AuthJS provider cannot use patched next-auth 4.24.15 (GHSA-7rqj-j65f-68wh)

[ucchishta-dd]

Environment

• Operating System: Linux / macOS
• Node Version: 22
• Nuxt Version: 4.4.8
• Nitro Version: 2.13.4
• Package Manager: pnpm 10
• Builder: Vite
• Runtime Modules:
  • @sidebase/nuxt-auth@1.3.1
  • next-auth@4.24.15
• Provider: authjs

Reproduction

The problem can be reproduced with the following dependencies:

{
  "dependencies": {
    "@sidebase/nuxt-auth": "1.3.1",
    "next-auth": "4.24.15",
    "nuxt": "4.4.8"
  }
}

Configure the AuthJS provider and add a NuxtAuthHandler under
server/api/auth/[...].ts, then run:

pnpm install
pnpm build
node .output/server/index.mjs

Access an AuthJS endpoint such as:
curl http://localhost:3000/api/auth/session

Describe the bug

next-auth@4.24.15 contains the fix for the published security advisory
GHSA-7rqj-j65f-68wh.

However, @sidebase/nuxt-auth currently declares next-auth ~4.21.1 as a peer
dependency and imports AuthHandler from the internal next-auth/core
subpath.

next-auth@4.24.15 no longer exports this subpath. During a Nuxt production
build, Nitro reports that it cannot resolve next-auth/core but treats it as
an external dependency, allowing the build to finish successfully. The
generated server can then fail when the authentication handler is loaded at
runtime.

This appears related to the previously reported issue #514. Pinning
next-auth@4.21.1 is no longer a satisfactory workaround because security
scanners now flag it as vulnerable.

Expected Behavior

@sidebase/nuxt-auth should support a patched version of next-auth, or
provide a documented supported migration/mitigation for AuthJS users affected
by GHSA-7rqj-j65f-68wh.
Ideally:

• the peer dependency permits a patched next-auth version;
• the AuthJS handler uses a supported public export rather than
  next-auth/core; and
• the production build does not leave an unresolved runtime dependency.

Additional context

The current main branch still imports:

import { AuthHandler } from 'next-auth/core'

This import is visible in:
https://github.com/sidebase/nuxt-auth/blob/main/src/runtime/server/services/authjs/nuxtAuthHandler.ts

The latest published @sidebase/nuxt-auth release also still declares
next-auth ~4.21.1 as its peer dependency.

Could the maintainers advise whether support for next-auth@4.24.15 is
planned? If direct support is not currently possible, what mitigation is
recommended for AuthJS users who need to address the published advisory?

Logs

Could not resolve import "next-auth/core" in
@sidebase/nuxt-auth/dist/runtime/server/services/authjs/nuxtAuthHandler.js
using exports defined in next-auth/package.json.

"next-auth/core" ... could not be resolved – treating it as an external
dependency.