build(deps): bump the production-dependencies group across 1 directory with 21 updates by dependabot[bot] · Pull Request #147 · MonashAPS/MOJ

dependabot · 2026-11-09T08:31:45Z

Bumps the production-dependencies group with 21 updates in the / directory:

Package	From	To
convex	`1.46.0`	`1.49.0`
@convex-dev/aggregate	`0.3.1`	`0.3.4`
@convex-dev/rate-limiter	`0.4.2`	`0.4.3`
zod	`4.6.5`	`4.6.7`
@aws-sdk/client-ses	`3.1150.0`	`3.1163.0`
@better-auth/api-key	`1.7.7`	`1.7.18`
@better-auth/passkey	`1.7.7`	`1.7.18`
@codemirror/autocomplete	`6.20.3`	`6.20.4`
@codemirror/view	`6.43.14`	`6.43.15`
better-auth	`1.7.7`	`1.7.18`
chart.js	`4.5.1`	`4.6.1`
katex	`0.19.0`	`0.19.1`
lucide-react	`1.55.0`	`1.70.0`
next	`16.4.0`	`16.4.5`
nodemailer	`10.1.0`	`10.3.1`
react	`19.3.0`	`19.3.1`
react-dom	`19.3.0`	`19.3.1`
shiki	`4.5.0`	`4.6.0`
simple-icons	`16.35.0`	`16.36.0`
unist-util-visit	`5.1.0`	`5.2.0`
@oxlint/plugins	`1.87.0`	`1.91.0`

Updates convex from 1.46.0 to 1.49.0

Changelog

Sourced from convex's changelog.

1.49.0

New npx convex plugins install command, which installs the Convex plugin for Claude Code and Codex on macOS and Linux. It works with the terminal CLIs, the desktop apps and the VS Code extensions. Running it again upgrades the plugin to the latest version.

This version drops support for Node.js 20. Please update to Node.js 22 or newer.

Adds the v.function({ fnType, args, returns }) validator, which validates that a value is a well-formed function handle. You can specify fnType, args, and returns for TypeScript typechecking and including type signatures in codegen, but they are not checked when running functions or writing to a table at runtime. The inferred type of v.function() is FunctionHandle_future, which has the same type semantics as FunctionReference_future. When incorporating v.function() into your codebase, existing code that uses the FunctionHandle type may need to be updated to use FunctionHandle_future.

Security fixes for GHSA-qw8j-4xj7-6f28 and GHSA-9mw5-7p28-rvv4.

1.48.0

Convex deployments can now sign their own JWTs with an internally managed key-pair. The ctx.auth.signJwt API is available in mutations. The JWTs can be verified with the public key in the JWKS hosted at ${CONVEX_CLOUD_URL}/.well-known/jwks.json.

npx convex dev --verbose and npx convex deploy --verbose no longer print environment variable values. The logged list of environment variables shows every value as <redacted>, and values of 8 or more characters are also redacted wherever else they appear in the logged push response and diff, such as auth providers that auth.config.ts builds from process.env.

When an AI agent runs npx convex env list or npx convex env default list, they now list only names by default, so secrets stay out of the agent's context. Agents are detected from the environment variables they set. Pass --include-values to print the values.

Fixed npx convex ai-files install and npx convex ai-files update reporting success and exiting 0 when the guidelines download or the agent skills install failed. They now exit with code 1.

ctx.storage.store() and ctx.storage.get() are now available in mutations, not just actions. Files stored and read in a mutation count toward its transaction limits.

1.47.0

Fixed the next step printed by npx convex project create. It suggested npx convex deployment create <team>:<project>:dev --type dev, which always

... (truncated)

Commits

See full diff in compare view

Updates @convex-dev/aggregate from 0.3.1 to 0.3.4

Changelog

Sourced from @convex-dev/aggregate's changelog.

0.3.4

Add experimental configuration options for configuring the Aggregate's batch worker: WORKER_IDLE_COOLDOWN_MS, WORKER_POLL_INTERVAL_MS, and WORKER_SCHEDULE_PING.

0.3.3

Bump convex-helpers to 0.1.128, which isn’t affected by GHSA-g5c8-w9fp-h5vm. This only keeps security scanners from flagging a vulnerable dependency; @convex-dev/aggregate itself is not affected.

0.3.2

Updates the /test entrypoint for compatibility with convex-test's new defineTestApp capability.

Optimization: only pings the batch worker on the first enqueue in a transaction

Commits

9387465 0.3.4
24bc74b Add an env var to schedule the batch worker ping (#269)
243ccaf Let the batch worker's idle behavior be tuned per aggregate (#268)
131e0bc Rename GitHub org references from get-convex to convex
5a72b01 0.3.3
cf7dd5a Ignore Convex local files in Prettier
72c9291 Changelog for v0.3.3 (#280)
376e556 Return registerComponent's result from the test register function
aa4fa73 Update convex-helpers (#277)
da878bc 0.3.2
Additional commits viewable in compare view

Updates @convex-dev/rate-limiter from 0.4.2 to 0.4.3

Changelog

Sourced from @convex-dev/rate-limiter's changelog.

0.4.3

Add rateLimiter.credit(...) to give capacity back to a rate limit.

Commits

0848613 0.4.3
86e4996 Add a credit API to restore rate limit capacity (#70)
dee5af1 Rename GitHub org references from get-convex to convex (#79)
8388cd7 Return registerComponent's result from the test register function
See full diff in compare view

Updates zod from 4.6.5 to 4.6.7

Release notes

Sourced from zod's releases.

v4.6.7

Commits:

b500a2ee95134f81d74da7911d7378dd2853d042 4.6.7

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini

9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales

34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note

74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)

b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors

8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze

bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles

c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)

a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)

a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)

529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6

9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

Commits

b500a2e 4.6.7
9c21983 ci: stage at verbose so a failed OIDC token exchange says why
529f78d 4.6.6
a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
c42596b release: hold the run on the release-approval environment until the staged ve...
bacad51 docs: square the Code for Japan logo to match the other bronze tiles
8fb2faf docs: crop the Code for Japan logo and list it first in bronze
b2ef983 docs: add Code for Japan to bronze sponsors
74304ce release: stage npm versions instead of publishing them (#6622)
Additional commits viewable in compare view

Updates @aws-sdk/client-ses from 3.1150.0 to 3.1163.0

Release notes

Sourced from @aws-sdk/client-ses's releases.

v3.1163.0

3.1163.0(2026-11-05)

New Features

clients: update client endpoints as of 2026-11-05 (57e9f143)

client-bedrock-agentcore-control: Adds support for OAuth2 Authorization Server Metadata (RFC 8414) discovery URLs in custom JWT authorizer and OAuth2 credential provider configurations. (950c852a)

client-sagemaker: Fixed the ImageDeleted and ImageVersionDeleted waiters to succeed on the ResourceNotFound error returned by DescribeImage and DescribeImageVersion (6cc77117)

client-wafv2: AWS WAF customers who monetize AI traffic on Web ACLs can now configure payments through connected accounts (Stripe). (9e7dd06f)

client-appintegrations: This release adds a LastModifiedRegion field to GetApplication and ListApplications so customers can see which Region an application was last modified in. (878faafe)

client-quicksight: Amazon QuickSight adds APIs to view account service role settings and switch to or replace a customer-managed IAM role. (98371e60)

client-lambda-microvms: AWS Lambda MicroVMs now support the x86-64 CPU architecture, which you can select in addition to ARM64 (Graviton) when launching a MicroVM. (928e07cc)

client-bedrock-agent-runtime: Amazon Bedrock Managed Knowledge Base now supports an optional mediaId parameter in GetDocumentContent that you can use to retrieve images embedded in source documents. (0740a76b)

client-securityagent: Adds support for IAM Identity Center groups as Agent Space members. CreateMembership, DeleteMembership, and ListMemberships now accept the GROUP member type. ListMemberships can filter by USER, GROUP, or ALL, and returns group display name and description. (a8e028e7)

client-cloudwatch-logs: Adds account-level retention policies with dry run preview and the Essentials log group class to Amazon CloudWatch Logs (da8a2a29)

client-datasync: Adds support for federated identity on Azure Blob Storage and object storage locations, enabling DataSync to authenticate to Azure and Google Cloud Storage using Workload Identity Federation (WIF) over OpenID Connect (OIDC) instead of stored long-lived credentials. (9a8be11b)

client-route-53-domains: Route 53 Domains now supports restoring domains. This release adds the RestoreDomain API to self-serve domain restoration. (ce3d5a2c)

client-glue: AWS Glue Spark ETL jobs can now auto-upgrade to the latest version. Set GlueVersion to Auto, then track progress with the AutoVersionStatus field in GetJob. Use StartJobUpgradeAnalysis to approve or decline an upgrade, GetJobUpgradeAnalysis to view details, and StopJobUpgradeAnalysis to stop it. (b04dd0b0)

client-account-access-runtime: Adds SDK support for Account Access user portal operations, enabling users to list out and get credentials for role assignments configured in AWS IAM Account Access Manager. (0372bae5)

client-qconnect: Adds support for real-time agent assistance and self-service with Amazon Connect Global Resiliency, including cross-Region replication of supported AI agent resources and configurations. (d3305fbd)

client-agent-registry-control: Adds support for OAuth2 Authorization Server Metadata (RFC 8414) discovery URLs in custom JWT authorizer. (0b9b8f4d)

Bug Fixes

snapshot-testing: add camelCase checksumAlgorithm to customFields (#8403) (0bde7a79)

For list of updated packages, view updated-packages.md in assets-3.1163.0.zip

v3.1162.0

3.1162.0(2026-11-04)

Documentation Changes

fix typos in credential-providers and xhr-http-handler READMEs (#8400) (13b91575)

New Features

clients: update client endpoints as of 2026-11-04 (7b30cd35)

client-lookoutequipment: Amazon Lookout for Equipment reached end of support on October 7, 2026. All Lookout for Equipment APIs are now marked as deprecated. (9a4a6882)

client-rolesanywhere: Adds the crlDpRevocationEnabled field to enable automatic revocation checking using CRL distribution points in X.509 certificates. (5c3071ce)

client-marketplace-discovery: GetListing and SearchListings APIs now return G2 and PeerSpot review sources in review summaries. (cb49279d)

client-ec2: Add the Unsupported SupportabilityScore to GetCapacityManagerSupportabilityScores. (e8a84dc8)

client-elastic-beanstalk: Adds DefaultAmiList to DescribePlatformVersion to return the default AMI for each processor architecture that a platform version supports. (a7dfafce)

client-iotsitewise: Adds support for an optional jobName on CreateDatasetExportJob. The jobName is returned by DescribeDatasetExportJob and ListDatasetExportJobs, making dataset export jobs easier to identify and track. If jobName is omitted, a default name is generated automatically. (33a8bf05)

client-connect-contact-lens: Rules TBAC GA (Contact Lens V1) - Adds an optional ListFilter (CategoriesAttributeFilter with OrConditions, AndCondition and TagCondition) to ListRealtimeContactAnalysisSegments. This filters matched categories by rule tags. It also adds an optional RuleId to CategoryDetails in the response. (c09702f1)

client-taxsettings: Adds Colombia additional information (responsibility codes, taxpayer type code, and RUT issue date) and a rejection reason (statusReason) to tax registration responses, and adds Argentina and Uruguay tax registration types. (582f0ce2)

client-s3tables: Amazon S3 Tables now supports migrating AWS Glue Data Catalog tables into S3 Table buckets. This release adds the StartTableMigration, SyncTableMigration, UpdateTableMigration, CompleteTableMigration, GetTableMigration, and ListTableMigrations APIs. (235b2d68)

... (truncated)

Changelog

Sourced from @aws-sdk/client-ses's changelog.

3.1163.0 (2026-11-05)

Note: Version bump only for package @aws-sdk/client-ses

3.1162.0 (2026-11-04)

Features

codegen: add a default socket timeout per service (#8396) (8f62478)

3.1161.0 (2026-10-30)

Note: Version bump only for package @aws-sdk/client-ses

3.1160.0 (2026-10-29)

Note: Version bump only for package @aws-sdk/client-ses

3.1159.0 (2026-10-28)

Note: Version bump only for package @aws-sdk/client-ses

3.1158.0 (2026-10-27)

Note: Version bump only for package @aws-sdk/client-ses

... (truncated)

Commits

9163d15 Publish v3.1163.0
80cb789 Publish v3.1162.0
8f62478 feat(codegen): add a default socket timeout per service (#8396)
258c144 Publish v3.1161.0
f393101 chore(codegen): sync to new smithy handler changes (#8390)
40bf3f7 Publish v3.1160.0
c1fb86e Publish v3.1159.0
2d08e1c Publish v3.1158.0
e5988ec Publish v3.1157.0
f9d9119 chore(codegen): sync for service default socket timeout and RPC v2 JSON (#8378)
Additional commits viewable in compare view

Updates @better-auth/api-key from 1.7.7 to 1.7.18

Release notes

Sourced from @better-auth/api-key's releases.

v1.7.18

[!IMPORTANT] Action required

If you use getTestInstance with testWith: "mysql", run a MySQL server at 127.0.0.1:3306 with the root password set to root_password. (#12244)

better-auth

Bug Fixes

Fixed "revoke all sessions" with secondaryStorage and storeSessionInDatabase to also revoke sessions created while the revocation is running, except sessions created by a session.delete.after hook, which stay active (#12259)

Fixed getTestInstance from better-auth/test to close its own Postgres connection pool and SQLite database when the test file finishes, while with Vitest's default sequence.hooks: "stack" your afterAll hooks still run first and can keep using the instance (#12250)

Fixed getTestInstance with testWith: "mysql" hanging, and added a separate database per instance so several instances can run in one test file (#12244)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

fix(core): accept introspected tokens when verifyOptions.typ is set (#12249)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@gustavovalverde

Full changelog: v1.7.17...v1.7.18

v1.7.17

better-auth

Bug Fixes

Fixed sessions created by a session.delete.after hook being treated as revoked during "revoke all sessions" when using secondaryStorage with storeSessionInDatabase (#12212)

Fixed remembered sign-ins and sign-ups to refresh their session even if an earlier sign-in in the same browser used rememberMe: false (#12181)

Fixed denying a device authorization request to reject a revoked session that is still in the cookie cache (#12216)

Fixed IP wildcard trusted origins such as exp://192.168.*.*:* matching custom-scheme hosts with out-of-range or zero-padded octets (#12217)

Fixed the phone number plugin storing an empty phoneNumber on sign-up and replacing a verified number when linking an account with an empty phone number (#12219)

Fixed TOTP verification rejecting API key sessions so they can now finish two-factor enrollment (#12211)

Fixed trusted devices being ignored when an app runs the two-factor sign-in step from its own hook on another sign-in path, such as email OTP (#12228)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

... (truncated)

Changelog

Sourced from @better-auth/api-key's changelog.

1.7.18

1.7.17

1.7.16

1.7.15

Patch Changes

#12107 9ce8b2c Thanks @bytaesu! - API keys stored in secondary storage now verify, load, and list correctly when the storage client returns already-parsed JSON objects, such as @upstash/redis.

1.7.14

1.7.13

1.7.12

1.7.11

1.7.10

1.7.9

1.7.8

Patch Changes

#11512 4175b34 Thanks @bytaesu! - Align the installed @better-auth/utils version with better-call while accepting ^0.4.2 || ^0.5.0 across official package peers.

Commits

38f43e3 chore: release v1.7.18 (#12252)
e3ae9e1 chore: release v1.7.17 (#12214)
98bcd98 fix(two-factor): accept API key sessions when verifying TOTP enrollment (#12211)
93edae1 chore: release v1.7.16 (#12199)
f25081a fix: harden authentication flows (#12198)
e556c07 chore: release v1.7.15 (#12101)
f63fb0e fix: accept constructor keys in strict JSON parsing (#12142)
9ce8b2c fix(api-key): accept parsed JSON from secondary storage (#12107)
a936663 chore: release v1.7.14 (#12055)
7f61081 chore: release v1.7.13 (#11994)
Additional commits viewable in compare view

Updates @better-auth/passkey from 1.7.7 to 1.7.18

Release notes

Sourced from @better-auth/passkey's releases.

v1.7.18

[!IMPORTANT] Action required

If you use getTestInstance with testWith: "mysql", run a MySQL server at 127.0.0.1:3306 with the root password set to root_password. (#12244)

better-auth

Bug Fixes

Fixed "revoke all sessions" with secondaryStorage and storeSessionInDatabase to also revoke sessions created while the revocation is running, except sessions created by a session.delete.after hook, which stay active (#12259)

Fixed getTestInstance from better-auth/test to close its own Postgres connection pool and SQLite database when the test file finishes, while with Vitest's default sequence.hooks: "stack" your afterAll hooks still run first and can keep using the instance (#12250)

Fixed getTestInstance with testWith: "mysql" hanging, and added a separate database per instance so several instances can run in one test file (#12244)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

fix(core): accept introspected tokens when verifyOptions.typ is set (#12249)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@gustavovalverde

Full changelog: v1.7.17...v1.7.18

v1.7.17

better-auth

Bug Fixes

Fixed sessions created by a session.delete.after hook being treated as revoked during "revoke all sessions" when using secondaryStorage with storeSessionInDatabase (#12212)

Fixed remembered sign-ins and sign-ups to refresh their session even if an earlier sign-in in the same browser used rememberMe: false (#12181)

Fixed denying a device authorization request to reject a revoked session that is still in the cookie cache (#12216)

Fixed IP wildcard trusted origins such as exp://192.168.*.*:* matching custom-scheme hosts with out-of-range or zero-padded octets (#12217)

Fixed the phone number plugin storing an empty phoneNumber on sign-up and replacing a verified number when linking an account with an empty phone number (#12219)

Fixed TOTP verification rejecting API key sessions so they can now finish two-factor enrollment (#12211)

Fixed trusted devices being ignored when an app runs the two-factor sign-in step from its own hook on another sign-in path, such as email OTP (#12228)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

... (truncated)

Changelog

Sourced from @better-auth/passkey's changelog.

1.7.18

1.7.17

Patch Changes

#12225 3ab3dbf Thanks @bytaesu! - Passkey registration and sign-in now work when one passkey() plugin is shared between auth instances where some set baseURL and others do not. Previously one of the instances could fail with ORIGIN_NOT_CONFIGURED or verify against the other instance's origin settings.

1.7.16

Patch Changes

#12198 f25081a Thanks @bytaesu! - Passkey registration, device authorization, two-factor enrollment and verification, social account linking, and phone number changes now reject a session revoked in the database or secondary storage, even when cookie caching is enabled. Sessions created from API keys are refused on these routes, except two-factor enrollment and phone number changes.

#12198 f25081a Thanks @bytaesu! - The expected WebAuthn origin now comes from server configuration instead of the request: the origin option, or the baseURL origin plus a frontend origin listed exactly in trustedOrigins. Set origin when rpID is set and a wildcard in baseURL.allowedHosts covers it.

#12198 f25081a Thanks @bytaesu! - authenticatorSelection.userVerification now applies to authentication as well as registration: it is requested in authentication options, and with required passkey registration and sign-in reject responses without user verification.

1.7.15

1.7.14

1.7.13

1.7.12

1.7.11

1.7.10

1.7.9

1.7.8

Patch Changes

#11512 4175b34 Thanks @bytaesu! - Align the installed @better-auth/utils version with better-call while accepting ^0.4.2 || ^0.5.0 across official package peers.

Commits

38f43e3 chore: release v1.7.18 (#12252)
e3ae9e1 chore: release v1.7.17 (#12214)
3ab3dbf fix(passkey): keep base URL mode per auth instance (#12225)
93edae1 chore: release v1.7.16 (#12199)
f25081a fix: harden authentication flows (#12198)
e556c07 chore: release v1.7.15 (#12101)
a936663 chore: release v1.7.14 (#12055)
7f61081 chore: release v1.7.13 (#11994)
1c031b1 chore(deps): update dependencies (#11984)
f4260a9 chore: release v1.7.12 (#11922)
Additional commits viewable in compare view

Updates @codemirror/autocomplete from 6.20.3 to 6.20.4

Commits

See full diff in compare view

Updates @codemirror/view from 6.43.14 to 6.43.15

Commits

See full diff in compare view

Updates better-auth from 1.7.7 to 1.7.18

Release notes

Sourced from better-auth's releases.

v1.7.18

[!IMPORTANT] Action required

If you use getTestInstance with testWith: "mysql", run a MySQL server at 127.0.0.1:3306 with the root password set to root_password. (#12244)

better-auth

Bug Fixes

Fixed "revoke all sessions" with secondaryStorage and storeSessionInDatabase to also revoke sessions created while the revocation is running, except sessions created by a session.delete.after hook, which stay active (#12259)

Fixed getTestInstance from better-auth/test to close its own Postgres connection pool and SQLite database when the test file finishes, while with Vitest's default sequence.hooks: "stack" your afterAll hooks still run first and can keep using the instance (#12250)

Fixed getTestInstance with testWith: "mysql" hanging, and added a separate database per instance so several instances can run in one test file (#12244)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

fix(core): accept introspected tokens when verifyOptions.typ is set (#12249)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@gustavovalverde

Full changelog: v1.7.17...v1.7.18

v1.7.17

better-auth

Bug Fixes

Fixed sessions created by a session.delete.after hook being treated as revoked during "revoke all sessions" when using secondaryStorage with storeSessionInDatabase (#12212)

Fixed remembered sign-ins and sign-ups to refresh their session even if an earlier sign-in in the same browser used rememberMe: false (#12181)

Fixed denying a device authorization request to reject a revoked session that is still in the cookie cache (#12216)

Fixed IP wildcard trusted origins such as exp://192.168.*.*:* matching custom-scheme hosts with out-of-range or zero-padded octets (#12217)

Fixed the phone number plugin storing an empty phoneNumber on sign-up and replacing a verified number when linking an account with an empty phone number (#12219)

Fixed TOTP verification rejecting API key sessions so they can now finish two-factor enrollment (#12211)

Fixed trusted devices being ignored when an app runs the two-factor sign-in step from its own hook on another sign-in path, such as email OTP (#12228)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.18

Patch Changes

#12259 9e2a0ec Thanks @gustavovalverde! - Fixed "revoke all sessions" with secondaryStorage and storeSessionInDatabase so that sessions created while the revocation runs are revoked too. Sessions created by a session.delete.after hook still stay active.

#12244 85f4342 Thanks @gustavovalverde! - getTestInstance with testWith: "mysql" no longer hangs. It expects a MySQL server at 127.0.0.1:3306 whose root password is root_password, and it creates and drops a separate database for each instance, so several instances can run in one test file.

#12250 278bb28 Thanks @gustavovalverde! - getTestInstance from better-auth/test now closes the Postgres connection pool and the SQLite database it created when the test file finishes. Previously both stayed open until the test worker exited. With Vitest's default sequence.hooks: "stack", afterAll hooks in your test files still run before this cleanup and can keep using the instance.

Updated dependencies [9342a73]:

@better-auth/core@1.7.18

@better-auth/drizzle-adapter@1.7.18

@better-auth/kysely-adapter@1.7.18

@better-auth/memory-adapter@1.7.18

@better-auth/mongo-adapter@1.7.18

@better-auth/prisma-adapter@1.7.18

@better-auth/telemetry@1.7.18

1.7.17

Patch Changes

#12181 b6a87ad Thanks @aliamanatali! - A remembered sign-in or sign-up now refreshes its session like any other remembered session, even if an earlier sign-in in the same browser used rememberMe: false. Previously the earlier choice stayed in a dont_remember cookie until the browser closed, so the new session stopped sliding and expired expiresIn after it was created.

#12216 cff7c1c Thanks @bytaesu! - Denying a device authorization request now rejects a session that was revoked but still present in the cookie cache, matching the behavior of approving a request.

#12217 16aa412 Thanks @bytaesu! - IP wildcard trusted origins such as exp://192.168.*.*:* no longer match custom-scheme hosts with out-of-range or zero-padded octets like 192.168.999.999.

#12219 9150314 Thanks @bytaesu! - Signing up with an empty phoneNumber with the phone number plugin no longer stores the empty string or makes later sign-ups fail. Linking an account whose profile maps an empty phone number no longer replaces the user's verified number.

#12212 f5be351 Thanks @bytaesu! - Fixed sessions created by a session.delete.after hook during "revoke all sessions" being treated as revoked immediately when secondaryStorage is used with storeSessionInDatabase.

#12211 98bcd98 Thanks @bytaesu! - Fixed TOTP verification rejecting sessions created from an API key, so API-key sessions can now finish two-factor enrollment.

#12228 fbff537 Thanks @bytaesu! - Trusted devices are honored again when an app runs the two-factor sign-in step from its own hook on another sign-in path, such as email OTP.

Updated dependencies [fc2e00b]:

@better-auth/kysely-adapter@1.7.17

@better-auth/core@1.7.17

@better-auth/drizzle-adapter@1.7.17

@better-auth/memory-adapter@1.7.17

@better-auth/mongo-adapter@1.7.17

@better-auth/prisma-adapter@1.7.17

@better-auth/telemetry@1.7.17

1.7.16

Patch Changes

... (truncated)

Commits

38f43e3 chore: release v1.7.18 (#12252)
9e2a0ec fix(session): revoke sessions created while bulk revocation runs (#12259)
278bb28 fix(test-utils): close the instance's own Postgres and SQLite handles (#12250)
85f4342 fix(test-utils): make testWith mysql work and run it in CI (#12244)
e3ae9e1 chore: release v1.7.17 (#12214)
b6a87ad fix(cookies): clear the dont_remember marker on a remembered sign-in (#12181)
fbff537 fix(two-factor): honor trusted devices when the sign-in step runs on custom p...
16aa412 fix(origin-check): validate IPv4 octets in IP wildcard trusted origins (#12217)
9150314 fix(phone-number): treat empty phone number as missing (#12219)
cff7c1c fix(device-authorization): reject revoked cached sessions on deny (#12216)
Additional commits viewable in compare view

Updates chart.js from 4.5.1 to 4.6.1

Release notes

Sourced from chart.js's releases.

v4.6.1

Essential Links

npm

Migration guide

Docs

API

Samples

#12355 fix: trusted publishing fix + version 4.6.1 bump

Thanks to

…y with 21 updates Bumps the production-dependencies group with 21 updates in the / directory: | Package | From | To | | --- | --- | --- | | [convex](https://github.com/convex/convex-backend/tree/HEAD/npm-packages/convex) | `1.46.0` | `1.49.0` | | [@convex-dev/aggregate](https://github.com/convex/aggregate) | `0.3.1` | `0.3.4` | | [@convex-dev/rate-limiter](https://github.com/convex/rate-limiter) | `0.4.2` | `0.4.3` | | [zod](https://github.com/colinhacks/zod) | `4.6.5` | `4.6.7` | | [@aws-sdk/client-ses](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-ses) | `3.1150.0` | `3.1163.0` | | [@better-auth/api-key](https://github.com/better-auth/better-auth/tree/HEAD/packages/api-key) | `1.7.7` | `1.7.18` | | [@better-auth/passkey](https://github.com/better-auth/better-auth/tree/HEAD/packages/passkey) | `1.7.7` | `1.7.18` | | [@codemirror/autocomplete](https://github.com/codemirror/autocomplete) | `6.20.3` | `6.20.4` | | [@codemirror/view](https://github.com/codemirror/view) | `6.43.14` | `6.43.15` | | [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.7` | `1.7.18` | | [chart.js](https://github.com/chartjs/Chart.js) | `4.5.1` | `4.6.1` | | [katex](https://github.com/KaTeX/KaTeX) | `0.19.0` | `0.19.1` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.55.0` | `1.70.0` | | [next](https://github.com/vercel/next.js) | `16.4.0` | `16.4.5` | | [nodemailer](https://github.com/nodemailer/nodemailer) | `10.1.0` | `10.3.1` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` | | [shiki](https://github.com/shikijs/shiki/tree/HEAD/packages/shiki) | `4.5.0` | `4.6.0` | | [simple-icons](https://github.com/simple-icons/simple-icons) | `16.35.0` | `16.36.0` | | [unist-util-visit](https://github.com/syntax-tree/unist-util-visit) | `5.1.0` | `5.2.0` | | [@oxlint/plugins](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugins) | `1.87.0` | `1.91.0` | Updates `convex` from 1.46.0 to 1.49.0 - [Release notes](https://github.com/convex/convex-backend/releases) - [Changelog](https://github.com/convex/convex-backend/blob/main/npm-packages/convex/CHANGELOG.md) - [Commits](https://github.com/convex/convex-backend/commits/HEAD/npm-packages/convex) Updates `@convex-dev/aggregate` from 0.3.1 to 0.3.4 - [Changelog](https://github.com/convex/aggregate/blob/main/CHANGELOG.md) - [Commits](convex/aggregate@v0.3.1...v0.3.4) Updates `@convex-dev/rate-limiter` from 0.4.2 to 0.4.3 - [Changelog](https://github.com/convex/rate-limiter/blob/main/CHANGELOG.md) - [Commits](convex/rate-limiter@v0.4.2...v0.4.3) Updates `zod` from 4.6.5 to 4.6.7 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.6.5...v4.6.7) Updates `@aws-sdk/client-ses` from 3.1150.0 to 3.1163.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-ses/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1163.0/clients/client-ses) Updates `@better-auth/api-key` from 1.7.7 to 1.7.18 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/api-key/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.18/packages/api-key) Updates `@better-auth/passkey` from 1.7.7 to 1.7.18 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/passkey/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.18/packages/passkey) Updates `@codemirror/autocomplete` from 6.20.3 to 6.20.4 - [Changelog](https://github.com/codemirror/autocomplete/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/autocomplete/commits) Updates `@codemirror/view` from 6.43.14 to 6.43.15 - [Changelog](https://github.com/codemirror/view/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/view/commits) Updates `better-auth` from 1.7.7 to 1.7.18 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.18/packages/better-auth) Updates `chart.js` from 4.5.1 to 4.6.1 - [Release notes](https://github.com/chartjs/Chart.js/releases) - [Commits](chartjs/Chart.js@v4.5.1...v4.6.1) Updates `katex` from 0.19.0 to 0.19.1 - [Release notes](https://github.com/KaTeX/KaTeX/releases) - [Changelog](https://github.com/KaTeX/KaTeX/blob/main/CHANGELOG.md) - [Commits](KaTeX/KaTeX@v0.19.0...v0.19.1) Updates `lucide-react` from 1.55.0 to 1.70.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.70.0/packages/lucide-react) Updates `next` from 16.4.0 to 16.4.5 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.4.0...v16.4.5) Updates `nodemailer` from 10.1.0 to 10.3.1 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v10.1.0...v10.3.1) Updates `react` from 19.3.0 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react) Updates `react-dom` from 19.3.0 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom) Updates `shiki` from 4.5.0 to 4.6.0 - [Release notes](https://github.com/shikijs/shiki/releases) - [Commits](https://github.com/shikijs/shiki/commits/v4.6.0/packages/shiki) Updates `simple-icons` from 16.35.0 to 16.36.0 - [Release notes](https://github.com/simple-icons/simple-icons/releases) - [Commits](simple-icons/simple-icons@16.35.0...16.36.0) Updates `unist-util-visit` from 5.1.0 to 5.2.0 - [Release notes](https://github.com/syntax-tree/unist-util-visit/releases) - [Commits](syntax-tree/unist-util-visit@5.1.0...5.2.0) Updates `@oxlint/plugins` from 1.87.0 to 1.91.0 - [Release notes](https://github.com/oxc-project/oxc/releases) - [Changelog](https://github.com/oxc-project/oxc/blob/main/CHANGELOG.md) - [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.91.0/npm/oxlint-plugins) --- updated-dependencies: - dependency-name: convex dependency-version: 1.49.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@convex-dev/aggregate" dependency-version: 0.3.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@convex-dev/rate-limiter" dependency-version: 0.4.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: zod dependency-version: 4.6.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@aws-sdk/client-ses" dependency-version: 3.1163.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@better-auth/api-key" dependency-version: 1.7.18 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@better-auth/passkey" dependency-version: 1.7.18 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@codemirror/autocomplete" dependency-version: 6.20.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@codemirror/view" dependency-version: 6.43.15 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: better-auth dependency-version: 1.7.18 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: chart.js dependency-version: 4.6.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: katex dependency-version: 0.19.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: lucide-react dependency-version: 1.70.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: next dependency-version: 16.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: nodemailer dependency-version: 10.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: react dependency-version: 19.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: react-dom dependency-version: 19.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: shiki dependency-version: 4.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: simple-icons dependency-version: 16.36.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: unist-util-visit dependency-version: 5.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@oxlint/plugins" dependency-version: 1.91.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 9, 2026

Navigation Menu

Repository navigation

build(deps): bump the production-dependencies group across 1 directory with 21 updates - #147

build(deps): bump the production-dependencies group across 1 directory with 21 updates#147
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-627baa6593

dependabot Bot commented on behalf of github Nov 9, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 9, 2026

1.49.0

1.48.0

1.47.0

0.3.4

0.3.3

0.3.2

0.4.3

v4.6.7

Commits:

v4.6.6

Commits:

v3.1163.0

3.1163.0(2026-11-05)

New Features

Bug Fixes

v3.1162.0

3.1162.0(2026-11-04)

Documentation Changes

New Features

3.1163.0 (2026-11-05)

3.1162.0 (2026-11-04)

Features

3.1161.0 (2026-10-30)

3.1160.0 (2026-10-29)

3.1159.0 (2026-10-28)

3.1158.0 (2026-10-27)

v1.7.18

better-auth

Bug Fixes

@better-auth/core

Bug Fixes

Contributors

v1.7.17

better-auth

Bug Fixes

@better-auth/expo

Bug Fixes

1.7.18

1.7.17

1.7.16

1.7.15

Patch Changes

1.7.14

1.7.13

1.7.12

1.7.11

1.7.10

1.7.9

1.7.8

Patch Changes

v1.7.18

better-auth

Bug Fixes

@better-auth/core

Bug Fixes

Contributors

v1.7.17

better-auth

Bug Fixes

@better-auth/expo

Bug Fixes

1.7.18

1.7.17

Patch Changes

1.7.16

Patch Changes

1.7.15

1.7.14

1.7.13

1.7.12

1.7.11

1.7.10

1.7.9

1.7.8

Patch Changes

v1.7.18

better-auth

Bug Fixes

`better-auth`

`@better-auth/core`

`better-auth`

`@better-auth/expo`

`better-auth`

`@better-auth/core`

`better-auth`

`@better-auth/expo`

`better-auth`

`@better-auth/core`

`better-auth`

`@better-auth/expo`