Skip to content

build(deps): update all non-major dependencies#33

Open
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/all-minor-patch
Open

build(deps): update all non-major dependencies#33
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/all-minor-patch

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate bot commented Feb 1, 2026 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@eslint/js (source) 9.39.3 → 9.39.4 age confidence
@hono/swagger-ui (source) ^0.5.0 → ^0.6.0 age confidence
@hono/zod-openapi (source) 1.2.2 → 1.2.4 age confidence
@libsql/client (source) 0.17.0 → 0.17.2 age confidence
@scalar/hono-api-reference (source) ^0.9.40 → ^0.10.0 age confidence
@tailwindcss/vite (source) 4.2.1 → 4.2.2 age confidence
@types/node (source) 20.19.33 → 20.19.39 age confidence
@typescript-eslint/parser (source) 8.56.0 → 8.58.0 age confidence
better-auth (source) 1.4.18 → 1.5.6 age confidence
dotenv 17.3.1 → 17.4.1 age confidence
drizzle-kit (source) 0.31.9 → 0.31.10 age confidence
drizzle-orm (source) 0.45.1 → 0.45.2 age confidence
eslint-plugin-turbo (source) 2.8.10 → 2.9.4 age confidence
globals 17.3.0 → 17.4.0 age confidence
jest (source) 30.2.0 → 30.3.0 age confidence
lint-staged 16.2.7 → 16.4.0 age confidence
lucide-vue-next (source) ^0.575.0 → ^0.577.0 age confidence
tailwindcss (source) 4.2.1 → 4.2.2 age confidence
ts-jest (source) 29.4.6 → 29.4.9 age confidence
turbo (source) 2.8.10 → 2.9.4 age confidence
typescript-eslint (source) 8.56.0 → 8.58.0 age confidence
vue (source) 3.5.28 → 3.5.32 age confidence
yarn (source) 4.12.0 → 4.13.0 age confidence

Release Notes

eslint/eslint (@​eslint/js)

v9.39.4

Compare Source

honojs/middleware (@​hono/swagger-ui)

v0.6.1

Compare Source

Patch Changes

v0.6.0

Compare Source

Minor Changes
honojs/middleware (@​hono/zod-openapi)

v1.2.4

Compare Source

Patch Changes

v1.2.3

Compare Source

Patch Changes
tursodatabase/libsql-client-ts (@​libsql/client)

v0.17.2

Compare Source

v0.17.1

Compare Source

scalar/scalar (@​scalar/hono-api-reference)

v0.10.6

v0.10.5

v0.10.4

Patch Changes

v0.10.3

Patch Changes
Updated Dependencies

v0.10.2

Patch Changes
Updated Dependencies

v0.10.1

Patch Changes
Updated Dependencies

v0.10.0

Minor Changes
  • #​8322: chore: bump required node version to >=22 (LTS)
Patch Changes
Updated Dependencies

v0.9.48

Patch Changes
Updated Dependencies

v0.9.47

Patch Changes
Updated Dependencies

v0.9.46

Patch Changes
Updated Dependencies

v0.9.45

Patch Changes
Updated Dependencies
tailwindlabs/tailwindcss (@​tailwindcss/vite)

v4.2.2

Compare Source

Fixed
  • Don't crash when candidates contain prototype properties like row-constructor (#​19725)
  • Canonicalize calc(var(--spacing)*…) expressions into --spacing(…) (#​19769)
  • Fix crash in canonicalization step when handling utilities containing @property at-rules (e.g. shadow-sm border) (#​19727)
  • Skip full reload for server only modules scanned by client CSS when using @tailwindcss/vite (#​19745)
  • Add support for Vite 8 in @tailwindcss/vite (#​19790)
  • Improve canonicalization for bare values exceeding default spacing scale suggestions (e.g. w-1234 h-1234 → size-1234) (#​19809)
  • Fix canonicalization resulting in empty list (e.g. w-5 h-5 size-5 → '' instead of size-5) (#​19812)
typescript-eslint/typescript-eslint (@​typescript-eslint/parser)

v8.58.0

Compare Source

🚀 Features
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.57.2

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.57.1

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.57.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.56.1

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

better-auth/better-auth (better-auth)

v1.5.6

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v1.5.5

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v1.5.4

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v1.5.3

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v1.5.2

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v1.5.1

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v1.5.0

Compare Source

Better Auth 1.5 Release

We’re excited to announce the release of Better Auth 1.5! 🎉

This is our biggest release yet, with over 600 commits, 70 new features, 200 bug fixes, and 7 entirely new packages. From MCP authentication to Electron desktop support, this release brings Better Auth to new platforms and use cases.

We’re also announcing our new Infrastructure product. It lets you use a full user management and analytics dashboard, security and protection tooling, audit logs, a self-service SSO UI, and more, all with your own Better Auth instance.

Starting with this release, the self-service SSO dashboard — which lets your enterprise customers onboard their own SAML providers without support tickets — is powered by Better Auth Infrastructure. If you’re using the SSO plugin in production, we recommend upgrading to the Pro or Business tier to get access to the dashboard and streamline your enterprise onboarding.

And soon, you’ll be able to host your Better Auth instance on our infrastructure as well, so you can own your auth at scale without worrying about infrastructure needs.

Sign up now: https://better-auth.com/sign-in 🚀

To upgrade, run:

npx auth upgrade

🚀 Highlights

New Better Auth CLI

We’re introducing a new standalone CLI: npx auth. This replaces the previous @better-auth/cli package, which will be deprecated in a future release.

npx auth init

With a single interactive command, npx auth init scaffolds a complete Better Auth setup — configuration file, database adapter, and framework integration.

All existing commands like migrate and generate are available through the new CLI as well:

npx auth migrate   # Run database migrations
npx auth generate  # Generate auth schema
npx auth upgrade   # Upgrade Better Auth to the latest version

The generate command now also supports a --adapter flag, letting you generate schema output tailored to your specific database adapter without needing a full Better Auth config file:

npx auth generate --adapter prisma
npx auth generate --adapter drizzle
Remote MCP Auth Client

The MCP plugin now ships a framework-agnostic remote auth client. If your MCP server is separate from your Better Auth instance, you can verify tokens and protect resources without duplicating auth logic.

👉 Read more about MCP authentication

import { createMcpAuthClient } from "better-auth/plugins/mcp/client";

const mcpAuth = createMcpAuthClient({
    authURL: "<https://my-app.com/api/auth>",
});

// Use as a handler wrapper
const handler = mcpAuth.handler(async (req, session) => {
    // session contains userId, scopes, accessToken, clientId, etc.
    return new Response("OK");
});

// Or verify tokens directly
const session = await mcpAuth.verifyToken(token);

It also comes with built-in framework adapters for Hono and Express-like servers:

import { mcpAuthHono } from "better-auth/plugins/mcp/client/adapters";

const middleware = mcpAuthHono(mcpAuth);
OAuth 2.1 Provider

The new @better-auth/oauth-provider plugin turns your Better Auth instance into a full OAuth 2.1 authorization server with OIDC compatibility. Issue access tokens, manage client registrations, and let third-party apps authenticate against your API — including MCP agents.

👉 Read more about the OAuth Provider

import { betterAuth } from "better-auth";
import { jwt } from "better-auth/plugins";
import { oauthProvider } from "@&#8203;better-auth/oauth-provider";

export const auth = betterAuth({
    plugins: [
        jwt(),
        oauthProvider({
            loginPage: "/sign-in",
            consentPage: "/consent",
        }),
    ],
});

Key features:

  • OAuth 2.1 with OIDC: Supports authorization_code, refresh_token, and client_credentials grants with openid scope support.
  • MCP-ready: Works out of the box as an authorization server for MCP tools and agents.
  • Dynamic Client Registration: Allow clients to register dynamically, with support for both public and confidential clients.
  • JWT & JWKS verification: Sign access tokens as JWTs and verify them remotely via the /jwks endpoint.
  • Consent & authorization flows: Built-in consent, account selection, and post-login redirect screens.
  • Token introspection & revocation: RFC 7662 and RFC 7009 compliant endpoints.
  • Per-endpoint rate limiting: Configurable rate limits for each OAuth endpoint.

Note:

The OAuth 2.1 Provider replaces the previous OIDC Provider plugin, which will be deprecated in a future release. The MCP plugin will also transition to use the OAuth 2.1 Provider as its foundation. See the migration guide for upgrading from the OIDC Provider plugin.

Electron Integration

Full desktop authentication support for Electron apps. The plugin handles the complete OAuth flow — opening the system browser, exchanging authorization codes via custom protocol, and managing cookies securely.

👉 Read more about Electron integration

import { betterAuth } from "better-auth";
import { electron } from "@&#8203;better-auth/electron";

export const auth = betterAuth({
    plugins: [electron()],
});
import { createAuthClient } from "better-auth/client";
import { electronClient } from "@&#8203;better-auth/electron/client";

const client = createAuthClient({
    plugins: [
        electronClient({
            protocol: "com.example.myapp",
        }),
    ],
});

// Opens system browser, handles callback, returns session
await client.requestAuth();
Internationalization (i18n)

The new i18n plugin provides type-safe error message translations with automatic locale detection from headers, cookies, or sessions.

👉 Read more about i18n

import { betterAuth } from "better-auth";
import { i18n } from "@&#8203;better-auth/i18n";

export const auth = betterAuth({
    plugins: [
        i18n({
            defaultLocale: "en",
            detection: ["header", "cookie"],
            translations: {
                en: { USER_NOT_FOUND: "User not found" },
                fr: { USER_NOT_FOUND: "Utilisateur non trouvé" },
                es: { USER_NOT_FOUND: "Usuario no encontrado" },
            },
        }),
    ],
});

Error codes are fully typed — your IDE will autocomplete all available error codes from every registered plugin.

Typed Error Codes

Every error response now includes a machine-readable code field. All first-party plugins define their own typed error codes using defineErrorCodes, and the APIError class supports them natively.

import { defineErrorCodes } from "@&#8203;better-auth/core";

export const MY_ERROR_CODES = defineErrorCodes({
    USER_NOT_FOUND: "User not found",
    INVALID_TOKEN: "The provided token is invalid",
});

// In route handlers:
throw APIError.from("BAD_REQUEST", MY_ERROR_CODES.USER_NOT_FOUND);

Error responses now look like:

{
    "code": "USER_NOT_FOUND",
    "message": "User not found"
}

This is the foundation that the i18n plugin builds on — every error code from every plugin is discoverable at compile time, so translation dictionaries are fully type-checked.

SSO — Production Ready

The SSO plugin has received extensive hardening to be production-ready, with 23+ commits improving security and compliance.

Self-Service SSO Dashboard

As part of our new Infrastructure product, the SSO plugin is now accompanied by a self-service dashboard for onboarding enterprise customers. Organization admins can generate a shareable link that walks enterprise customers through configuring their SAML identity provider — no back-and-forth support tickets required.

The dashboard is available at:

https://better-auth.com/dashboard/[project]/organization/[orgId]/enterprise

From there, you can generate onboarding links, monitor SSO connection status, and manage provider configurations for each organization.

SAML Single Logout (SLO)

Full support for both SP-initiated and IdP-initiated SAML Single Logout:

import { betterAuth } from "better-auth";
import { sso } from "@&#8203;better-auth/sso";

export const auth = betterAuth({
    plugins: [
        sso({
            saml: {
                enableSingleLogout: true, // [!code highlight]
                wantLogoutRequestSigned: true,
                wantLogoutResponseSigned: true,
            },
        }),
    ],
});
Additional SSO Improvements
  • Signed SAML AuthnRequests: Configurable signature and digest algorithms.
  • Multi-domain providers: Bind SSO providers to multiple domains.
  • InResponseTo validation: Prevent replay attacks on SAML assertions.
  • Algorithm restrictions: Block deprecated signature/digest algorithms.
  • Clock skew tolerance: Configurable tolerance for SAML timestamp validation.
  • OIDC ID token aud claim validation: Verify audience in OpenID Connect flows.
  • Provider CRUD endpoints: List, get, update, and delete SSO providers via API.
  • Shared OIDC redirect URI: Single redirect URI for all OIDC providers.
Unified Before & After Hooks

Plugin hooks and global hooks now share the same AuthMiddleware type, making the hooks system consistent and composable across the entire auth pipeline.

import { betterAuth } from "better-auth";
import { createAuthMiddleware } from "better-auth/api";

export const auth = betterAuth({
    hooks: {
        before: createAuthMiddleware(async (ctx) => {
            // Runs before every endpoint
            console.log("Request to:", ctx.path);
        }),
        after: createAuthMiddleware(async (ctx) => {
            // Runs after every endpoint, with access to the response
            console.log("Response:", ctx.context.returned);
        }),
    },
});

Plugins use the same middleware type with matchers for targeted interception:

hooks: {
    before: [{
        matcher: (ctx) => ctx.path === "/sign-in/email",
        handler: createAuthMiddleware(async (ctx) => { /* ... */ }),
    }],
},
Dynamic Base URL

Better Auth can now resolve the base URL dynamically from incoming requests, making it work seamlessly with Vercel preview deployments, multi-domain setups, and reverse proxies.

👉 Read more about dynamic base URL

import { betterAuth } from "better-auth";

export const auth = betterAuth({
    baseURL: {
        allowedHosts: [
            "myapp.com",
            "*.vercel.app",       // Any Vercel preview
            "preview-*.myapp.com", // Pattern match
        ],
        fallback: "<https://myapp.com>",
        protocol: "auto",
    },
});
Verification on Secondary Storage

Verification tokens can now be stored in secondary storage (e.g., Redis) instead of — or in addition to — the database. Identifiers can be hashed for extra security.

import { betterAuth } from "better-auth";

export const auth = betterAuth({
    secondaryStorage: {
        // ... your Redis config
    },
    verification: {
        storeIdentifier: "hashed",     // Hash verification identifiers // [!code highlight]
        storeInDatabase: false,        // Only use secondary storage // [!code highlight]
    },
});

You can also configure per-identifier overrides:

verification: {
    storeIdentifier: {
        default: "plain",
        overrides: {
            "email-verification": "hashed",
            "password-reset": "hashed",
        },
    },
},
Rate Limiter Improvements

The rate limiter has been improved with separate request/response handling, hardened defaults, and IPv6 support.

  • Separate request and response phases: Rejected requests are no longer counted against the rate limit.
  • Hardened default rules: Sign-in/sign-up limited to 3 requests per 10 seconds; password reset/OTP limited to 3 requests per 60 seconds.
  • IPv6 subnet support: Rate limiting by IPv6 prefix with configurable subnet size.
  • Plugin-level rate limit rules: Plugins can define their own rate limit rules.
  • Expired entry cleanup: Automatic cleanup for the memory storage backend.
import { betterAuth } from "better-auth";

export const auth = betterAuth({
    advanced: {
        ipAddress: {
            ipv6Subnet: 64, // Rate limit by /64 subnet
        },
    },
});
Non-Destructive Secret Key Rotation

Better Auth now supports rotating BETTER_AUTH_SECRET without invalidating existing sessions, tokens, or encrypted data. When you need to rotate your secret — whether for scheduled rotation or incident response — you can introduce a new key while keeping old keys available for decryption.

import { betterAuth } from "better-auth";

export const auth = betterAuth({
    secrets: [
        { version: 2, value: "new-secret-key-at-least-32-chars" },   // current (first = active)
        { version: 1, value: "old-secret-key-still-used-to-decrypt" }, // previous
    ],
});

Or via environment variable:

BETTER_AUTH_SECRETS="2:new-secret-key,1:old-secret-key"

New data is always encrypted with the latest key (first in the array), while decryption automatically tries all configured keys. This lets you roll secrets gradually without downtime or data loss.

Seat-Based Billing (Stripe)

The Stripe plugin now supports per-seat billing for organizations. Member changes automatically sync seat quantity with Stripe.

import { betterAuth } from "better-auth";
import { stripe } from "@&#8203;better-auth/stripe";
import { organization } from "better-auth/plugins";

export const auth = betterAuth({
    plugins: [
        organization(),
        stripe({
            stripeClient,
     

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "on the 1st day of the month" (UTC), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/malang-dev/template-nodejs).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi45Mi4xIiwidXBkYXRlZEluVmVyIjoiNDMuMTAyLjExIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbXX0=-->

@renovate renovate bot changed the title build(deps): update dependency globals to v17.3.0 build(deps): update all non-major dependencies Feb 3, 2026
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 7 times, most recently from bcf0861 to d05b786 Compare February 9, 2026 17:57
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 7 times, most recently from 8d05175 to 5e909de Compare February 19, 2026 13:35
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from dc52fcc to b9fba5d Compare February 23, 2026 13:08
@renovate renovate bot changed the title build(deps): update all non-major dependencies build(deps): update all non-major dependencies - autoclosed Feb 23, 2026
@renovate renovate bot closed this Feb 23, 2026
@renovate renovate bot deleted the renovate/all-minor-patch branch February 23, 2026 13:11
@renovate renovate bot changed the title build(deps): update all non-major dependencies - autoclosed build(deps): update all non-major dependencies Mar 1, 2026
@renovate renovate bot reopened this Mar 1, 2026
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from c0e0576 to d1af473 Compare March 2, 2026 20:57
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 12 times, most recently from e6fc1ba to ba49a5d Compare March 13, 2026 01:31
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 9 times, most recently from e05c192 to 643d51e Compare March 19, 2026 21:30
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 8 times, most recently from 2af9317 to 00b5890 Compare March 27, 2026 00:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants