[jameskurz-filecoin]

AuthKit saves the WorkOS session before invoking onSuccess. Clockwork's callback then performed a commerce membership lookup whose result was discarded. If that lookup failed, AuthKit returned HTTP 500 with “Couldn't sign in” while leaving the user signed in. This matches the reported sequence of an error after entering an email code followed by a working session when navigating directly to the app.

Remove the duplicate lookup from the callback so successful authentication completes its redirect. The destination and protected operations still resolve commerce membership and permissions through getCommerceSession; missing membership and database failures continue to deny commerce access. No roles, memberships, MFA policy, or provider error handling change.

The release audit also exposed existing high-severity dependency advisories. Update Zod to 4.6.6 (advisory), body-parser to 2.4.0 (advisory), and undici to 8.12.2 (advisory). Trigger SDK/core moves to 4.6.4 to support Zod 4 without forcing an incompatible major version into its old consumer; preserve the scoped OpenTelemetry alignment. No new advisory exceptions are added.

Validation:

• Reproduced the original HTTP 500 with a saved session using the installed AuthKit implementation and a failing commerce lookup; the regression passes with the fix.
• 77 focused authentication tests passed, including callback redirects, configured public origin, return paths, rejected provider codes, OAuth state mismatch, cookie preservation, and commerce authorization failures.
• Web TypeScript check and pre-commit formatting, lint, and secret checks passed.
• Workflow type check and 535 workflow tests passed after the dependency update. Production audit passes the high-severity threshold; 8 low/moderate findings remain.

Production logs were not available in this environment, so the precise lookup exception for the reported attempt is unconfirmed. The earlier email delivery delay is separate and is not addressed by this callback change.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​trigger.dev/​sdk@​4.5.9 ⏵ 4.6.4	+1		+1	+1
	zod@​4.4.3 ⏵ 4.6.6		+16		+1

View full report