertest (#379)
• 834e54f 2.0.11
• ba72bcd perf(request): fast-path PATCH method (#380)
• Additional commits viewable in compare view

Updates @hono/zod-validator from 0.9.0 to 0.9.1

Release notes

Sourced from @​hono/zod-validator's releases.

@​hono/zod-validator@​0.9.1

Patch Changes

• #2112 51b7f976286d0429179142e8058dcc59d1e82d75 Thanks @​T4ko0522! - Cached case-insensitive header schema metadata when creating validator middleware.

Changelog

Sourced from @​hono/zod-validator's changelog.

0.9.1

Patch Changes

• #2112 51b7f976286d0429179142e8058dcc59d1e82d75 Thanks @​T4ko0522! - Cached case-insensitive header schema metadata when creating validator middleware.

Commits

• 8de0f1e Version Packages (#2114)
• 51b7f97 perf(zod-validator): Caching the key mapping table of the header scheme (#2112)
• 40f956e chore(dev-deps): partial upgrade to TypeScript 7 (#2048)
• See full diff in compare view

Updates @langchain/core from 1.2.3 to 1.2.9

Release notes

Sourced from @​langchain/core's releases.

@​langchain/core@​1.2.9

Patch Changes

• #11402 43e4396 Thanks @​thushanth-bengre-langchain! - Fix ChatVertexAI/ChatGoogle content blocks: include tool_call blocks from message.tool_calls and skip spurious empty text blocks in contentBlocks.

@​langchain/core@​1.2.8

Patch Changes

• #11369 d6ad973 Thanks @​hntrl! - fix(langchain): use unified endpoint for gateway

• #11342 3b0e4c4 Thanks @​thushanth-bengre-langchain! - feat(core): mark errors as retryable or not, and stop retrying the ones that aren't

  Retry middleware retried every failure up to maxRetries, including deterministic ones like a bad API key or an unknown model. Retries also nest, so a single such failure could cost dozens of API calls.

  @langchain/core/errors adds stampRetryable(error, retryable) and getRetryable(error). Marking an error leaves its class and shape untouched, so a provider SDK error can be classified without breaking instanceof. getRetryable returns undefined for errors nobody classified, and both are exported so tool authors can mark their own failures.

  modelRetryMiddleware and toolRetryMiddleware now respect the mark by default, and retries stop as soon as one is found rather than each layer spending its own budget. Aborted calls, context overflow, and oversized payloads are marked non-retryable out of the box. Models accept a per-call maxRetries so a surrounding retry loop can take over.

  Behavior change: errors marked non-retryable now fail on the first attempt. Unclassified errors — including any from third-party integrations or custom tools — retry exactly as before. Pass retryOn: () => true to restore the old default. A custom onFailedAttempt replaces the built-in handler and opts out of marking.

@​langchain/core@​1.2.7

Patch Changes

• #11366 c068bbf Thanks @​hntrl! - fix(core,langchain): patch and release core, update peer dependencies

@​langchain/core@​1.2.6

Patch Changes

• #11344 f08e0c6 Thanks @​hntrl! - fix: apply [Symbol.hasInstance] method to all comparable properties using .isInstance()

  We have some internal schemas that rely on z.instanceof(). This uses a strict instanceof check which can conflict if there are multiple versions of core installed. This overrides the Symbol.hasInstance method to use the same logic as .isInstance() to compare objects at runtime.

@​langchain/core@​1.2.5

Patch Changes

• #11305 e654022 Thanks @​jacoblee93! - Add LangSmith Gateway environment configuration to OpenAI, Anthropic, and Fireworks chat models.

• #11295 1a1b347 Thanks @​vladislav-nechakhin! - fix(core): pass the mustache escape override per render call

@​langchain/core@​1.2.4

Patch Changes

• #11190 9654bde Thanks @​pawel-twardziak! - Coalesce nested LangChain tracer callbacks that share run bookkeeping.

• #11153 84ce6d6 Thanks @​parveshsaini! - fix(core): bind splitText when trimMessages receives a TextSplitter instance

Commits

• e493ed6 chore: version packages (#11393)
• 8384848 fix(google-common): release endpoint routing fix as patch (#11413)
• 8cfff4d feat(google): add gateway support for genai (#11405)
• 7df258c chore(langchain): update langgraph deps (#11412)
• 3ceef4b fix(anthropic): round-trip tool search server-tool result blocks (#11407)
• fe8eec1 fix(openai): drop Gemini functionCall content blocks in Chat Completions mess...
• 0e7c765 fix(google-genai): throw ContentBlockedError when Gemini candidate has no con...
• 5c9fdf2 fix(openai): retain cache_write_tokens, update to v7 sdk (#11399)
• 5ff9179 fix(google-genai): guard streaming chunks when candidate has no content (#10742)
• 43e4396 fix(core): include tool_call blocks and skip empty text blocks in ChatVertexA...
• Additional commits viewable in compare view

Updates @langchain/openai from 1.5.5 to 1.5.11

Release notes

Sourced from @​langchain/openai's releases.

@​langchain/openai@​1.5.11

Patch Changes

• #11448 53dbfc2 Thanks @​hntrl! - fix(openai): resolve encrypted content with zdr when streaming

  OpenAI recently changed the disposition of encrypted_content to contain the canonical payload on the final done event. Encrypted content also does not need to be a parameter in the include call options in order to propagate.

@​langchain/openai@​1.5.10

Patch Changes

• #11419 c26c87e Thanks @​chiliec! - fix(openai): send content null (not []) for tool-call-only v1 assistant messages

@​langchain/openai@​1.5.9

Patch Changes

• #11399 5c9fdf2 Thanks @​gethin-langchain! - update to v7 openai sdk

• #11403 fe8eec1 Thanks @​thushanth-bengre-langchain! - Drop Gemini-native functionCall content blocks (already carried in tool_calls) when converting messages to Chat Completions API params, fixing requests that fail when a ChatGoogleGenerativeAI message is passed to ChatOpenAI (e.g. a cross-provider handoff in LangGraph).

• #11399 5c9fdf2 Thanks @​gethin-langchain! - Map OpenAI's cache_write_tokens to cache_creation in usage_metadata.input_token_details, mirroring the existing cached_tokens -> cache_read mapping across the Chat Completions and Responses APIs. Previously, prompt cache-write token counts were silently dropped.

@​langchain/openai@​1.5.8

Patch Changes

• #11342 3b0e4c4 Thanks @​thushanth-bengre-langchain! - feat(openai): mark OpenAI provider errors as retryable or not

  Builds on stampRetryable in @langchain/core so the retry middleware can tell a transient failure from a deterministic one. Timeouts and rate limits are marked retryable; aborts, context overflow, invalid tool results, bad credentials, and unknown models non-retryable. Anything else stays unmarked and retries as before.

  Also forwards a per-call maxRetries to the retry loop, so a surrounding retry loop such as modelRetryMiddleware can take over instead of the two multiplying against each other.

  Errors keep their original class, so instanceof against the openai SDK error types is unaffected.

@​langchain/openai@​1.5.7

Patch Changes

• #11347 3fe4c43 Thanks @​talarari! - fix(openai): include usage in response_metadata when system_fingerprint is absent

@​langchain/openai@​1.5.6

Patch Changes

• #11305 e654022 Thanks @​jacoblee93! - Add LangSmith Gateway environment configuration to OpenAI, Anthropic, and Fireworks chat models.

Commits

• 21fff39 chore: version packages (#11517)
• 6b613fe fix(infra): add oxfmt formatter
• b522160 chore(infra): update to changesets 3 (#11516)
• ba81a3c chore: version packages (#11462)
• e927605 fix(aws): recognize claude 5 models in supportedToolChoiceValuesForModel (#11...
• ffadf85 chore(deps): bump the minor-and-patch group across 1 directory with 39 update...
• 679f79b chore(deps): bump the aws group across 1 directory with 7 updates (#11484)
• 0f54ed6 chore(deps): bump the build-and-test group across 1 directory with 3 updates ...
• 147e082 chore(deps): bump google-auth-library from 10.9.1 to 11.0.2 in the google gro...
• 7969427 chore(deps): bump changesets/action from 1.9.0 to 2.1.1 in the gh-actions-maj...
• Additional commits viewable in compare view

Updates better-auth from 1.6.23 to 1.7.2

Release notes

Sourced from better-auth's releases.

v1.7.2

better-auth

Bug Fixes

• Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
• Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
• Added warnings for invalid signed session data in the cookie cache. (#10934)
• Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
• Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
• Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
• Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
• Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
• Improved getTestInstance performance with a faster default password hasher. (#10879)
• Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
• Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
• Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
• Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
• Added synchronous and optional access to the current auth endpoint context. (#10938)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
• Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
• Fixed relative redirect URLs containing fragments. (#10983)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
• Added validation for missing Drizzle schema fields in compound where clauses. (#10859)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.2

Patch Changes

• #10875 d5d889b Thanks @​bytaesu! - Fix programmatic migrations failing on Cloudflare D1 while preserving existing-index validation across supported databases.

• #10982 b4ad5a1 Thanks @​bytaesu! - Built-in placeholder emails now consistently use the namespaced {identifier}@{namespace}.placeholder.invalid format.

• #10934 c7a5c1a Thanks @​bytaesu! - Cookie-cache reads now warn when signed session data is invalid instead of silently appearing as a signed-out session.

• #10879 78f0c39 Thanks @​starslingdev! - Test suites using getTestInstance now run faster because the shared fixture avoids production password-hashing costs by default. Custom emailAndPassword.password implementations continue to take precedence.

• #10823 ce8a3ab Thanks @​sosyz! - Ensure permanently banning a user clears any expiration from a previous temporary ban.

• #10907 a021eaf Thanks @​heliohm! - A client created with more plugins is again assignable to a client type declaring fewer plugins, as in 1.6.

• #10959 c8dcfa5 Thanks @​bytaesu! - Allow same-origin form submissions from pages using Referrer-Policy: no-referrer while continuing to reject untrusted request origins.

• #10979 fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.

• #10041 f6891a2 Thanks @​GautamBytes! - Allow ~ in relative callback URLs validated by trusted origin checks.

• #10877 649818a Thanks @​bytaesu! - Prevent disabled MyISAM indexes from satisfying migration index checks.

• Updated dependencies [557e19b, 64da15b, d5d889b, b4ad5a1, ea77118, 5aea9f7, fced1a5, e1d4011]:

  • @​better-auth/core@​1.7.2
  • @​better-auth/kysely-adapter@​1.7.2
  • @​better-auth/drizzle-adapter@​1.7.2
  • @​better-auth/memory-adapter@​1.7.2
  • @​better-auth/mongo-adapter@​1.7.2
  • @​better-auth/prisma-adapter@​1.7.2
  • @​better-auth/telemetry@​1.7.2

1.7.1

Patch Changes

• #10863 845bbd1 Thanks @​gustavovalverde! - auth migrate no longer attempts to add a required column with no default value to a table that already has rows. It stops with an error naming the column and the backfill to run first. Previously the generated statement failed on SQLite, Postgres, and SQL Server; on MySQL it filled the new column with an empty string for every existing row and reported success. If auth migrate already ran against a MySQL database on 1.7, run the check in the upgrade guide's account identity section.

  getMigrations throws the new UnsafeMigrationError...

  Description has been truncated

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.