chore(deps): bump the npm-deps group across 1 directory with 10 updates by dependabot[bot] · Pull Request #75 · codebar/auth

dependabot · 2026-09-24T10:15:13Z

Bumps the npm-deps group with 10 updates in the / directory:

Package	From	To
@better-auth/oauth-provider	`1.6.27`	`1.7.5`
better-auth	`1.6.27`	`1.7.5`
hono	`4.13.5`	`4.13.8`
@playwright/test	`1.62.1`	`1.63.0`
eslint	`10.8.1`	`10.10.0`
fallow	`3.22.0`	`3.27.0`
globals	`17.11.0`	`17.12.0`
lint-staged	`17.3.0`	`17.5.1`
prettier	`3.9.6`	`3.9.7`
tap	`21.7.5`	`21.8.0`

Updates @better-auth/oauth-provider from 1.6.27 to 1.7.5

Release notes

Sourced from @better-auth/oauth-provider's releases.

v1.7.5

better-auth

Features

Added database.schemaName support for direct PostgreSQL connections. (#11203)

Bug Fixes

Improved server-side logging for Cloudflare Turnstile verification failures. (#11283)

Fixed PostgreSQL migrations incorrectly identifying tables and views across schemas. (#11270)

Fixed MySQL index validation for existing string columns. (#11272)

Removed the unused optional better-sqlite3 peer dependency to prevent installation conflicts. (#11209)

For detailed changes, see CHANGELOG

@better-auth/core

Features

Added database.schemaName support for direct PostgreSQL connections. (#11203)

Bug Fixes

Fixed database option type inference outside Cloudflare Workers. (#11290)

For detailed changes, see CHANGELOG

@better-auth/cimd

Bug Fixes

Fixed unnecessary pacing of consecutive CIMD OAuth requests when metadata cannot be cached. (#11161)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

Fixed lazy database initialization when using Drizzle relations. (#11263)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Features

Added database.schemaName support for direct PostgreSQL connections. (#11203)

... (truncated)

Changelog

Sourced from @better-auth/oauth-provider's changelog.

1.7.5

1.7.4

1.7.3

Patch Changes

#11090 4d09d50 Thanks @Salman-Arshad! - Allow native OAuth clients with localhost loopback redirect URIs to use ephemeral callback ports, and ensure loopback port variance changes only the port.

1.7.2

Patch Changes

#11010 bb8d7c4 Thanks @bytaesu! - Client ID Metadata Document clients that declare a grant the server does not offer (such as Claude's enterprise jwt-bearer grant) can now register. Only documents sharing no grant with the server are refused.

#10979 fced1a5 Thanks @bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.

1.7.1

1.7.0

Minor Changes

#10577 5c45abc Thanks @gustavovalverde! - OAuth clients now store applicationType and expose it as application_type in OAuth metadata. tokenEndpointAuthMethod alone determines authentication: "none" is public, and every other method is confidential. The legacy type and public fields are removed.

OAuthClient no longer has a catch-all string index. Model custom wire extensions explicitly with a named intersection such as OAuthClient & YourExtensionMetadata; legacy type and public fields no longer type-check as unknown baggage.

Dynamic, administrative, and user-managed registrations default an omitted application_type to web. Client ID Metadata Documents preserve an omitted value as null.

Web redirects require HTTPS on a non-loopback host. Native redirects accept claimed HTTPS URLs, exact HTTP loopback hosts, or reverse-domain private-use schemes.

Registration resource options control resource links. mcp() contributes its protected resource by default, so standards-based clients no longer need a resources extension.

mcp() no longer enables unauthenticated Dynamic Client Registration. Compose mcp() with cimd() for Client ID Metadata Documents, or enable both DCR flags explicitly.

This release requires a database migration. Add applicationType and nullable clientDiscoveryId; map old web and native values directly, map user-agent-based to NULL for manual reclassification, and never derive it from public. Set clientDiscoveryId only from known discovery provenance, never by inspecting an HTTPS client ID. Deduplicate existing (clientId, resourceId) links before adding the new compound unique index, then drop the legacy columns. Deployments with custom schema mappings must apply this backfill manually.

Machine-to-machine scope authority is now stored separately in nullable oauthClient.clientCredentialsScopes. Missing, NULL, and empty values deny client_credentials token issuance. Only the administrative create and update endpoints expose client_credentials_scopes, and assigning a non-empty value requires clientPrivileges to approve the new configure-client-credentials-scopes action. DCR, CIMD, and user-managed registration cannot assign this field; CIMD refresh preserves an existing administrator-owned value. Remove clientCredentialGrantDefaultScopes, backfill every existing client to [], configure [] as the default for new rows, then explicitly assign every approved machine scope after auditing the client.

#10577 5c45abc Thanks @gustavovalverde! - Client ID Metadata Documents now follow shared-cache freshness rules and fail closed when freshness is ambiguous. The plugin prefers s-maxage over max-age and Expires, honors s-maxage=0, conditionally revalidates with ETag or Last-Modified, and treats invalid or duplicate freshness directives as immediately stale. Concurrent refreshes converge on one client-resource link instead of failing on its unique constraint.

Shared OAuth metadata validation now rejects a blank client_name without trimming a valid display name. Native private-use redirects require the RFC 8252 single-slash form, such as com.example.app:/callback. Native HTTP redirects accept only exact localhost, 127.0.0.1, or [::1] hosts; other 127.0.0.0/8 addresses and localhost subdomains are rejected.

CIMD now bounds metadata request amplification through metadataFetchPolicy: same-client fetches coalesce, per-client pacing and global/per-origin concurrency reject immediately, and rolling 60-second budgets cap unique-client sprays. HTTP no-store, private, and Vary: * behavior is unchanged and never feeds metadata or validators into the governor.

Node.js deployments can import fetchClientMetadataResource from @better-auth/cimd/node. The transport resolves once, rejects any non-public DNS answer, pins the approved connection without using the global HTTPS pool, preserves Host and TLS certificate identity, and returns redirects and response bodies without buffering. Other runtimes remain responsible for providing an equivalent secure transport.

Unknown draft-02 metadata members are now ignored and never persisted. Recognized secrets, privilege fields, and server controls remain fatal, while generic internal aliases and nonstandard client-credentials authority spellings are stripped.

#9159 cd8313b Thanks @gustavovalverde! - Add @better-auth/cimd for Client ID Metadata Document draft-02. An exact HTTPS metadata-document URL becomes the OAuth client_id, and OAuth discovery advertises support when the plugin is installed. The explicit metadataProfile: "mcp-2026-07-28" mode applies the draft-00 metadata requirements pinned by MCP 2026-07-28.

Validate the complete shared OAuth client metadata schema. Generic draft-02 clients may omit client_name and redirect_uris and may use any grant supported by the OAuth Provider; the MCP profile requires client_id, client_name, and redirect_uris.

Reject client secrets, private JWK material, back-channel logout metadata, server-owned fields, unsafe metadata URLs, non-JSON responses, oversized documents, redirects, and private or reserved network targets. Loopback Client Identifier URLs are no longer supported.

Validate registered, discovered, and remotely fetched client JWKS through one public-asymmetric-key boundary. RFC 7517 JWK Sets must use { "keys": [...] }; replace the removed bare-array form jwks: [key] with jwks: { keys: [key] }. Empty, malformed, symmetric, private, and unsupported key sets fail before they can enter a provider-scoped cache. EC keys must use P-256, P-384, or P-521; OKP keys must use Ed25519. A declared alg must match the key type and curve. Existing OAuth client rows written through oauthToSchema are already normalized, so no database rewrite is required unless rows were written outside Better Auth.

... (truncated)

Commits

5468e6b chore: release v1.7.5 (#11245)
735008f chore: release v1.7.4 (#11216)
597d39c chore: release v1.7.3 (#11032)
2220ee7 revert: drop the issuer column and resolve accounts by provider id (#11153)
4d09d50 fix(oauth-provider): extend RFC 8252 loopback port variance to localhost (#11...
c0444dc fix: align OpenAPI required fields with Zod 4.5 (#11066)
ba12fcd chore: release v1.7.2 (#10870)
bb8d7c4 fix(oauth-provider): backport CIMD grant intersection (#11010)
79904f0 fix(origin-check): support fragments in relative redirect URLs (#10983)
2344536 chore: release v1.7.1 (#10864)
Additional commits viewable in compare view

Updates better-auth from 1.6.27 to 1.7.5

Release notes

Sourced from better-auth's releases.

v1.7.5

better-auth

Features

Added database.schemaName support for direct PostgreSQL connections. (#11203)

Bug Fixes

Improved server-side logging for Cloudflare Turnstile verification failures. (#11283)

Fixed PostgreSQL migrations incorrectly identifying tables and views across schemas. (#11270)

Fixed MySQL index validation for existing string columns. (#11272)

Removed the unused optional better-sqlite3 peer dependency to prevent installation conflicts. (#11209)

For detailed changes, see CHANGELOG

@better-auth/core

Features

Added database.schemaName support for direct PostgreSQL connections. (#11203)

Bug Fixes

Fixed database option type inference outside Cloudflare Workers. (#11290)

For detailed changes, see CHANGELOG

@better-auth/cimd

Bug Fixes

Fixed unnecessary pacing of consecutive CIMD OAuth requests when metadata cannot be cached. (#11161)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

Fixed lazy database initialization when using Drizzle relations. (#11263)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Features

Added database.schemaName support for direct PostgreSQL connections. (#11203)

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.5

Patch Changes

#11283 e56c45b Thanks @bytaesu! - Log Cloudflare Turnstile error codes and binding mismatches on the server so CAPTCHA verification failures can be diagnosed.

#11209 8d37cc3 Thanks @siam923! - Remove the unused optional better-sqlite3 peer dependency to prevent installation conflicts.

#11272 348fc26 Thanks @bytaesu! - Use MySQL's reported byte lengths when validating indexes on existing string columns.

#11203 cb627eb Thanks @dshukertjr! - Add a database.schemaName option for direct PostgreSQL connections. When set, the adapter and the CLI qualify every statement with that schema, so auth generate writes a schema-qualified migration that creates the schema before its tables instead of relying on the connection's search_path.

#11270 133f6a2 Thanks @bytaesu! - Prevent PostgreSQL migrations from treating tables in other schemas or views in the active schema as Better Auth tables.

Updated dependencies [e18bc83, cb627eb, dae97ed]:

@better-auth/drizzle-adapter@1.7.5

@better-auth/kysely-adapter@1.7.5

@better-auth/core@1.7.5

@better-auth/memory-adapter@1.7.5

@better-auth/mongo-adapter@1.7.5

@better-auth/prisma-adapter@1.7.5

@better-auth/telemetry@1.7.5

1.7.4

Patch Changes

#11205 3f890eb Thanks @bytaesu! - Support Vitest 5 in the testing utilities while retaining support for previously supported Vitest versions.

#11224 c1756a2 Thanks @bytaesu! - Add experimental.instrumentation.enabled to disable Better Auth OpenTelemetry span creation per auth instance. Instrumentation remains enabled by default and independent of usage reporting.

#11217 9b9638e Thanks @onmax! - Allow testUtils auth helpers to accept additional session fields through the session option, including required fields without defaults and per-session overrides of configured defaults.

Updated dependencies [3ff842a, b905bfe, c1756a2]:

@better-auth/core@1.7.4

@better-auth/drizzle-adapter@1.7.4

@better-auth/kysely-adapter@1.7.4

@better-auth/memory-adapter@1.7.4

@better-auth/mongo-adapter@1.7.4

@better-auth/prisma-adapter@1.7.4

@better-auth/telemetry@1.7.4

1.7.3

Patch Changes

#11060 3660f06 Thanks @bytaesu! - Handle malformed custom-scheme callback URLs without excessive processing.

#11037 5bd7096 Thanks @bytaesu! - Prevent repeated TOTP enrollment from replacing an active authenticator and its backup codes.

... (truncated)

Commits

5468e6b chore: release v1.7.5 (#11245)
e56c45b fix(captcha): log Turnstile verification failures (#11283)
cb627eb feat(postgres): add support for custom schema name in PostgreSQL connections ...
348fc26 fix(db): use reported MySQL index byte bounds (#11272)
b93f73d refactor(db): model migration targets by dialect (#11271)
133f6a2 fix(db): use Kysely metadata for PostgreSQL schema introspection (#11270)
34ad3be refactor(cookies): centralize cookie cache version validation (#11254)
8d37cc3 fix(deps): remove unused better-sqlite3 peer dependency (#11209)
735008f chore: release v1.7.4 (#11216)
80b1d64 chore(deps): bump next (#11226)
Additional commits viewable in compare view

Updates hono from 4.13.5 to 4.13.8

Release notes

Sourced from hono's releases.

v4.13.8

What's Changed

docs: fix typos in code comments and link third-party middleware section in honojs/hono#5343

perf(jsx/dom): reduce lookup work for large keyed updates in honojs/hono#5340

fix(aws-lambda): respect backpressure when streaming the response body in honojs/hono#5351

fix(accepts, language): skip accept entries with quality 0 when matching in honojs/hono#5311

fix(accept): treat the q parameter name as case-insensitive in honojs/hono#5349

fix(accept): clamp a negative q to 0, not 1 in honojs/hono#5357

fix(request): keep the request media type when reusing a cached body in honojs/hono#5366

docs(combine): fix except() JSDoc param and add missing @returns in honojs/hono#5346

perf(jsx/dom): optimize matching-head child lookup during reconciliation in honojs/hono#5329

Full Changelog: honojs/hono@v4.13.7...v4.13.8

v4.13.7

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

What's Changed

fix(client): keep a param value of "index" in $url() and $path() in honojs/hono#5297

fix(client): normalize root WebSocket URLs in honojs/hono#5291

fix(types): allow symbol keys in Context get and set fallbacks in honojs/hono#5300

chore: bump editorconfig-checker in honojs/hono#5336

refactor(on-handler): use forEach for consistent handler iteration in honojs/hono#5326

Full Changelog: honojs/hono@v4.13.5...v4.13.6

Commits

098e119 4.13.8
e8c8c21 perf(jsx/dom): optimize matching-head child lookup during reconciliation (#5329)
8755b17 docs(combine): fix except() JSDoc param and add missing @returns (#5346)
edd138e fix(request): keep the request media type when reusing a cached body (#5366)
9b4e9c2 fix(accept): clamp a negative q to 0, not 1 (#5357)
65cff90 fix(accept): treat the q parameter name as case-insensitive (#5349)
f147de5 fix(accepts, language): skip accept entries with quality 0 when matching (#5311)
90e1b94 fix(aws-lambda): respect backpressure when streaming the response body (#5351)
7792f5d perf(jsx/dom): reduce lookup work for large keyed updates (#5340)
e7b38ee docs: fix typos in code comments and link third-party middleware section (#5343)
Additional commits viewable in compare view

Updates @playwright/test from 1.62.1 to 1.63.0

Release notes

Sourced from @playwright/test's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:
test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});
A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:
// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();
The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:
await page.locator('button').visible().click();
🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:
await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });
Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits

1b025d7 chore: mark v1.63.0 (#42569)
0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
13dbf10 cherry-pick(#42552): docs: release notes for v1.63
e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
2b7a5f2 test: response.body() for content-encoding:identity (#42537)
648a67c fix(mcp): create parent directories for explicitly named files (#42540)
7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
52900a1 devops: restore npm publishing from GitHub Actions (#42550)
8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
Additional commits viewable in compare view

Updates eslint from 10.8.1 to 10.10.0

Release notes

Sourced from eslint's releases.

v10.10.0

Features

264b434 feat: add d and v flags to no-unexpected-multiline (#21305) (Gihyeon Jeong / 정기현)

c6cc6c5 feat: check Object.prototype property names in new-cap (#21269) (crimsonjay0)

5661fa6 feat: no-extra-bind false negatives with class fields and static blocks (#21260) (synthex-byte)

Bug Fixes

bb47dc6 fix: update dependency file-entry-cache to v11 (#20801) (Milos Djermanovic)

427ac0a fix: use format strings in debug calls (#21247) (Francesco Trotta)

9d81532 fix: support __proto__ in /* exported */ comments (#21261) (sethamus)

87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282) (김채영)

8e2cb14 fix: new-cap false positive for UTC calls with properties: false (#21275) (Pixel)

9f4a364 fix: Ignore static imports in no-unreachable (#21276) (Taha Kotil)

Documentation

2417cad docs: Update README (GitHub Actions Bot)

9cecb8a docs: document \c control letter escapes in no-control-regex (#21286) (한국)

8724829 docs: update compat table links (#21263) (fnx)

5634542 docs: Clarify eqeqeq suggestion behavior (#21256) (Müslüm Yılmaz)

Chores

b3d876b chore: disable npm audit in ecosystem tests (#21306) (Francesco Trotta)

1696682 ci: restore EMFILE test on Node.js 26 (#21297) (Marry (Subin Yang))

2c7f5d6 chore: update github/codeql-action action to v4.37.9 (#21296) (renovate[bot])

3c753f1 chore: update eslint (#21289) (renovate[bot])

1c73469 chore: update ecosystem plugins (#21280) (ESLint Bot)

08a02be test: add error locations to no-extra-boolean-cast (#21266) (lumir)

77bb1db chore: update github/codeql-action action to v4.37.8 (#21270) (renovate[bot])

007e81a ci: skip EMFILE test on Node.js 26 (#21265) (lumir)

0430280 chore: improve ecosystem tests compatibility on Windows (#21178) (crimsonjay0)

v10.9.1

Bug Fixes

1e641c9 fix: no-loss-of-precision false positive with trailing decimal point (#21251) (Aleksandr Shoronov)

Documentation

ad74a8d docs: add deprecation steps for EOL package versions (#21248) (Francesco Trotta)

Chores

3c3ae53 chore: update ecosystem plugins (#21249) (ESLint Bot)

v10.9.0

Features

08de88e feat: handle underflow in no-loss-of-precision (#21218) (Rithish S)

55db479 feat: add checkConditionalExpressions to no-unmodified-loop-condition (#21175) (sethamus)

Bug Fixes

2ba3025 fix: prevent unsafe no-var autofix with hoisted functions (#21213) (sethamus)

8e69622 fix: Prevent no-var autofix when var is shadowed by catch parameter (#21204) (Yang Hyeonjong)

684b579 fix: prefer-template invalid autofix creates a tagged template call (#21207) (김채영)

... (truncated)

Commits

3f20a57 10.10.0
f4e5284 Build: changelog update for 10.10.0
bb47dc6 fix: update dependency file-entry-cache to v11 (#20801)
427ac0a fix: use format strings in debug calls (#21247)
b3d876b chore: disable npm audit in ecosystem tests (#21306)
9d81532 fix: support __proto__ in /* exported */ comments (#21261)
264b434 feat: add d and v flags to no-unexpected-multiline (#21305)
1696682 ci: restore EMFILE test on Node.js 26 (#21297)
2c7f5d6 chore: update github/codeql-action action to v4.37.9 (#21296)
87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282)
Additional commits viewable in compare view

Updates fallow from 3.22.0 to 3.27.0

Release notes

Sourced from fallow's releases.

v3.27.0: every CI gate can fail the job, baseline staleness in CI, gate results in MCP

Features

An armed gate reports its result in the JSON output. A run that arms a gate gets gate_outcomes, an object keyed by gate name. Each entry has status (pass, warn, fail or skipped) and enforced. Where a comparison happened, you also get observed, threshold and threshold_label. Only the gates the run armed appear in the object. A dead-code run can exit 1 on the default severity rules with no object at all. The key set is open, and a gate name you do not recognise means "some gate". (#2680, #2681, #2683, #2685)

The JSON output reports a stale baseline, and CI can fail on it. 3.26.0 printed the stale-baseline warning and --fail-on-stale-baseline on stderr only, and --quiet removes that output. The GitHub Action and the GitLab template both run with --quiet. dead-code / check, the bare run, dupes and health report one baseline_staleness object, in grouped output too. It holds the entry counts, change_scoped, the warning result and gate_trips. Both integrations show a stale baseline as a warning and in the job summary. On a pull request the main run covers changed files only. The integrations therefore re-read the baseline once over the whole project. That re-read took 0.11s with a cache and 0.24s with type-aware analysis on an 870-file TypeScript project. Whether a stale baseline fails the job depends on the new fail-on-stale-baseline input and the FALLOW_FAIL_ON_STALE_BASELINE variable. The pull-request comment and the merge-request note do not include the warning yet. Thanks @cloud-walker for the report, which traced the gap through the action scripts. (#2673)

min-score is an Action input and a GitLab variable. Before this release you could set it only through args: / FALLOW_ARGS. --min-score implies --score, so the integrations add --complexity when no health section input is set. That keeps the annotations, the SARIF upload and the pull-request comment populated. The CLI turns its own findings rule off for such a run, and the integrations do the same, which leaves the decision to the score. min-score and min-severity apply to command: health and exit 2 elsewhere. (#2682)

A run that analyzed no source file reports it. The run prints a warning and passes by default. fail-on-empty-analysis: true (FALLOW_FAIL_ON_EMPTY_ANALYSIS on GitLab) makes it fail. The JSON output has a no-source-files-analyzed diagnostic and the new workspace_diagnostics[].degrades_analysis field. When findings cover less than the whole project, the integrations print one combined warning with the diagnostic kinds and their counts. (#2686)

An MCP tool result reports what each gate concluded. The tools run the CLI with --quiet and turn exit 1 into a successful result, which hid every gate result from the agent. The root warnings array reports a stale baseline together with the re-save remedy. It also lists every gate that concluded fail or warn, with its numbers. A run that covered less than the whole project gets one entry too. The subprocess, Code Mode and typed routes all do this. find_dupes with a threshold takes the route that can evaluate it. A response with nothing to report is unchanged. (#2676)

fallow report --from shows the gate results in CI. It prints them as a notice annotation and as a line in the job summary, the pull-request comment and the merge-request note. The line is informational and never fails a step. (#2684)

Changed

security-gate fails the job independently of fail-on-issues. In both integrations the security branch sat inside the fail-on-issues conditional, and fail-on-issues: false meant that branch never ran.

The Action's inline Check threshold step is gone. Its logic moved into the analyze step, and the gates-failed output names the gates that decided the result.

In combined mode the duplication threshold does not fail the run, and the JSON output has enforced: false for it. Standalone dupes exits 1 as before. The default GitLab job forwards the threshold in combined mode, and that pipeline prints a warning with the reason.

--fail-on-stale-baseline changes one field in the output. That field is gate_outcomes["stale-baseline"].enforced. Nothing in baseline_staleness depends on the flag, not even gate_trips.

health --report-only sets enforced: false on every gate it evaluated.

One stale baseline can produce two lines for a pull request. The Action's warning comes from its whole-project re-read. The gate line from fallow report describes the scoped run, where the gate fails nothing.

No schema_version in the JSON output changed. gate_outcomes and workspace_diagnostics[].degrades_analysis are additive and optional.

Bug fixes

fail-on-regression, threshold, min-severity and the security gate fail the job. All four were documented as gates. Each one reported its result on stderr, which --quiet removes. Both integrations also drop the exit code when stdout parses as JSON. The integrations read gate_outcomes instead. A gate fails the build when its status is fail and enforced is true, and only when the input that owns it was set. A flag passed through args: prints a warning and cannot override fail-on-issues: false. (#2680, #2681, #2683, #2685)

Every failing gate is reported before the step exits. Both integrations stopped at the first failure, and a run with a tripped gate and findings reported one of the two. They print every reason, write the outputs and artifacts, and exit once. The security gate keeps exit 8, which outranks the generic 1.

The duplication threshold applies to the bare command on GitHub. The Action forwarded it on command: dupes only.

Upgrade notes

If you set fail-on-regression, threshold, min-severity or a security gate and relied on the job passing, expect failures. With security-gate and fail-on-issues: false, unset security-gate to keep the old behaviour.

Remove --fail-on-stale-baseline from args / FALLOW_ARGS, delete any separate unscoped gate step added as a workaround, and set the fail-on-stale-baseline input.

fail-on-stale-baseline with no baseline set, or on fix or security, exits 2.

Do not point baseline and save-baseline at the same file. The run saves before it compares, and such a baseline can never have a stale entry. The integrations warn about it.

If a workflow references the Check threshold step by name (continue-on-error, steps.*.outcome), point it at the analyze step and the gates-failed output.

With a pinned fallow older than 3.27.0, the integrations use the fields that version writes. A gate with no field in that version passes, and the integrations print one warning.

If you import npm/fallow/types in TypeScript, HealthBaselineStaleness is now BaselineStaleness. The old name remains as a deprecated alias.

Full Changelog: fallow-rs/fallow@v3.26.0...v3.27.0

v3.26.0: stale-baseline gate, built-in exclusion diagnostics, rule overrides everywhere

Features

--fail-on-stale-baseline turns a rotting baseline into a failing build. The new global flag exits 1 when a loaded --baseline has an entry that matched nothing this run. It works on dead-code / check, the bare run, dupes and health, in every output format. A run that cannot judge the baseline skips the flag and says so on stderr. That covers a scoped run, health --report-only, audit and decision-surface. JSON output is unchanged. (#2637)

dead-code --baseline warns when the saved baseline has gone stale. The wording matches what health --baseline has printed since 3.12.0. When a quarter or more of the entries match no current issue, the run says so and points at the re-save command. Exit codes are untouched. Thanks @cloud-walker for the report. (#2627)

A run can say which built-in ignore pattern removed source files. The walk assigns every excluded candidate to the pattern that remo...
Description has been truncated

Bumps the npm-deps group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@better-auth/oauth-provider](https://github.com/better-auth/better-auth/tree/HEAD/packages/oauth-provider) | `1.6.27` | `1.7.5` | | [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.6.27` | `1.7.5` | | [hono](https://github.com/honojs/hono) | `4.13.5` | `4.13.8` | | [@playwright/test](https://github.com/microsoft/playwright) | `1.62.1` | `1.63.0` | | [eslint](https://github.com/eslint/eslint) | `10.8.1` | `10.10.0` | | [fallow](https://github.com/fallow-rs/fallow) | `3.22.0` | `3.27.0` | | [globals](https://github.com/sindresorhus/globals) | `17.11.0` | `17.12.0` | | [lint-staged](https://github.com/lint-staged/lint-staged) | `17.3.0` | `17.5.1` | | [prettier](https://github.com/prettier/prettier) | `3.9.6` | `3.9.7` | | [tap](https://github.com/tapjs/tapjs) | `21.7.5` | `21.8.0` | Updates `@better-auth/oauth-provider` from 1.6.27 to 1.7.5 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/oauth-provider/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.5/packages/oauth-provider) Updates `better-auth` from 1.6.27 to 1.7.5 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.5/packages/better-auth) Updates `hono` from 4.13.5 to 4.13.8 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.13.5...v4.13.8) Updates `@playwright/test` from 1.62.1 to 1.63.0 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.62.1...v1.63.0) Updates `eslint` from 10.8.1 to 10.10.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.8.1...v10.10.0) Updates `fallow` from 3.22.0 to 3.27.0 - [Release notes](https://github.com/fallow-rs/fallow/releases) - [Changelog](https://github.com/fallow-rs/fallow/blob/main/release.toml) - [Commits](fallow-rs/fallow@v3.22.0...v3.27.0) Updates `globals` from 17.11.0 to 17.12.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](sindresorhus/globals@v17.11.0...v17.12.0) Updates `lint-staged` from 17.3.0 to 17.5.1 - [Release notes](https://github.com/lint-staged/lint-staged/releases) - [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md) - [Commits](lint-staged/lint-staged@v17.3.0...v17.5.1) Updates `prettier` from 3.9.6 to 3.9.7 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.9.6...3.9.7) Updates `tap` from 21.7.5 to 21.8.0 - [Release notes](https://github.com/tapjs/tapjs/releases) - [Commits](https://github.com/tapjs/tapjs/compare/tap@21.7.5...tap@21.8.0) --- updated-dependencies: - dependency-name: "@better-auth/oauth-provider" dependency-version: 1.7.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: better-auth dependency-version: 1.7.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: hono dependency-version: 4.13.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-deps - dependency-name: "@playwright/test" dependency-version: 1.63.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: eslint dependency-version: 10.10.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: fallow dependency-version: 3.27.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: globals dependency-version: 17.12.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: lint-staged dependency-version: 17.5.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: prettier dependency-version: 3.9.7 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-deps - dependency-name: tap dependency-version: 21.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-deps ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 24, 2026

Navigation Menu

chore(deps): bump the npm-deps group across 1 directory with 10 updates - #75

chore(deps): bump the npm-deps group across 1 directory with 10 updates#75
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-deps-0a357deddb

dependabot Bot commented on behalf of github Sep 24, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 24, 2026

v1.7.5

better-auth

Features

Bug Fixes

@better-auth/core

Features

Bug Fixes

@better-auth/cimd

Bug Fixes

@better-auth/drizzle-adapter

Bug Fixes

@better-auth/kysely-adapter

Features

1.7.5

1.7.4

1.7.3

Patch Changes

1.7.2

Patch Changes

1.7.1

1.7.0

Minor Changes

v1.7.5

better-auth

Features

Bug Fixes

@better-auth/core

Features

Bug Fixes

@better-auth/cimd

Bug Fixes

@better-auth/drizzle-adapter

Bug Fixes

@better-auth/kysely-adapter

Features

1.7.5

Patch Changes

1.7.4

Patch Changes

1.7.3

Patch Changes

v4.13.8

What's Changed

v4.13.7

Security fixes

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

v4.13.6

What's Changed

v1.63.0

🔒 Test locks

🪟 Locate across frames

👁️ Visible-only locators

🧾 Step params and subtitles

v10.10.0

Features

Bug Fixes

Documentation

Chores

v10.9.1

Bug Fixes

Documentation

Chores

v10.9.0

Features

Bug Fixes

v3.27.0: every CI gate can fail the job, baseline staleness in CI, gate results in MCP

Features

Changed

Bug fixes

Upgrade notes

v3.26.0: stale-baseline gate, built-in exclusion diagnostics, rule overrides everywhere

Features

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

`better-auth`

`@better-auth/core`

`@better-auth/cimd`

`@better-auth/drizzle-adapter`

`@better-auth/kysely-adapter`

`better-auth`

`@better-auth/core`

`@better-auth/cimd`

`@better-auth/drizzle-adapter`

`@better-auth/kysely-adapter`

`hono/jsx` renders plain strings unescaped in boundary components, leading to XSS