Reconcile pnpm-lock.yaml (root) and demo/nextjs/pnpm-lock.yaml with the merged
package.json and pnpm-workspace.yaml overrides: next's workspace versions plus
main's security bumps (samlify 2.13.1, fast-xml-parser 5.8.0) and the #9820
transitive-version overrides. demo/nextjs is a standalone pnpm project whose
lockfile was resolved to next's during the merge while its workspace took
main's overrides, so it is regenerated to match.
Two root overrides pin dependencies to next's working versions:
- kysely 0.28.17 (main's resolved version). The catalog range permits 0.29,
but kysely 0.29's ESM build dropped the migration-table exports the
kysely-adapter node:sqlite introspector imports, breaking table discovery.
- zod 4.x to 4.3.6. better-call's zod peer otherwise resolves to 4.4.3, which
produces a third zod copy that makes the docs app resolve zod to the 3.x
line and fails react-hook-form's zodResolver type check.
main reaches these versions through its release-age policy; next pins them
explicitly because that policy does not resolve in every environment. Remove
the pins once the kysely 0.29 and zod 4.4 upgrades land with their fixes.
Verified: frozen install (root and all demos) under the strict policy, docs
tsc, build, and the OAuth/SSO/oauth-provider regression suites.
Catches the electron (38.8.6 -> 41.2.2) and @hono/node-server (1.19.11 -> 1.19.14) dep bumps that landed on main after the previous sync commit. Auto-merged without conflicts.
- keep next package versions at 1.7.0-beta.1
- keep both changelog streams by inserting the stable 1.6.5, 1.6.6, and 1.6.7 sections below the 1.7.0-beta entries
- keep the cimd and dash deps on demo/nextjs (next-only); regenerate pnpm-lock.yaml
- resolve TODO(sync-from-main-9226) in oauth-provider authorize.ts: findRegisteredRedirectUri now uses isLoopbackIP from @better-auth/core/utils/host to cover the full 127.0.0.0/8 range per RFC 8252 §7.3
- drop the unused saml import that main's #9262 added to sso/src/routes/sso.ts; next already migrated to saml-pipeline
Resolve the main to next sync discrepancies after the v1.6.4 release.
Conflict resolution:
- keep next package versions at 1.7.0-beta.1
- keep both changelog streams by inserting the stable 1.6.4 sections below the 1.7.0-beta entries
- restore the next pre-release accumulator changesets that the stable release deleted on main
Resolves conflicts in PR #9115 which the release bot cannot auto-merge.
Conflict resolutions:
- .github/workflows/release.yml: take main's hardened grep fallback (92256a2d0)
- docs/content/docs/plugins/sso.mdx: take main's named-exports refactor verbatim (#9144)
- packages/oauth-provider/src/token.ts: keep next's at_hash sequencing (#9079),
add main's customTokenResponseFields spread and credential helper rename (#9118)
- packages/oauth-provider/src/token.test.ts: keep both new describe blocks
(at_hash in id tokens from next, customTokenResponseFields from main)
Semantic fixes on auto-merged files where git silently dropped main's changes
around next's discriminated-response refactor:
- two-factor/index.ts: restore skipVerificationOnEnable handling in the totp
enablement path
- two-factor/types.ts: restore the skipVerificationOnEnable type field
- two-factor/two-factor.test.ts: narrow the discriminated enable response via
method === "totp" guard
Gustavo Valverde
TaesuandGitHub
Pooya ParsaandGitHub
