github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 15:42:09 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #8838] fix(deps): patch Dependabot security issues #16491

New Issue
Closed
opened 2026-04-13 10:32:29 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-13 10:32:29 -05:00
Owner
Copy Link

Original Pull Request: https://github.com/better-auth/better-auth/pull/8838

State: closed
Merged: Yes

Summary

  • Add pnpm.overrides to resolve 27 of 30 Dependabot security alerts across 7 transitive dependencies
  • The only production-impacting vulnerability (node-forge 1.3.3 → 1.4.0 in @better-auth/sso via samlify) is fixed via override — 4 HIGH CVEs (signature forgery, cert chain bypass, DoS)
  • All other vulnerabilities are dev/test/docs-only (h3, happy-dom, brace-expansion, path-to-regexp, dompurify)
  • Bump mermaid ^11.12.3 → ^11.13.0 in docs (pulls in patched dompurify)
  • Pin samlify to ~2.10.2 — v2.11.0 drops node-forge but introduces breaking changes with encrypted key handling

Overrides added

Package Before → After Severity Scope
node-forge 1.3.3 → 1.4.0 HIGH (4 CVEs) Production (SSO/SAML)
h3 (v1.x) 1.15.5 → 1.15.10 HIGH+MED (4 alerts) Dev only
happy-dom 20.7.0 → 20.8.9 HIGH (2 CVEs) Test only
brace-expansion 1.1.12/2.0.2/5.0.3 → patched MED (8 alerts) Dev tooling
path-to-regexp 8.3.0 → 8.4.0 HIGH+MED (2 true positives) Docs/dev
dompurify 3.3.1 → 3.3.3 MED Docs only

Not addressed (3 alerts)

  • h3 v2 RC + srvx: Pinned by TanStack — needs upstream update
  • serialize-javascript: Deep in vinxi/nitropack chain — needs upstream update
  • esbuild: False positive — installed 0.27.3 already above patched 0.25.0

False positives identified

  • esbuild (#63): Installed version 0.27.3 already patched (old transitive entries from drizzle-kit flagged)
  • path-to-regexp@6.3.0 (2 alerts): Below the vulnerable range (≥8.0.0)

Test plan

  • SSO tests pass (340/340) — critical since node-forge override affects samlify
  • pnpm typecheck passes
  • pnpm lint passes
  • pnpm format:check passes
  • pnpm build passes
  • CI validates full test suite

Summary by cubic

Patch 27 of 30 Dependabot alerts using workspace-level overrides in pnpm-workspace.yaml. Fixes the only production issue by forcing node-forge >=1.4.0 for SSO; others are dev/test/docs-only.

  • Dependencies
    • Consolidated security overrides in pnpm-workspace.yaml (with existing axios pin)
    • Overrides: node-forge >=1.4.0 <2 (prod via @better-auth/sso → samlify), h3@<2: >=1.15.9, happy-dom >=20.8.9 <21, brace-expansion (1.1.13/2.0.3/5.0.5), path-to-regexp@>=8: 8.4.0, dompurify >=3.3.2 <4
    • Bumped mermaid to ^11.13.0 in docs
    • Pinned samlify to ~2.10.2 and added a changeset to release the @better-auth/sso patch
    • Regenerated pnpm-lock.yaml

Written for commit 33792cadd0. Summary will update on new commits.

**Original Pull Request:** https://github.com/better-auth/better-auth/pull/8838 **State:** closed **Merged:** Yes --- ## Summary - Add `pnpm.overrides` to resolve **27 of 30** Dependabot security alerts across 7 transitive dependencies - The only **production-impacting** vulnerability (node-forge 1.3.3 → 1.4.0 in `@better-auth/sso` via samlify) is fixed via override — 4 HIGH CVEs (signature forgery, cert chain bypass, DoS) - All other vulnerabilities are **dev/test/docs-only** (h3, happy-dom, brace-expansion, path-to-regexp, dompurify) - Bump mermaid `^11.12.3` → `^11.13.0` in docs (pulls in patched dompurify) - Pin samlify to `~2.10.2` — v2.11.0 drops node-forge but introduces breaking changes with encrypted key handling ### Overrides added | Package | Before → After | Severity | Scope | |---------|---------------|----------|-------| | node-forge | 1.3.3 → 1.4.0 | HIGH (4 CVEs) | Production (SSO/SAML) | | h3 (v1.x) | 1.15.5 → 1.15.10 | HIGH+MED (4 alerts) | Dev only | | happy-dom | 20.7.0 → 20.8.9 | HIGH (2 CVEs) | Test only | | brace-expansion | 1.1.12/2.0.2/5.0.3 → patched | MED (8 alerts) | Dev tooling | | path-to-regexp | 8.3.0 → 8.4.0 | HIGH+MED (2 true positives) | Docs/dev | | dompurify | 3.3.1 → 3.3.3 | MED | Docs only | ### Not addressed (3 alerts) - **h3 v2 RC + srvx**: Pinned by TanStack — needs upstream update - **serialize-javascript**: Deep in vinxi/nitropack chain — needs upstream update - **esbuild**: False positive — installed 0.27.3 already above patched 0.25.0 ### False positives identified - **esbuild** (#63): Installed version 0.27.3 already patched (old transitive entries from drizzle-kit flagged) - **path-to-regexp@6.3.0** (2 alerts): Below the vulnerable range (≥8.0.0) ## Test plan - [x] SSO tests pass (340/340) — critical since node-forge override affects samlify - [x] `pnpm typecheck` passes - [x] `pnpm lint` passes - [x] `pnpm format:check` passes - [x] `pnpm build` passes - [ ] CI validates full test suite <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Patch 27 of 30 Dependabot alerts using workspace-level overrides in `pnpm-workspace.yaml`. Fixes the only production issue by forcing `node-forge` >=1.4.0 for SSO; others are dev/test/docs-only. - **Dependencies** - Consolidated security overrides in `pnpm-workspace.yaml` (with existing `axios` pin) - Overrides: `node-forge >=1.4.0 <2` (prod via `@better-auth/sso` → `samlify`), `h3@<2: >=1.15.9`, `happy-dom >=20.8.9 <21`, `brace-expansion` (`1.1.13`/`2.0.3`/`5.0.5`), `path-to-regexp@>=8: 8.4.0`, `dompurify >=3.3.2 <4` - Bumped `mermaid` to `^11.13.0` in docs - Pinned `samlify` to `~2.10.2` and added a changeset to release the `@better-auth/sso` patch - Regenerated `pnpm-lock.yaml` <sup>Written for commit 33792cadd0e4a4dedcdae7490c0876ac13bfb81c. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. -->
GiteaMirror added the pull-request label 2026-04-13 10:32:29 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#16491
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?