Reconcile pnpm-lock.yaml (root) and demo/nextjs/pnpm-lock.yaml with the merged
package.json and pnpm-workspace.yaml overrides: next's workspace versions plus
main's security bumps (samlify 2.13.1, fast-xml-parser 5.8.0) and the #9820
transitive-version overrides. demo/nextjs is a standalone pnpm project whose
lockfile was resolved to next's during the merge while its workspace took
main's overrides, so it is regenerated to match.
Two root overrides pin dependencies to next's working versions:
- kysely 0.28.17 (main's resolved version). The catalog range permits 0.29,
but kysely 0.29's ESM build dropped the migration-table exports the
kysely-adapter node:sqlite introspector imports, breaking table discovery.
- zod 4.x to 4.3.6. better-call's zod peer otherwise resolves to 4.4.3, which
produces a third zod copy that makes the docs app resolve zod to the 3.x
line and fails react-hook-form's zodResolver type check.
main reaches these versions through its release-age policy; next pins them
explicitly because that policy does not resolve in every environment. Remove
the pins once the kysely 0.29 and zod 4.4 upgrades land with their fixes.
Verified: frozen install (root and all demos) under the strict policy, docs
tsc, build, and the OAuth/SSO/oauth-provider regression suites.
Sync main (through #9821/#9820/#9822/#9768) into next. Conflicting
package.json files keep next's version and intentional divergences (for
example the cli's c12 v4) while taking main's dependency updates, including
the samlify 2.13.1 and fast-xml-parser security bumps; the lockfile is
regenerated from the reconciled set. The 13 source/doc/test conflicts take
next's refactored architecture as the baseline; main's colliding fixes are
re-applied on top in the following per-domain commits.
Clean main fixes land via this merge, including the auto-restored
account-takeover defenses #9578 and #9577.
- keep next package versions at 1.7.0-beta.1
- keep both changelog streams by inserting the stable 1.6.5, 1.6.6, and 1.6.7 sections below the 1.7.0-beta entries
- keep the cimd and dash deps on demo/nextjs (next-only); regenerate pnpm-lock.yaml
- resolve TODO(sync-from-main-9226) in oauth-provider authorize.ts: findRegisteredRedirectUri now uses isLoopbackIP from @better-auth/core/utils/host to cover the full 127.0.0.0/8 range per RFC 8252 §7.3
- drop the unused saml import that main's #9262 added to sso/src/routes/sso.ts; next already migrated to saml-pipeline
Resolves conflicts in PR #9115 which the release bot cannot auto-merge.
Conflict resolutions:
- .github/workflows/release.yml: take main's hardened grep fallback (92256a2d0)
- docs/content/docs/plugins/sso.mdx: take main's named-exports refactor verbatim (#9144)
- packages/oauth-provider/src/token.ts: keep next's at_hash sequencing (#9079),
add main's customTokenResponseFields spread and credential helper rename (#9118)
- packages/oauth-provider/src/token.test.ts: keep both new describe blocks
(at_hash in id tokens from next, customTokenResponseFields from main)
Semantic fixes on auto-merged files where git silently dropped main's changes
around next's discriminated-response refactor:
- two-factor/index.ts: restore skipVerificationOnEnable handling in the totp
enablement path
- two-factor/types.ts: restore the skipVerificationOnEnable type field
- two-factor/two-factor.test.ts: narrow the discriminated enable response via
method === "totp" guard
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Alex Yang <himself65@outlook.com>
Gustavo Valverde
Alex YangandGitHub
Bereket EngidaandGitHub
Joél SolanoandGitHub
Carlos Eduardo MedimandGitHub
Bereket Engida