Skip to content

Bump @auth/core from 0.40.0 to 0.41.3 - #505

Open
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/npm_and_yarn/auth/core-0.41.3
Open

Bump @auth/core from 0.40.0 to 0.41.3#505
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/npm_and_yarn/auth/core-0.41.3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 26, 2026

Copy link
Copy Markdown
Contributor

Bumps @auth/core from 0.40.0 to 0.41.3.

Release notes

Sourced from @​auth/core's releases.

@​auth/core@​0.41.3

Bugfixes

  • core: getToken() now returns null instead of throwing when the Authorization header contains a malformed Bearer value
  • core: OAuth state, nonce, and PKCE check cookies are now bound to the provider that created them and are rejected when a different provider handles the callback
  • core: email addresses are Unicode-normalized (NFKC) before validation in the default email normalizer, closing a homoglyph @ bypass

Other

  • deps: resolve Dependabot alerts via cross-major dependency upgrades (#13449)
  • deps: resolve Dependabot security advisories via pnpm overrides (#13441)
  • deps: allow nodemailer 8 in peer dependency ranges (#13434)
  • CI formatting and proxy deploy repairs (#13444)

@​auth/core@​0.41.2

Bugfixes

  • providers: add issuer to GitHub provider for RFC 9207 compliance (#13410)

Other

  • sync package versions with npm registry (#13414)

@​auth/core@​0.41.1

Bugfixes

  • security issue from nodemailer (#13305)

Other

  • update links for Credentials-based Authentication (#13258)
Commits
  • 5af7357 chore(release): bump package version(s) [skip ci]
  • 8a933f9 fix(core): document that getToken returns null for malformed authorization he...
  • 5b1aa47 chore(ci): pin surrealdb test server to the v2 image for the 1.3 client (#13468)
  • 1116034 Chore/nodemailer 8 peer deps (#13434)
  • 7b35fc3 fix(docs): repair docs build broken by floating TypeScript resolution (#13450)
  • b24abfa fix(proxy): override Vercel build command so it doesn't run turbo (#13448)
  • a99514b chore(deps): resolve remaining Dependabot alerts via cross-major dependency u...
  • d008b9b Merge commit from fork
  • af42d8f chore: lint (#13446)
  • e707770 Merge commit from fork
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by better-gustavo, a new releaser for @​auth/core since your current version.


Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 26, 2026
@vercel

vercel Bot commented Jul 26, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
pv-frontpage-redux Ready Ready Preview Aug 9, 2026 3:10pm

Request Review

@zoe2276

zoe2276 commented Aug 8, 2026

Copy link
Copy Markdown
Contributor
image

Bumps [@auth/core](https://github.com/nextauthjs/next-auth) from 0.40.0 to 0.41.3.
- [Release notes](https://github.com/nextauthjs/next-auth/releases)
- [Commits](https://github.com/nextauthjs/next-auth/compare/@auth/core@0.40.0...@auth/core@0.41.3)

---
updated-dependencies:
- dependency-name: "@auth/core"
  dependency-version: 0.41.3
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant