chore(deps): bump the production-dependencies group across 1 directory with 8 updates by dependabot[bot] · Pull Request #302 · StuartMeeks/ficsit-foreman

dependabot · 2026-09-14T07:12:20Z

Bumps the production-dependencies group with 7 updates in the / directory:

Package	From	To
better-auth	`1.6.28`	`1.7.4`
react	`19.2.8`	`19.3.0`
react-dom	`19.2.8`	`19.3.0`
@anthropic-ai/sdk	`0.117.1`	`0.125.0`
@prisma/adapter-better-sqlite3	`7.9.1`	`7.10.0`
@prisma/client	`7.9.1`	`7.10.0`
openai	`7.4.0`	`7.15.0`

Updates better-auth from 1.6.28 to 1.7.4

Release notes

Sourced from better-auth's releases.

v1.7.4

better-auth

Features

Added experimental.instrumentation.enabled to disable OpenTelemetry span creation per auth instance. (#11224)

Added support for additional session fields in testUtils auth helpers. (#11217)

Added Vitest 5 support to the testing utilities. (#11205)

For detailed changes, see CHANGELOG

@better-auth/core

Features

Added experimental.instrumentation.enabled to disable OpenTelemetry span creation per auth instance. (#11224)

Bug Fixes

Fixed Metro bundling when the optional OpenTelemetry API is not installed. (#11210)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

Fixed multibyte session data storage in Expo SecureStore. (#11238)

Fixed stale Expo secure-storage session data and corrupted cookies during concurrent updates. (#11200)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

Improved schema validation for the Drizzle Relations v2 adapter. (#11213)

For detailed changes, see CHANGELOG

@better-auth/test-utils

Features

Added Vitest 5 support to the testing utilities. (#11205)

For detailed changes, see CHANGELOG

Contributors

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.4

Patch Changes

#11205 3f890eb Thanks @bytaesu! - Support Vitest 5 in the testing utilities while retaining support for previously supported Vitest versions.

#11224 c1756a2 Thanks @bytaesu! - Add experimental.instrumentation.enabled to disable Better Auth OpenTelemetry span creation per auth instance. Instrumentation remains enabled by default and independent of usage reporting.

#11217 9b9638e Thanks @onmax! - Allow testUtils auth helpers to accept additional session fields through the session option, including required fields without defaults and per-session overrides of configured defaults.

Updated dependencies [3ff842a, b905bfe, c1756a2]:

@better-auth/core@1.7.4

@better-auth/drizzle-adapter@1.7.4

@better-auth/kysely-adapter@1.7.4

@better-auth/memory-adapter@1.7.4

@better-auth/mongo-adapter@1.7.4

@better-auth/prisma-adapter@1.7.4

@better-auth/telemetry@1.7.4

1.7.3

Patch Changes

#11060 3660f06 Thanks @bytaesu! - Handle malformed custom-scheme callback URLs without excessive processing.

#11037 5bd7096 Thanks @bytaesu! - Prevent repeated TOTP enrollment from replacing an active authenticator and its backup codes.

#11120 7ec7146 Thanks @onmax! - Prevent getSession from failing when cookie caching is disabled while clients still have cached session cookies.

#9908 76d311f Thanks @harshil1712! - Add Cloudflare as a built-in social provider, with support for client-secret authentication and PKCE clients without a secret.

#11188 c47b765 Thanks @bytaesu! - Normalize Auth0 domains without a potentially slow trailing-slash regular expression.

#11084 2d5c63d Thanks @bytaesu! - Prevent duplicate session requests and hydration mismatches when using the Vue client with Nuxt useFetch.

#11147 a9d8c12 Thanks @bytaesu! - Add isPasswordCompromised for checking passwords against Have I Been Pwned in custom server-side flows, while ignoring padded response entries with zero occurrences.

#10988 9fc7498 Thanks @bytaesu! - Run callback hooks after proxied OAuth sign-ins and preserve server state when callback cookies are unavailable. The legacy /oauth-proxy-callback endpoint is deprecated and will be removed in the next minor release.

#11178 be0e007 Thanks @bytaesu! - Report missing tables, missing columns, and required columns Better Auth never writes during initialization, with guidance for fixing them. Kysely checks the live database schema. Authentication requests await the same check and are rejected if the schema does not match.

Validation is enabled by default, including in production. Set advanced.database.validateSchema: false to disable runtime validation. auth migrate refuses to apply changes when required unwritten columns need manual repair.

#11069 0bb0dbf Thanks @bytaesu! - Improve dynamic organization role permission check performance.

#11153 2220ee7 Thanks @bytaesu! - Restore sign-in compatibility with 1.6 databases by identifying accounts with (providerId, accountId) and removing the issuer requirement introduced in 1.7.0. Upgrading from 1.6 no longer requires an account schema migration. Ambiguous account keys are rejected instead of selecting an arbitrary account.

If you applied the 1.7.0 through 1.7.2 account schema, remove its issuer unique index before upgrading. For SQL databases, also make issuer nullable or remove the column so sign-ups and account linking can succeed. auth migrate does not perform this cleanup. Follow the upgrade guide for database-specific steps.

#10978 5fe5bc2 Thanks @BetterAndBetterII! - Skip a generic OAuth provider when discovery fails instead of taking down the rest of the auth API.

... (truncated)

Commits

735008f chore: release v1.7.4 (#11216)
80b1d64 chore(deps): bump next (#11226)
9b9638e feat(test-utils): accept additional session fields in auth helpers (#11217)
eb8b6fd test: adopt Vitest 5 features (#11211)
3f890eb feat(test): support Vitest 5 (#11205)
c1756a2 feat(instrumentation): add option to disable tracing (#11224)
874752f test(open-api): lock in requestBody for /phone-number/verify (#11208)
cfedf97 docs: update CLI references to auth (#11214)
597d39c chore: release v1.7.3 (#11032)
1a1b7d5 fix(core): restore optional atomic adapter methods (#11189)
Additional commits viewable in compare view

Updates react from 19.2.8 to 19.3.0

Release notes

Sourced from react's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

<ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@sebmarkbage, @jackpope, @gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)

Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@jackpope, @sebmarkbage, @eps1lon, @Dhakshin2007, @chirokas, @teamleaderleo, @fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@gnoff: #37143, #37241)

Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@gnoff #37193)

Notable changes

Enable Trusted Types API integration (@rickhanlonii #35816)

Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@acdlite #37290)

Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@hoxyq, @eps1lon: #37104, #37203, #37491)

All Changes

React

Fast Refresh Fixes

Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@sophiebits #36965)

Fix Fast Refresh so edits to a memo() comparison function take effect (@sophiebits #36964)

Fix Fast Refresh crash when an edit changes the kind of a component's type (@sophiebits #36963)

Unify hot reload type resolution for Fast Refresh (@sophiebits #36962)

Fix Fast Refresh to remount correctly when an edit changes the component kind (@sophiebits #36950)

Double invoke effects in StrictMode after Fast Refresh (@eps1lon #35962)

Performance Track Fixes

Prevent crash when accessing $$typeof in Performance Tracks (@eps1lon #35679)

Handle non-string function names in Performance Tracks (@eps1lon #35659)

Use minus (-) instead of en dash for removed props in Performance Tracks (@eps1lon #35649)

Handle arrays with bigints in deep objects in Performance Tracks (@eps1lon #35648)

Don't enumerate typed array props in Performance Tracks in DEV (@UditDewan #36913)

Bail out of diffing wide objects and arrays in Performance Tracks (@eps1lon #34742)

Clear potentially large performance measures in DEV (@hoxyq #34803)

Fix missing else branch for renders with no props change in Performance Tracks (@hoxyq #34837)

Activity Fixes

Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@sophiebits #36947)

Hide portal contents when an Activity is hidden (@acdlite #35091)

Prevent metadata hoisting in hidden <Activity> trees (@ronnakamoto #34983)

Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@acdlite #35074)

Don't unhide a node if a direct parent Offscreen is still hidden (@sebmarkbage #34821)

Don't show internal <Offscreen> component in error messages (@rickhanlonii #35763)

Warn in DEV when a component appears to have been unblocked by a conditional use() (@hoxyq, @eps1lon: #37104, #37203, #37491)

Render transitions independently instead of entangling them into a single render (@acdlite #37290)

... (truncated)

Changelog

Sourced from react's changelog.

19.3.0 (September 9, 2026)

New React Features

<ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@sebmarkbage, @jackpope, @gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)

Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@jackpope, @sebmarkbage, @eps1lon, @Dhakshin2007, @chirokas, @teamleaderleo, @fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@gnoff: #37143, #37241)

Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@gnoff #37193)

Notable changes

Enable Trusted Types API integration (@rickhanlonii #35816)

Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@acdlite #37290)

Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@hoxyq, @eps1lon: #37104, #37203, #37491)

All Changes

React

Fast Refresh Fixes

Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@sophiebits #36965)

Fix Fast Refresh so edits to a memo() comparison function take effect (@sophiebits #36964)

Fix Fast Refresh crash when an edit changes the kind of a component's type (@sophiebits #36963)

Unify hot reload type resolution for Fast Refresh (@sophiebits #36962)

Fix Fast Refresh to remount correctly when an edit changes the component kind (@sophiebits #36950)

Double invoke effects in StrictMode after Fast Refresh (@eps1lon #35962)

Performance Track Fixes

Prevent crash when accessing $$typeof in Performance Tracks (@eps1lon #35679)

Handle non-string function names in Performance Tracks (@eps1lon #35659)

Use minus (-) instead of en dash for removed props in Performance Tracks (@eps1lon #35649)

Handle arrays with bigints in deep objects in Performance Tracks (@eps1lon #35648)

Don't enumerate typed array props in Performance Tracks in DEV (@UditDewan #36913)

Bail out of diffing wide objects and arrays in Performance Tracks (@eps1lon #34742)

Clear potentially large performance measures in DEV (@hoxyq #34803)

Fix missing else branch for renders with no props change in Performance Tracks (@hoxyq #34837)

Activity Fixes

Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@sophiebits #36947)

Hide portal contents when an Activity is hidden (@acdlite #35091)

Prevent metadata hoisting in hidden <Activity> trees (@ronnakamoto #34983)

Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@acdlite #35074)

Don't unhide a node if a direct parent Offscreen is still hidden (@sebmarkbage #34821)

Don't show internal <Offscreen> component in error messages (@rickhanlonii #35763)

Warn in DEV when a component appears to have been unblocked by a conditional use() (@hoxyq, @eps1lon: #37104, #37203, #37491)

Render transitions independently instead of entangling them into a single render (@acdlite #37290)

Fix hang when updating a dehydrated boundary inside a hidden tree (@gaearon #37135)

Don't reacquire Host Singletons during dev effect validation (@gnoff #37113)

Only remove properties from Host Singletons on release (@gnoff #37112)

... (truncated)

Commits

2dc7da7 [test] Bump Jest to 30.4 (#37382)
4f93894 docs: remove stale parentType param from validateChildKeys JSDoc (#36928)
dbc3750 Update required references to GitHub repo (#36752)
900ae09 [flow] Bump flow to v0.317.0 (#36701)
fbb1370 [flow] Bump flow to v0.307.1 (#36199)
56922cf [react-native-renderer] Delete Paper (legacy) renderer (#36285)
74568e8 [Flight] Transport AggregateErrors.errors (#36156)
e66ef64 [tests] remove withoutStack from assertConsole helpers (#35498)
db71391 [Fiber] Instrument the lazy initializer thenable in all cases (#35521)
3e1abcc [tests] Require exact error messages in assertConsole helpers (#35497)
Additional commits viewable in compare view

Updates react-dom from 19.2.8 to 19.3.0

Release notes

Sourced from react-dom's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

<ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@sebmarkbage, @jackpope, @gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)

Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@jackpope, @sebmarkbage, @eps1lon, @Dhakshin2007, @chirokas, @teamleaderleo, @fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <...
Description has been truncated

…y with 8 updates Bumps the production-dependencies group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.6.28` | `1.7.4` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.0` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.0` | | [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.117.1` | `0.125.0` | | [@prisma/adapter-better-sqlite3](https://github.com/prisma/prisma/tree/HEAD/packages/adapter-better-sqlite3) | `7.9.1` | `7.10.0` | | [@prisma/client](https://github.com/prisma/prisma/tree/HEAD/packages/client) | `7.9.1` | `7.10.0` | | [openai](https://github.com/openai/openai-node) | `7.4.0` | `7.15.0` | Updates `better-auth` from 1.6.28 to 1.7.4 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.4/packages/better-auth) Updates `react` from 19.2.8 to 19.3.0 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.0/packages/react) Updates `react-dom` from 19.2.8 to 19.3.0 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.0/packages/react-dom) Updates `@anthropic-ai/sdk` from 0.117.1 to 0.125.0 - [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases) - [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md) - [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.117.1...sdk-v0.125.0) Updates `@prisma/adapter-better-sqlite3` from 7.9.1 to 7.10.0 - [Release notes](https://github.com/prisma/prisma/releases) - [Commits](https://github.com/prisma/prisma/commits/7.10.0/packages/adapter-better-sqlite3) Updates `@prisma/client` from 7.9.1 to 7.10.0 - [Release notes](https://github.com/prisma/prisma/releases) - [Commits](https://github.com/prisma/prisma/commits/7.10.0/packages/client) Updates `openai` from 7.4.0 to 7.15.0 - [Release notes](https://github.com/openai/openai-node/releases) - [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md) - [Commits](openai/openai-node@v7.4.0...v7.15.0) Updates `zod` from 4.4.3 to 4.6.2 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.4.3...v4.6.2) --- updated-dependencies: - dependency-name: better-auth dependency-version: 1.7.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: react dependency-version: 19.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: react-dom dependency-version: 19.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@anthropic-ai/sdk" dependency-version: 0.125.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@prisma/adapter-better-sqlite3" dependency-version: 7.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@prisma/client" dependency-version: 7.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: openai dependency-version: 7.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: zod dependency-version: 4.6.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

StuartMeeks

Automated approval: version-update:semver-minor dependency update.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 14, 2026

dependabot Bot requested a review from StuartMeeks as a code owner September 14, 2026 07:12

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 14, 2026

StuartMeeks approved these changes Sep 14, 2026

View reviewed changes

StuartMeeks enabled auto-merge (squash) September 14, 2026 07:12

Navigation Menu

chore(deps): bump the production-dependencies group across 1 directory with 8 updates - #302

chore(deps): bump the production-dependencies group across 1 directory with 8 updates#302
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-09c26e2114

dependabot Bot commented on behalf of github Sep 14, 2026

Uh oh!

StuartMeeks left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Sep 14, 2026

v1.7.4

better-auth

Features

@better-auth/core

Features

Bug Fixes

@better-auth/expo

Bug Fixes

@better-auth/drizzle-adapter

Bug Fixes

@better-auth/test-utils

Features

Contributors

1.7.4

Patch Changes

1.7.3

Patch Changes

19.3.0 (September 9, 2026)

New React Features

New React DOM Features

Notable changes

All Changes

React

19.3.0 (September 9, 2026)

New React Features

New React DOM Features

Notable changes

All Changes

React

19.3.0 (September 9, 2026)

New React Features

New React DOM Features

Uh oh!

StuartMeeks left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

`better-auth`

`@better-auth/core`

`@better-auth/expo`

`@better-auth/drizzle-adapter`

`@better-auth/test-utils`