Update Routine updates#376
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
commit: |
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
63dc237 to
87fb859
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
87fb859 to
8e9ad8a
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
8e9ad8a to
4d7b750
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
4d7b750 to
1787003
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
1787003 to
931f226
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
931f226 to
267cd41
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
267cd41 to
e56c97b
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
e56c97b to
0351eb0
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
0351eb0 to
1c30557
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
1c30557 to
fe7ffe2
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
fe7ffe2 to
8545fd6
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
8545fd6 to
541d1b4
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
541d1b4 to
470bc50
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
f63f20d to
2d561dd
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
2d561dd to
8ebc2c3
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
8ebc2c3 to
c85954d
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
c85954d to
1540bb6
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
1540bb6 to
bc74f48
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
bc74f48 to
6fea059
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
6fea059 to
6c27629
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
6c27629 to
8a95d30
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
8a95d30 to
7ac7b81
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
7ac7b81 to
2f2291a
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
2f2291a to
9da4dbe
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
9da4dbe to
21066f2
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
21066f2 to
e4a7540
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
e4a7540 to
940f01b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.6.15→1.6.161.6.18(+1)1.6.15→1.6.161.6.18(+1)1.1.21→1.2.21.3.01.167.65→1.168.252.0.13→2.0.1424.12.3→24.13.219.2.14→19.2.17de0fac2→df4cb1c1.6.15→1.6.161.6.18(+1)1.38.0→1.41.00.1.116→0.1.1190.0.51→0.0.5310.3.0→10.4.110.5.016.2.6→16.2.916.8.8→16.10.016.10.2(+1)16.8.8→16.10.016.10.2(+1)16.2.6→16.2.916.2.6→16.2.90.0.71→0.0.758.5.14→8.5.153.8.3→3.8.419.2.6→19.2.719.2.6→19.2.719.2.6→19.2.719.2.6→19.2.72.34.0→2.39.07.8.0→7.8.45.6.0→5.7.08.59.2→8.61.04.1.5→4.1.8Release Notes
better-auth/better-auth (@better-auth/core)
v1.6.16Compare Source
Patch Changes
#9974
cb1cbfaThanks @Bekacru! - Validate Facebook opaque access tokens against the configured app. PreviouslyverifyIdTokenreturnedtruefor any non-JWT token andgetUserInfocalled Graph/mewith the caller-supplied token without checking which app issued it, so tokens issued for other Facebook apps were not distinguished on the direct sign-in path. Facebook tokens are now inspected via thedebug_tokenendpoint, requiringis_valid, anapp_idthat matches one of the configured client ids, and auser_idthat matches the returned profile, before the token is accepted. A client secret must be configured for access-token sign-in to work.#9974
cb1cbfaThanks @Bekacru! - Enforce the Googlehd(hosted domain) option against the id token. Previouslyhdwas only sent to Google as an authorization hint, which does not by itself restrict sign-in to the configured Workspace domain. Whenhdis set, thehdclaim on the verified id token (verifyIdToken) and the decoded callback profile (getUserInfo) must be present and match, otherwise sign-in is rejected.#9974
cb1cbfaThanks @Bekacru! - Scope the JWKS cache per source. Access-token verification previously kept a single global key set and reused it whenever it contained a key matching the token'skid, without considering which JWKS source the verification was for. When verifying tokens against more than one source, a token could end up matched against keys fetched for a different source if the two shared akid. The cache is now keyed per JWKS source and honors a TTL, so each verification uses the keys for its own source and rotated or removed keys are no longer used after the TTL elapses.#9974
cb1cbfaThanks @Bekacru! - Cryptographically verify PayPal ID tokens on direct sign-in. PreviouslyverifyIdTokenonly decoded the JWT and checked that asubclaim was present, performing no signature, issuer, audience, or expiration checks, so any well-formed token paired with a valid access token would be accepted. The token is now verified against PayPal's issuer and published JWKS (RS256) or the client secret (HS256), with theaudpinned to the configuredclientId, amaxTokenAgebound, and thenoncechecked when supplied.#9974
cb1cbfaThanks @Bekacru! - Stop mapping the Redditoauth_client_idto the user's email. Reddit'sidentityscope does not return an email address, and the provider previously storedoauth_client_id(which identifies the OAuth application and is the same for every user of the app) asuser.emailwithhas_verified_emailasemailVerified. This collapsed all Reddit users of the same app onto a single "verified" email, which could enable implicit account linking/takeover. The Reddit provider now uses the email returned frommapProfileToUserwhen provided, otherwise falls back to a unique per-user synthetic address (<reddit-user-id>@​reddit.com), and no longer marks it as verified. Provide a real email viamapProfileToUserif you need the actual address.#9974
cb1cbfaThanks @Bekacru! - FixverifyAccessTokensilently dropping the configured audience check during remote introspection. Previously, when a requiredaudiencewas set inverifyOptionsbut the introspection response omitted theaudclaim, audience validation was skipped and any active token from the issuer was accepted — so a token issued for a different resource or client on the same issuer could also pass verification. Verification now requires the claim: a missing or mismatchingaudis rejected. Authorization servers that legitimately omitaudfrom introspection responses (it is OPTIONAL per RFC 7662) can opt back into the old behavior with the newremoteVerify.allowMissingAudience: trueflag, which still rejects mismatching audiences.better-auth/better-auth (@better-auth/test-utils)
v1.6.16Compare Source
Patch Changes
cb1cbfa,cb1cbfa,cb1cbfa,cb1cbfa,cb1cbfa,cb1cbfa,87e7aa5,cb1cbfa,cb1cbfa,cb1cbfa,893cf6c,cb1cbfa,cb1cbfa,5e49c56,cb1cbfa]:better-auth/better-fetch (@better-fetch/fetch)
v1.2.2Compare Source
🐞 Bug Fixes
View changes on GitHub
v1.2.1Compare Source
🐞 Bug Fixes
View changes on GitHub
v1.2.0Compare Source
🚀 Features
🐞 Bug Fixes
View changes on GitHub
TanStack/router (@tanstack/react-start)
v1.168.25Compare Source
Patch Changes
#7566
9bebf8d- Addvalidator()as the canonical server function and middleware validator method. DeprecateinputValidator()and emit compiler warnings for remaining uses.Updated dependencies [
9bebf8d]:v1.168.24Compare Source
Patch Changes
v1.168.23Compare Source
Patch Changes
v1.168.22Compare Source
Patch Changes
ac10815]:v1.168.21Compare Source
Patch Changes
301f6ba]:v1.168.20Compare Source
Patch Changes
8091918]:v1.168.19Compare Source
Patch Changes
v1.168.18Compare Source
Patch Changes
#7509
9cb7a00- feat(rsbuild): add RSC supportUpdated dependencies [
9cb7a00]:v1.168.17Compare Source
Patch Changes
#7505
2f53749- Preserve primitive values thrown from beforeLoad error handling.Updated dependencies [
2f53749]:v1.168.16Compare Source
Patch Changes
d1997b6]:v1.168.15Compare Source
Patch Changes
9c09bca]:v1.168.14Compare Source
Patch Changes
#7492
71fb329- Avoid pulling the client hydration entry into root@tanstack/react-startand@tanstack/solid-startimports by re-exportingHydratefrom framework client Hydrate-only subpaths.Updated dependencies [
71fb329]:v1.168.13Compare Source
Patch Changes
Fix serialization adapter module resolution in TanStack Start. Vite dev now uses clean runtime-specific virtual module IDs instead of browser requests containing encoded null-byte virtual IDs, which avoids reverse proxy failures. When no serialization adapters are configured, Vite and Rsbuild now resolve
#tanstack-start-plugin-adaptersthrough the package empty-adapter fallback. (#7484)Publish matching TanStack Start dev server packages so fresh installs do not pair a Start plugin that no longer provides
tanstack-start-injected-head-scripts:vwith an older Start server runtime that still imports it. (#7487)Updated dependencies [
a82cec6,d8be4f8]:v1.168.12Compare Source
Patch Changes
Add Vite bundled dev mode support for TanStack Start. Start now recognizes Vite's
experimental.bundledDevopt-in, uses the bundled dev client entry in the dev manifest, keeps server requests pointed at the latest client build output, and preserves import-protection behavior for bundled client dev. (#7482)Updated dependencies [
90adda9]:v1.168.11Compare Source
Patch Changes
Add support for Rsbuild client output formats, including module output by default and IIFE output for classic script environments. (#7477)
Client entry scripts and preloads are now represented as root route manifest assets, script preloads follow the manifest script format, and script asset cross-origin configuration uses the
scriptkey. ThetransformAssetsscript callback context now exposes onlykind: 'script'andurl, keeping script format handling internal to manifest rendering.Fix Rsbuild server function metadata replay when Rspack restores modules from its persistent cache. (#7477)
Server function metadata is now stored on Rspack module build info and replayed from cached modules before resolver modules are rebuilt, preventing warm restarts from losing server function registrations.
Updated dependencies [
51a97a1,51a97a1]:v1.168.10Compare Source
Patch Changes
Explicitly re-export public API names from
@tanstack/start-client-core(createServerFn,createMiddleware,createStart,createCsrfMiddleware,createIsomorphicFn,createClientOnlyFn,createServerOnlyFn) alongside the existingexport *. The explicit named re-exports are registered at link time (via Vite SSR'sdefineExportatfileStartIndex), so the namespace has these getters before any import body runs — survives the cold-start SSR cycle through user middleware whereexport *would otherwise produce a partial facade (createMiddleware is not a function). Workaround for vitejs/vite#22491 / #22493. (#7466)Updated dependencies []:
v1.168.9Compare Source
Patch Changes
v1.168.8Compare Source
Patch Changes
0300f87]:v1.168.7Compare Source
Patch Changes
5fa9e55]:v1.168.6Compare Source
Patch Changes
v1.168.5Compare Source
Patch Changes
v1.168.4Compare Source
Patch Changes
v1.168.3Compare Source
Patch Changes
v1.168.2Compare Source
Patch Changes
v1.168.1Compare Source
Patch Changes
2387a2e]:v1.168.0Compare Source
Minor Changes
Patch Changes
201e150,5ae2ae5]:better-auth/better-auth (better-auth)
v1.6.16Compare Source
Patch Changes
#9974
cb1cbfaThanks @Bekacru! - Guard protected user fields in the admin plugin behind their dedicated permissions./admin/create-usernow requiresuser:set-rolewhen aroleis supplied (top-level or viadata.role), validates requested roles against the configured roles, requiresuser:banfor ban fields passed indata, and no longer letsdataoverrideemail,name, orrole./admin/update-usernow requiresuser:banforbanned/banReason/banExpires(revoking the user's sessions when banning and rejecting self-bans), requires the newuser:set-emailpermission foremail/emailVerified(with email validation, lowercasing, and uniqueness checks), and rejectspasswordupdates in favor of/admin/set-user-password. If you use a custom access control, addset-emailto your statements and grant it (andban) to roles that should be able to change those fields throughupdate-user.#9974
cb1cbfaThanks @Bekacru! - Require a provider account id when signing in through generic OAuth. The default userinfo handler previously fell back to an empty string when the provider response had nosub(orid), and the callback never checked the resolved account id. With certain non-OIDC providers that omitsub, accounts could be stored under the same empty id and a later sign-in could resolve to an existing account. The generic OAuth callback now rejects sign-in when no account id can be resolved, the default userinfo handler returns no profile when neithersubnoridis present, and the built-in OAuth callback also rejects an empty account id.#9974
cb1cbfaThanks @Bekacru! - Scope organization invitation team IDs to the invited organization.createInvitationnow validates that every requestedteamIdbelongs to the invitation's organization regardless of whetherteams.maximumMembersPerTeamis set, andacceptInvitationre-checks each stored team's organization before adding team membership. Previously, with the default unlimited team size, a team ID from another organization could be stored on an invitation and applied on acceptance.#9973
87e7aa5Thanks @gustavovalverde! - Email sign-in and sign-up noConfiguration
📅 Schedule: (in timezone America/Los_Angeles)
* * * * 1-5)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.