chore(deps): bump the npm_and_yarn group across 1 directory with 11 updates by dependabot[bot] · Pull Request #310 · Himan-D/agent-memory

dependabot · 2026-08-09T06:57:52Z

Bumps the npm_and_yarn group with 9 updates in the /dashboard directory:

Package	From	To
better-auth	`1.6.15`	`1.6.26`
next	`15.5.19`	`15.5.23`
postcss	`8.5.15`	`8.5.23`
brace-expansion	`1.1.14`	`1.1.18`
fast-uri	`3.1.2`	`3.1.5`
hono	`4.12.21`	`4.13.1`
ip-address	`10.2.0`	`10.4.0`
js-yaml	`4.1.1`	`4.3.1`
sharp	`0.34.5`	`0.35.2`

Updates better-auth from 1.6.15 to 1.6.26

Release notes

Sourced from better-auth's releases.

v1.6.26

better-auth

Bug Fixes

Fixed session cleanup on user deletion to also remove sessions from secondary storage (#10520)

Fixed findSessions to skip invalid secondary-storage session entries without discarding other valid sessions (#10580)

Fixed email OTP sign-up to pass the verification type to custom OTP generators (#10608)

Fixed email OTP password reset to allow retrying after entering an invalid password (#10552)

Fixed email OTP verification to no longer reveal whether an email is registered before the OTP is verified (#10605)

Fixed jwtClient() collapsing createAuthClient type inference when combined with other client plugins (#10513)

Fixed JWT key minting inside database transactions to use the transaction-scoped adapter, preventing deadlocks on SQLite and ensuring keys commit with their surrounding transaction on Postgres and MySQL (#10623)

Fixed oAuthProxy to preserve Apple user data from form_post callbacks (#10599)

Fixed oneTapClient() collapsing createAuthClient type inference when combined with other client plugins (#10635)

Fixed database rate-limit cleanup to complete when no background task handler is configured (#10619)

Improved nextCookies performance in instrumented Next.js applications by reusing the next/headers import promise (#10467)

For detailed changes, see CHANGELOG

@better-auth/core

Features

Added a utility for creating stable, namespaced placeholder emails on the reserved placeholder.invalid domain (#10576)

For detailed changes, see CHANGELOG

@better-auth/redis-storage

Bug Fixes

Fixed listKeys() and clear() to use SCAN instead of KEYS so large keyspaces no longer block the Redis server (#10507)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@bytaesu, @Emmaccen, @gustavovalverde, @jashkarangiya, @jeroenvandermerwe, @jlucaso1, @krish-vachhani, @mrosberghaus, @XXMOHAMED012

Full changelog: v1.6.25...v1.6.26

v1.6.25

better-auth

Bug Fixes

Fixed Apple OAuth not sending the PKCE code challenge during authorization, causing token exchange failures (#10294)

Fixed Google One Tap creating new users when sign-up was disabled on the Google provider (#10479)

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.6.26

Patch Changes

#10619 9ede805 Thanks @jeroenvandermerwe! - Ensure database rate-limit cleanup completes when no background task handler is configured.

#10608 5a811f1 Thanks @bytaesu! - Pass the email verification type to custom OTP generators after email sign-up.

#10605 d8327f1 Thanks @XXMOHAMED012! - The email OTP verification check no longer reveals whether an email is registered before the OTP itself is verified.

#10513 e2c73fb Thanks @mrosberghaus! - Fix jwtClient() collapsing createAuthClient type inference when combined with other client plugins such as inferAdditionalFields. Additional user fields (for example on updateUser) are preserved again.

#10635 af50c45 Thanks @krish-vachhani! - Fix oneTapClient() collapsing createAuthClient type inference when combined with other client plugins. The oneTap action is available on the client again.

#10633 701cd43 Thanks @gustavovalverde! - Minting or reading a JWKS signing key inside an active database transaction now uses the transaction-scoped adapter instead of the root connection. On a single-connection SQLite database with native transactions enabled, this no longer deadlocks, and on Postgres and MySQL the key commits with the surrounding transaction instead of independently of it.

#10599 e7b0eba Thanks @bytaesu! - Preserve Apple user data from form_post callbacks when using oAuthProxy.

#10552 2b4a14f Thanks @bytaesu! - Allow users to retry email OTP password resets after entering an invalid password.

#10467 7552a3b Thanks @jlucaso1! - Improve nextCookies performance in instrumented Next.js applications.

#10580 ea38fca Thanks @Emmaccen! - Skip invalid secondary-storage session entries without discarding other valid sessions.

#10520 a03e4c1 Thanks @bytaesu! - Ensure deleting a user also removes their sessions from secondary storage.

Updated dependencies [a30e274]:

@better-auth/core@1.6.26

@better-auth/drizzle-adapter@1.6.26

@better-auth/kysely-adapter@1.6.26

@better-auth/memory-adapter@1.6.26

@better-auth/mongo-adapter@1.6.26

@better-auth/prisma-adapter@1.6.26

@better-auth/telemetry@1.6.26

1.6.25

Patch Changes

#10479 5124c34 Thanks @krish-vachhani! - Prevent Google One Tap from creating new users when sign-up is disabled for the Google provider.

#10444 7439359 Thanks @birkskyum! - Expose the real $fetch instance and $store atoms from the Solid client instead of resolving them as dynamic API routes.

Updated dependencies [0ffd1fb]:

@better-auth/core@1.6.25

@better-auth/drizzle-adapter@1.6.25

@better-auth/kysely-adapter@1.6.25

@better-auth/memory-adapter@1.6.25

@better-auth/mongo-adapter@1.6.25

@better-auth/prisma-adapter@1.6.25

... (truncated)

Commits

a16b30e chore: release v1.6.26 (#10521)
9ede805 fix(rate-limit): await database cleanup by default (#10619)
af50c45 fix(one-tap): preserve client plugin inference with oneTapClient (#10635)
222facf fix(jwt): resolve the transaction-scoped adapter when signing (#10623)
d8327f1 fix(email-otp): verify OTP before revealing whether the email exists (#10605)
e7b0eba fix(oauth-proxy): preserve Apple user data (#10599)
5a811f1 fix(email-otp): pass verification type on sign-up (#10608)
e18606b chore(deps): upgrade OpenTelemetry to v2 (#10601)
ea38fca fix(db): skip null-parsed session token in findSessions instead of returning ...
7552a3b perf(next-js): reuse the next/headers import promise in production (#10467)
Additional commits viewable in compare view

Updates next from 15.5.19 to 15.5.23

Release notes

Sourced from next's releases.

v15.5.23

What's Changed

[15.x] Port ReplyServer traversal guards to FlightClient @eps1lon in vercel/next.js#96405

Full Changelog: vercel/next.js@v15.5.22...v15.5.23

v15.5.22

What's Changed

[15.5] Reject TypeScript >= 7.0 with an actionable error by @lukesandberg in vercel/next.js#96110

Full Changelog: vercel/next.js@v15.5.21...v15.5.22

v15.5.21

This release contains security fixes for the following advisories:

High:

Denial of Service in App Router using Server Actions

Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Server-Side Request Forgery in Server Actions on custom servers

Moderate:

Cache confusion of response bodies for requests with bodies

Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Denial of Service in the Image Optimization API using SVGs

Unauthenticated disclosure of internal Server Function endpoints

Unbounded Server Action payload in Edge runtime

v15.5.20

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 15.5.15.

Commits

c91fd53 v15.5.23
0cb3208 [15.x] Port ReplyServer traversal guards to FlightClient (#96405)
6ad9e56 v15.5.22
fcc0424 [15.5] Reject TypeScript >= 7.0 with an actionable error (#96110)
e26f6ff v15.5.21
7f5deeb [15.x] Improve performance of checking valid MPA form submissions
57c31f7 [15.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
e3e5666 [15.x] Set correct origin for internal redirects in custom server
35f5013 [15.x] Ensure exotic rewrite param values are properly encoded
062f667 [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request
Additional commits viewable in compare view

Updates postcss from 8.5.15 to 8.5.23

Release notes

Sourced from postcss's releases.

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

Changelog

Sourced from postcss's changelog.

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

Commits

eb9e1fe Release 8.5.23 version
9d19c78 Update dependencies
7beca13 Does no load source map file without opts.from
decea51 Typo
c18e30d Update EM banner
98a39ad Update EM banner
a3e48c4 Release 8.5.22 version
f49d691 Fix custom property losing its semicolon before a comment (#2117)
28e0daf Release 8.5.21 version
3d2b4e4 Update dependencies
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates brace-expansion from 1.1.14 to 1.1.18

Release notes

Sourced from brace-expansion's releases.

v1.1.15

Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

Commits

758fcd6 1.1.18
27fbeed Merge commit from fork
5c57cc2 1.1.17
d757f1d npm ignore .claude
cb4b9e4 fix: backport GHSA-mh99-v99m-4gvg (#129)
447763a 1.1.16
d74e630 fix: v1 backport for CVE-2026-13149 (#122)
2203f4f 1.1.15
0b09384 Backport v5.0.6 change to v1 (#111)
See full diff in compare view

Updates fast-uri from 3.1.2 to 3.1.5

Release notes

Sourced from fast-uri's releases.

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

v3.1.3

⚠️ Security Release

Fixes: GHSA-4c8g-83qw-93j6

Full Changelog: fastify/fast-uri@v3.1.2...v3.1.3

Commits

5e179cb Bumped v3.1.5
2cad02d Merge commit from fork
6aeece6 Bumped v3.1.4
2d50fba fix: reject literal backslash in URI authority
0549fe3 Bumped v3.1.3
2a6d357 Merge commit from fork
See full diff in compare view

Updates hono from 4.12.21 to 4.13.1

Release notes

Sourced from hono's releases.

v4.13.1

What's Changed

fix(trie-router): count every slash a pattern consumes by @Jaybhade in honojs/hono#5189

fix(utils/stream): re-acquire writer lock when pipe() throws by @Sriharsha-dev369 in honojs/hono#4988

fix(etag): skip unsafe methods or error responses on non-* case by @na-trium-144 in honojs/hono#5196

New Contributors

@Jaybhade made their first contribution in honojs/hono#5189

@Sriharsha-dev369 made their first contribution in honojs/hono#4988

Full Changelog: honojs/hono@v4.13.0...v4.13.1

v4.13.0

Hono v4.13.0 is now available!

The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more.

Performance improvements

This release includes a series of small optimizations: skipping unnecessary Headers allocations, replacing regex tests with indexOf, allocating internal state lazily, and more.

Here is benchmarks/fetch comparing v4.12 and v4.13 (ROUNDS=5 ./compare.sh, Bun 1.4.0, Apple Silicon — each measurement runs in a fresh process, and the variant order is reversed every round to avoid warm-up bias):

Benchmark v4.12 v4.13 Speedup

ping — GET / 165.83 ns 163.99 ns 1.01x

query — GET /id/1?name=bun 674.40 ns 616.99 ns 1.09x

json — GET /user 528.99 ns 422.44 ns 1.25x

body — POST /json 1.16 µs 1.00 µs 1.15x

The individual changes:

perf(context): iterate the header record with for..in honojs/hono#5118

perf(url): replace regex tests with indexOf honojs/hono#5121

perf(context): skip Headers creation when there are no headers to merge honojs/hono#5122

perf(urls): refactor tryDecodeURIComponent honojs/hono#5158

perf(request): allocate #validatedData lazily honojs/hono#5175

perf(request): probe the body cache without allocating honojs/hono#5176

In addition, the RegExpRouter rewrite described below makes route registration plus the first match roughly 20% faster.

Thanks @kibertoad for the contributions!

First-class QUERY method support

The QUERY method — a safe, idempotent method that carries a request body — is now a first-class citizen in Hono. You can define QUERY handlers with app.query():
const app = new Hono()
</tr></table>

... (truncated)

Commits

cf78528 4.13.1
f6aa913 fix(etag): skip unsafe methods or error responses on non-* case (#5196)
cd31bc1 fix(utils/stream): re-acquire writer lock when pipe() throws (#4988)
569b419 fix(trie-router): count every slash a pattern consumes (#5189)
192768f 4.13.0
b0c2d90 Merge pull request #5154 from honojs/next
8f07028 fix(compress): set Vary: Accept-Encoding on negotiated responses (#5137)
8a0b18f feat(reg-exp-router): throw UnsupportedPathError during route registration (#...
3feb355 fix(jsx): allow a function component to return an array (#5179)
5d911d2 feat(utils/headers): add HTTP fields newly registered with IANA (#5153)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.

Updates ip-address from 10.2.0 to 10.4.0

Release notes

Sourced from ip-address's releases.

v10.4.0

What's Changed

Add GitHub Actions CI by @beaugunderson in beaugunderson/ip-address#213

Keep the package loadable on node 12, and enforce it by @beaugunderson in beaugunderson/ip-address#216

Validate the byte arrays Address6 is given by @beaugunderson in beaugunderson/ip-address#217

Full Changelog: beaugunderson/ip-address@v10.3.1...v10.4.0

v10.3.1

Full Changelog: beaugunderson/ip-address@v10.3.0...v10.3.1

v10.3.0

Full Changelog: beaugunderson/ip-address@v10.2.2...v10.3.0

v10.2.2

Full Changelog: beaugunderson/ip-address@v10.2.1...v10.2.2

v10.2.1

Full Changelog: beaugunderson/ip-address@v10.2.0...v10.2.1

Commits

fbb8db2 10.4.0
45a2b11 Validate the byte arrays Address6 is given (#217)
bac8810 Keep the package loadable on node 12, and enforce it (#216)
9b3d848 Add a security policy and a README section on security posture
e84a7b3 Order the README API reference Address4, Address6, AddressError
015160b Collapse each class in the README API reference
34061a8 Pin checkout and setup-node to commits in the release job
c5fae5d Pin action-gh-release to a commit and move it to 3.0.2
e0ef048 Replace CircleCI with GitHub Actions
5e3ceb7 Add GitHub Actions CI across Node 20, 22, 24 and 25 (#213)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ip-address since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates js-yaml from 4.1.1 to 4.3.1

Changelog

Sourced from js-yaml's changelog.

4.3.1 - 2026-07-31

Security

[backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

[backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

Restore umd builds back to es5.

Removed

[backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

[4.2.0] - 2026-06-01

Added

Added docs/safety.md with notes about processing untrusted YAML.

Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.

Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.

Added sourcemaps to dist/ builds.

Changed

Stop resolving numbers with underscores as numeric scalars, #627.

Switched dev toolchains to Vite / neostandard.

Updated demo.

Reorganized tests.

dist/ files are no longer kept in the repository.

Fixed

Fix parsing of properties on the first implicit block mapping key, #62.

Fix trailing whitespace handling when folding flow scalar lines, #307.

Reject top-level block scalars without content indentation, #280.

Ensure numbers survive round-trip, #737.

Fix test coverage for issue #221.

Fix flow scalar trailing whitespace folding, #307.

Fix digits in YAML named tag handles.

Security

Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

[3.14.2] - 2025-11-15

Security

... (truncated)

Commits

86e91b8 4.3.1 released
c3cc4b0 Backport quadratic complexity fix for !!omap
33d05b5 4.3.0 released
663bfab Drop demo publish, to not override new v5 one.
1cb8c7b Add v4-legacy tag for publish
02f27af Restore umd builds back to es5
8be84ed Fix es5 compatibility
59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
6842ef6 doc polish
590dbab 4.2.0 released
Additional commits viewable in compare view

Updates nanoid from 3.3.12 to 3.3.18

Release notes

Sourced from nanoid's releases.

3.3.18

Fixed infinite loop on async for React Native (by @OvergrowthBeards-JB).

3.3.17

Fixed infinite loop on zero size.

3.3.16

Fixed infinite loop on negative size (by @greymoth-jp).

3.3.15

Fixed npm provenance error.

3.3.14

Fixed random pool corruption on big ID sizes.

3.3.13

Reduced npm package size.

Changelog

Sourced from nanoid's changelog.

3.3.18

Fixed infinite loop on async for React Native (by @OvergrowthBeards-JB).

3.3.17

Fixed infinite loop on zero size.

3.3.16

Fixed infinite loop on negative size (by @greymoth-jp).

3.3.15

Fixed npm provenance error.

3.3.14

Fixed random pool corruption on big ID sizes.

3.3.13

Reduced npm package size.

Commits

9ad9805 Release 3.3.18 version
55e50a0 Update CI action
e10f8d4 Update index.native.js (#606)
73d6716 Release 3.3.17 version
f9d13f1 Sync 0 size behaviour with PostCSS 5
9760e11 Release 3.3.16 version
e835c9b fix(non-secure): clamp negative size to prevent infinite loop (#601)
96dd086 Update CI action
ba0bc3b Do not create latest release for v3
6819724 Release 3.3.15 version
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.

Updates sharp from 0.34.5 to 0.35.2

Release notes

Sourced from sharp's releases.

v0.35.2

TypeScript: Add mediaType to metadata response. #4492

Improve WebAssembly fallback detection. #4513

Improve code bundler support with stub binaries. #4543

Verify GIF effort option is an integer. #4544 @metsw24-max

Verify recomb matrix entries are numbers. #4545 @metsw24-max

TypeScript: Replace namespace with named exports for ESM. #4546

Bound dilate and erode width to avoid mask-size overflow. #4548 @metsw24-max

Verify convolve kernel values are numbers. #4549 @metsw24-max

v0.35.2-rc.2

TypeScript: Add mediaType to metadata response. #4492

Improve WebAssembly fallback detection. #4513

Improve code bundler support with stub binaries. #4543

Verify GIF effort option is an integer. #4544 @metsw24-max

Verify recomb matrix entries are numbers. #4545 @metsw24-max

TypeScript: Replace namespace with named exports for ESM. #4546

... (truncated)

Commits

c9622a3 Release v0.35.2
cd4568f Upgrade to sharp-libvips v1.3.1
78390cf Tests: Add font file to prevent font discovery flakiness (#4550)
61210b4 Verify convolve kernel values are numbers (#4549)
1cb27dc Prerelease v0.35.2-rc.2
c7606c3 Upgrade to sharp-libvips v1.3.1-rc.0
29d1e9e Prerelease v0.35.2-rc.1
bbba0a1 Improve code bundler support with stub binaries
ab52866 Bound dilate and erode width to avoid mask-size overflow (#4548)
0f594dd Prerelease v0.35.2-rc.0
Additional commits viewable in compare view

Updates undici from 7.24.8 to 7.29.0

Release notes

Sourced from undici's releases.

v7.29.0

⚠️ Security fixes

High severity

GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 9f10f1e9, with regression coverage in 466e99d1.

Medium severity

GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 33928bc2.

GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by 98011a86.

GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by 1b5a5312, with corrected fixtures in 4a9dafb1.

GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 3bf91ddb.

Full Changelog: nodejs/undici@v7.28.0...v7.29.0

v7.28.0

⚠️ Security Release

This release line addresses 7 security advisories, all shipped in v7.28.0.
Action required: Upgrade to undici 7.28.0 or later.
npm install undici@^7.28.0
The v7 line is not affected by GHSA-38rv-x7px-6hhq (CVE-2026-9675), which is an 8.x-only regression.

Note on GHSA-hm92-r4w5-c3mj: this fix shipped in v7.28.0, not the earlier 7.2x line — the vulnerable single-pool code was still present through v7.27.2. The per-origin pool fix is 3805b8f8 (#5041).

Summary

Advisory CVE Severity (CVSS) Fixed in Fix commit

GHSA-vxpw-j846-p89q CVE-2026-12151 High (7.5) 7.28.0 8cb10f98

GHSA-vmh5-mc38-953g CVE-2026-9697 High (7.4) 7.28.0 04201f89

GHSA-hm92-r4w5-c3mj CVE-2026-6734 High (7.5) 7.28.0 3805b8f8

GHSA-pr7r-676h-xcf6 CVE-2026-9678 Moderate (5.9) 7.28.0 85a24055

GHSA-p88m-4jfj-68fv CVE-2026-9679 Moderate (5.9) 7.28.0 d0574cc4

…pdates Bumps the npm_and_yarn group with 9 updates in the /dashboard directory: | Package | From | To | | --- | --- | --- | | [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.6.15` | `1.6.26` | | [next](https://github.com/vercel/next.js) | `15.5.19` | `15.5.23` | | [postcss](https://github.com/postcss/postcss) | `8.5.15` | `8.5.23` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.14` | `1.1.18` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.2` | `3.1.5` | | [hono](https://github.com/honojs/hono) | `4.12.21` | `4.13.1` | | [ip-address](https://github.com/beaugunderson/ip-address) | `10.2.0` | `10.4.0` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.1` | `4.3.1` | | [sharp](https://github.com/lovell/sharp) | `0.34.5` | `0.35.2` | Updates `better-auth` from 1.6.15 to 1.6.26 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.6.26/packages/better-auth) Updates `next` from 15.5.19 to 15.5.23 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.19...v15.5.23) Updates `postcss` from 8.5.15 to 8.5.23 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.15...8.5.23) Updates `brace-expansion` from 1.1.14 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.14...v1.1.18) Updates `fast-uri` from 3.1.2 to 3.1.5 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.2...v3.1.5) Updates `hono` from 4.12.21 to 4.13.1 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.21...v4.13.1) Updates `ip-address` from 10.2.0 to 10.4.0 - [Release notes](https://github.com/beaugunderson/ip-address/releases) - [Commits](beaugunderson/ip-address@v10.2.0...v10.4.0) Updates `js-yaml` from 4.1.1 to 4.3.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.1...4.3.1) Updates `nanoid` from 3.3.12 to 3.3.18 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md) - [Commits](ai/nanoid@3.3.12...3.3.18) Updates `sharp` from 0.34.5 to 0.35.2 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.34.5...v0.35.2) Updates `undici` from 7.24.8 to 7.29.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.24.8...v7.29.0) --- updated-dependencies: - dependency-name: better-auth dependency-version: 1.6.26 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.23 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.23 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.13.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ip-address dependency-version: 10.4.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: nanoid dependency-version: 3.3.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: sharp dependency-version: 0.35.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.29.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-08-09T06:57:53Z

Labels

The following labels could not be found: frontend. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

dependabot Bot added automerge dependencies labels Aug 9, 2026

dependabot Bot requested a review from Himan-D as a code owner August 9, 2026 06:57

dependabot Bot added automerge dependencies labels Aug 9, 2026

github-actions Bot added the dashboard label Aug 9, 2026

Navigation Menu

chore(deps): bump the npm_and_yarn group across 1 directory with 11 updates - #310

chore(deps): bump the npm_and_yarn group across 1 directory with 11 updates#310
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/dashboard/npm_and_yarn-d4b415fa07

dependabot Bot commented on behalf of github Aug 9, 2026

Uh oh!

dependabot Bot commented on behalf of github Aug 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Benchmark	v4.12	v4.13	Speedup
`ping` — `GET /`	165.83 ns	163.99 ns	1.01x
`query` — `GET /id/1?name=bun`	674.40 ns	616.99 ns	1.09x
`json` — `GET /user`	528.99 ns	422.44 ns	1.25x
`body` — `POST /json`	1.16 µs	1.00 µs	1.15x

Advisory	CVE	Severity (CVSS)	Fixed in	Fix commit
GHSA-vxpw-j846-p89q	CVE-2026-12151	High (7.5)	7.28.0	`8cb10f98`
GHSA-vmh5-mc38-953g	CVE-2026-9697	High (7.4)	7.28.0	`04201f89`
GHSA-hm92-r4w5-c3mj	CVE-2026-6734	High (7.5)	7.28.0	`3805b8f8`
GHSA-pr7r-676h-xcf6	CVE-2026-9678	Moderate (5.9)	7.28.0	`85a24055`
GHSA-p88m-4jfj-68fv	CVE-2026-9679	Moderate (5.9)	7.28.0	`d0574cc4`

Conversation

dependabot Bot commented on behalf of github Aug 9, 2026

v1.6.26

better-auth

Bug Fixes

@better-auth/core

Features

@better-auth/redis-storage

Bug Fixes

Contributors

v1.6.25

better-auth

Bug Fixes

1.6.26

Patch Changes

1.6.25

Patch Changes

v15.5.23

What's Changed

v15.5.22

What's Changed

v15.5.21

v15.5.20

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

v1.1.15

v3.1.5

⚠️ Security Warning

v3.1.4

⚠️ Security Release

v3.1.3

⚠️ Security Release

v4.13.1

What's Changed

New Contributors

v4.13.0

Performance improvements

First-class QUERY method support

v10.4.0

What's Changed

v10.3.1

v10.3.0

v10.2.2

v10.2.1

4.3.1 - 2026-07-31

Security

4.3.0 - 2026-06-27

Added

Fixed

Removed

[4.2.0] - 2026-06-01

Added

Changed

Fixed

Security

[3.14.2] - 2025-11-15

Security

3.3.18

3.3.17

3.3.16

3.3.15

3.3.14

3.3.13

3.3.18

3.3.17

3.3.16

`better-auth`

`@better-auth/core`

`@better-auth/redis-storage`

`better-auth`