chore: update jose and crypto dependencies (#4433)

Co-authored-by: Alex Yang <himself65@outlook.com>

packages/better-auth/package.json

@@ -700,13 +700,13 @@
   "dependencies": {
     "@better-auth/utils": "0.2.6",
     "@better-fetch/fetch": "catalog:",
-    "@noble/ciphers": "^0.6.0",
-    "@noble/hashes": "^1.8.0",
+    "@noble/ciphers": "^2.0.0",
+    "@noble/hashes": "^2.0.0",
     "@simplewebauthn/browser": "^13.1.2",
     "@simplewebauthn/server": "^13.1.2",
     "better-call": "catalog:",
     "defu": "^6.1.4",
-    "jose": "^5.10.0",
+    "jose": "^6.1.0",
     "kysely": "^0.28.5",
     "nanostores": "^0.11.4",
     "zod": "^4.1.5"

packages/better-auth/src/crypto/index.ts

@@ -1,7 +1,11 @@
 import { createHash } from "@better-auth/utils/hash";
-import { xchacha20poly1305 } from "@noble/ciphers/chacha";
-import { bytesToHex, hexToBytes, utf8ToBytes } from "@noble/ciphers/utils";
-import { managedNonce } from "@noble/ciphers/webcrypto";
+import { xchacha20poly1305 } from "@noble/ciphers/chacha.js";
+import {
+	bytesToHex,
+	hexToBytes,
+	utf8ToBytes,
+	managedNonce,
+} from "@noble/ciphers/utils.js";
 
 export type SymmetricEncryptOptions = {
 	key: string;

packages/better-auth/src/crypto/password.ts

@@ -1,8 +1,8 @@
 import { constantTimeEqual } from "./buffer";
-import { scryptAsync } from "@noble/hashes/scrypt";
+import { scryptAsync } from "@noble/hashes/scrypt.js";
 import { getRandomValues } from "@better-auth/utils";
 import { hex } from "@better-auth/utils/hex";
-import { hexToBytes } from "@noble/hashes/utils";
+import { hexToBytes } from "@noble/hashes/utils.js";
 import { BetterAuthError } from "../error";
 
 const config = {

packages/better-auth/src/utils/hashing.ts

@@ -1,4 +1,5 @@
-import { keccak_256 } from "@noble/hashes/sha3";
+import { keccak_256 } from "@noble/hashes/sha3.js";
+import { utf8ToBytes } from "@noble/hashes/utils.js";
 
 /**
  * TS implementation of ERC-55 ("Mixed-case checksum address encoding") using @noble/hashes
@@ -8,7 +9,7 @@ import { keccak_256 } from "@noble/hashes/sha3";
 export function toChecksumAddress(address: string) {
 	address = address.toLowerCase().replace("0x", "");
 	// Hash the address (treat it as UTF-8) and return as a hex string
-	const hash = [...keccak_256(address)]
+	const hash = [...keccak_256(utf8ToBytes(address))]
 		.map((v) => v.toString(16).padStart(2, "0"))
 		.join("");
 	let ret = "0x";

pnpm-lock.yaml

@@ -613,11 +613,11 @@ importers:
         specifier: 'catalog:'
         version: 1.1.18
       '@noble/ciphers':
-        specifier: ^0.6.0
-        version: 0.6.0
+        specifier: ^2.0.0
+        version: 2.0.0
       '@noble/hashes':
-        specifier: ^1.8.0
-        version: 1.8.0
+        specifier: ^2.0.0
+        version: 2.0.0
       '@simplewebauthn/browser':
         specifier: ^13.1.2
         version: 13.1.2
@@ -631,8 +631,8 @@ importers:
         specifier: ^6.1.4
         version: 6.1.4
       jose:
-        specifier: ^5.10.0
-        version: 5.10.0
+        specifier: ^6.1.0
+        version: 6.1.0
       kysely:
         specifier: ^0.28.5
         version: 0.28.5
@@ -3031,13 +3031,18 @@ packages:
     cpu: [x64]
     os: [win32]
 
-  '@noble/ciphers@0.6.0':
-    resolution: {integrity: sha512-mIbq/R9QXk5/cTfESb1OKtyFnk7oc1Om/8onA1158K9/OZUQFDEVy55jVTato+xmp3XX6F6Qh0zz0Nc1AxAlRQ==}
+  '@noble/ciphers@2.0.0':
+    resolution: {integrity: sha512-j/l6jpnpaIBM87cAYPJzi/6TgqmBv9spkqPyCXvRYsu5uxqh6tPJZDnD85yo8VWqzTuTQPgfv7NgT63u7kbwAQ==}
+    engines: {node: '>= 20.19.0'}
 
   '@noble/hashes@1.8.0':
     resolution: {integrity: sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A==}
     engines: {node: ^14.21.3 || >=16}
 
+  '@noble/hashes@2.0.0':
+    resolution: {integrity: sha512-h8VUBlE8R42+XIDO229cgisD287im3kdY6nbNZJFjc6ZvKIXPYXe6Vc/t+kyjFdMFyt5JpapzTsEg8n63w5/lw==}
+    engines: {node: '>= 20.19.0'}
+
   '@nodelib/fs.scandir@2.1.5':
     resolution: {integrity: sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==}
     engines: {node: '>= 8'}
@@ -8489,6 +8494,9 @@ packages:
   jose@5.10.0:
     resolution: {integrity: sha512-s+3Al/p9g32Iq+oqXxkW//7jk2Vig6FF1CFqzVXoTUXt2qz89YWbL+OwS17NFYEvxC35n0FKeGO2LGYSxeM2Gg==}
 
+  jose@6.1.0:
+    resolution: {integrity: sha512-TTQJyoEoKcC1lscpVDCSsVgYzUDg/0Bt3WE//WiTPK6uOCQC2KZS4MpugbMWt/zyjkopgZoXhZuCi00gLudfUA==}
+
   jotai@2.13.1:
     resolution: {integrity: sha512-cRsw6kFeGC9Z/D3egVKrTXRweycZ4z/k7i2MrfCzPYsL9SIWcPXTyqv258/+Ay8VUEcihNiE/coBLE6Kic6b8A==}
     engines: {node: '>=12.20.0'}
@@ -14759,10 +14767,12 @@ snapshots:
   '@next/swc-win32-x64-msvc@15.5.2':
     optional: true
 
-  '@noble/ciphers@0.6.0': {}
+  '@noble/ciphers@2.0.0': {}
 
   '@noble/hashes@1.8.0': {}
 
+  '@noble/hashes@2.0.0': {}
+
   '@nodelib/fs.scandir@2.1.5':
     dependencies:
       '@nodelib/fs.stat': 2.0.5
@@ -16213,7 +16223,9 @@ snapshots:
       metro-runtime: 0.83.1
     transitivePeerDependencies:
       - '@babel/core'
+      - bufferutil
       - supports-color
+      - utf-8-validate
 
   '@react-native/normalize-colors@0.79.5': {}
 
@@ -21129,6 +21141,8 @@ snapshots:
 
   jose@5.10.0: {}
 
+  jose@6.1.0: {}
+
   jotai@2.13.1(@babel/core@7.28.3)(@babel/template@7.27.2)(@types/react@19.1.12)(react@19.1.1):
     optionalDependencies:
       '@babel/core': 7.28.3