github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-22 14:21:55 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #9165] [MERGED] chore(adapters): require patched drizzle-orm and kysely peer versions #25380

New Issue
Closed
opened 2026-04-15 22:51:42 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-15 22:51:42 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/9165
Author: @gustavovalverde
Created: 4/14/2026
Status: ✅ Merged
Merged: 4/15/2026
Merged by: @gustavovalverde

Base: main ← Head: chore/tighten-adapter-peerdeps

📝 Commits (2)

  • 5824800 chore(adapters): require patched drizzle-orm and kysely peer versions
  • f516191 Merge branch 'main' into chore/tighten-adapter-peerdeps

📊 Changes

5 files changed (+14 additions, -116 deletions)

View changed files

➕ .changeset/tighten-adapter-peerdeps.md (+9 -0)
📝 packages/better-auth/package.json (+1 -1)
📝 packages/drizzle-adapter/package.json (+1 -1)
📝 packages/kysely-adapter/package.json (+1 -1)
📝 pnpm-lock.yaml (+2 -113)

📄 Description

Narrows the drizzle-orm peer on @better-auth/drizzle-adapter and better-auth to ^0.45.2 (GHSA-gpj5-g38j-94v9), and the kysely peer on @better-auth/kysely-adapter to ^0.28.14 (GHSA-8cpq-38p9-67gx, GHSA-wmrf-hv6w-mr66).

Both ranges track only the minor line that carries the fix, so the adapters advertise support for versions that have actually been tested against. The previous open-top >=0.41.0 for drizzle and dual-major ^0.27 || ^0.28 for kysely lied about compatibility with untested releases.

Adapter code does not reach the vulnerable identifier-escaping, sql.lit, or JSON-path-key paths, so this is a signalling change: consumers on older releases see an unmet-peer warning and can upgrade alongside the adapter. The peer is marked optional, so installs do not hard-fail.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/9165 **Author:** [@gustavovalverde](https://github.com/gustavovalverde) **Created:** 4/14/2026 **Status:** ✅ Merged **Merged:** 4/15/2026 **Merged by:** [@gustavovalverde](https://github.com/gustavovalverde) **Base:** `main` ← **Head:** `chore/tighten-adapter-peerdeps` --- ### 📝 Commits (2) - [`5824800`](https://github.com/better-auth/better-auth/commit/5824800d09c13d042c5e7119ac3c531af15cac32) chore(adapters): require patched drizzle-orm and kysely peer versions - [`f516191`](https://github.com/better-auth/better-auth/commit/f51619193f9334d297e0c10c0e873452ddd1a658) Merge branch 'main' into chore/tighten-adapter-peerdeps ### 📊 Changes **5 files changed** (+14 additions, -116 deletions) <details> <summary>View changed files</summary> ➕ `.changeset/tighten-adapter-peerdeps.md` (+9 -0) 📝 `packages/better-auth/package.json` (+1 -1) 📝 `packages/drizzle-adapter/package.json` (+1 -1) 📝 `packages/kysely-adapter/package.json` (+1 -1) 📝 `pnpm-lock.yaml` (+2 -113) </details> ### 📄 Description Narrows the `drizzle-orm` peer on `@better-auth/drizzle-adapter` and `better-auth` to `^0.45.2` (GHSA-gpj5-g38j-94v9), and the `kysely` peer on `@better-auth/kysely-adapter` to `^0.28.14` (GHSA-8cpq-38p9-67gx, GHSA-wmrf-hv6w-mr66). Both ranges track only the minor line that carries the fix, so the adapters advertise support for versions that have actually been tested against. The previous open-top `>=0.41.0` for drizzle and dual-major `^0.27 || ^0.28` for kysely lied about compatibility with untested releases. Adapter code does not reach the vulnerable identifier-escaping, `sql.lit`, or JSON-path-key paths, so this is a signalling change: consumers on older releases see an unmet-peer warning and can upgrade alongside the adapter. The peer is marked optional, so installs do not hard-fail. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-15 22:51:42 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#25380
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?