The demo accepts only registered device client IDs, so the approval page
can show their registered name. Both examples look names up in a Map, so
a client ID such as __proto__ falls back to the unrecognized label.
Approve stays disabled unless the lookup returned the client ID, which
GET /device includes only for the session that claimed the code. The
demo also discards stale lookups, reports invalid or expired codes, and
both examples show a registered client name instead of the raw ID.
The approval page example enabled Approve before the request details
loaded, and the demo approval page showed neither the client nor the
requested scopes. Both now load them from GET /device, keep Approve
disabled until they arrive, and remind the user to approve only a code
shown on a device they have. The docs also describe which approval pages
to avoid.
Reconcile pnpm-lock.yaml (root) and demo/nextjs/pnpm-lock.yaml with the merged
package.json and pnpm-workspace.yaml overrides: next's workspace versions plus
main's security bumps (samlify 2.13.1, fast-xml-parser 5.8.0) and the #9820
transitive-version overrides. demo/nextjs is a standalone pnpm project whose
lockfile was resolved to next's during the merge while its workspace took
main's overrides, so it is regenerated to match.
Two root overrides pin dependencies to next's working versions:
- kysely 0.28.17 (main's resolved version). The catalog range permits 0.29,
but kysely 0.29's ESM build dropped the migration-table exports the
kysely-adapter node:sqlite introspector imports, breaking table discovery.
- zod 4.x to 4.3.6. better-call's zod peer otherwise resolves to 4.4.3, which
produces a third zod copy that makes the docs app resolve zod to the 3.x
line and fails react-hook-form's zodResolver type check.
main reaches these versions through its release-age policy; next pins them
explicitly because that policy does not resolve in every environment. Remove
the pins once the kysely 0.29 and zod 4.4 upgrades land with their fixes.
Verified: frozen install (root and all demos) under the strict policy, docs
tsc, build, and the OAuth/SSO/oauth-provider regression suites.
Sync main (through #9821/#9820/#9822/#9768) into next. Conflicting
package.json files keep next's version and intentional divergences (for
example the cli's c12 v4) while taking main's dependency updates, including
the samlify 2.13.1 and fast-xml-parser security bumps; the lockfile is
regenerated from the reconciled set. The 13 source/doc/test conflicts take
next's refactored architecture as the baseline; main's colliding fixes are
re-applied on top in the following per-domain commits.
Clean main fixes land via this merge, including the auto-restored
account-takeover defenses #9578 and #9577.
Gustavo Valverde
TaesuandGitHub
