github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 23:52:05 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #9168] chore(demo): pin patched versions in demo lockfiles #25383

New Issue
Open
opened 2026-04-15 22:51:46 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-15 22:51:46 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/9168
Author: @gustavovalverde
Created: 4/14/2026
Status: 🔄 Open

Base: main ← Head: chore/demo-vulnerability-overrides

📝 Commits (1)

  • 1716544 chore(demo): pin patched versions in demo lockfiles

📊 Changes

8 files changed (+902 additions, -770 deletions)

View changed files

📝 demo/electron/package.json (+7 -1)
📝 demo/electron/pnpm-lock.yaml (+49 -24)
📝 demo/expo/package.json (+7 -0)
📝 demo/expo/pnpm-lock.yaml (+26 -21)
📝 demo/nextjs/package.json (+9 -1)
📝 demo/nextjs/pnpm-lock.yaml (+44 -38)
📝 demo/oidc-client/package.json (+5 -0)
📝 demo/oidc-client/pnpm-lock.yaml (+755 -685)

📄 Description

Each demo under demo/* keeps its own pnpm-lock.yaml and is never published, so the workspace overrides in pnpm-workspace.yaml do not reach them. This PR adds per-demo pnpm.overrides (and two direct dep bumps) so the demo lockfiles resolve to patched versions for every Dependabot-flagged transitive.

Changes:

  • demo/electron: electron devDep to ^39.8.1 (GHSA-532v-xpq5-8h95). Overrides for @xmldom/xmldom >=0.8.12 (GHSA-wh4c-j3r5-mjhp) and tar >=7.5.11 (GHSA-9ppj-qmqm-q256, GHSA-qffp-2rhf-9h96), both pulled by electron-builder tooling.
  • demo/expo: overrides for node-forge >=1.4.0 (four advisories), picomatch@>=4 >=4.0.4 (GHSA-c2c7-rcm5-vvqj), and @xmldom/xmldom >=0.8.12. The 2.x branch of picomatch is pinned by micromatch and cannot be overridden without breaking it; upstream fix pending.
  • demo/nextjs: kysely direct dep to ^0.28.14 (GHSA-8cpq-38p9-67gx, GHSA-wmrf-hv6w-mr66). Overrides for path-to-regexp >=8.4.0 (GHSA-j3q9-mxjg-w52f), hono >=4.12.4 (GHSA-q5qw-h33p-qvwr), @hono/node-server >=1.19.10 (GHSA-wc8c-qw6v-h7f6), and express-rate-limit >=8.2.2 (GHSA-46wh-pxpv-q5gq).
  • demo/oidc-client: override for next ^16.2.3 (GHSA-q4gf-8mx6-v5v3), pulled transitively via geist.

Install succeeds for all four demos; lockfile resolutions confirmed to pick the overridden versions. Two pre-existing demo typecheck failures (@better-auth/dash d.mts parse, oauth4webapi API drift) exist on main too and are out of scope.

Summary by cubic

Pins patched versions in each demo by adding per-app pnpm.overrides and bumping two direct deps, so their isolated lockfiles resolve to patched transitives and keep vulnerability scans clean.

  • Dependencies
    • demo/electron: bump electron to ^39.8.1; overrides @xmldom/xmldom >=0.8.12, tar >=7.5.11.
    • demo/expo: overrides node-forge >=1.4.0, picomatch@>=4 >=4.0.4, @xmldom/xmldom >=0.8.12 (note: micromatch pins picomatch@2, can’t override that branch yet).
    • demo/nextjs: bump kysely to ^0.28.14; overrides path-to-regexp >=8.4.0, hono >=4.12.4, @hono/node-server >=1.19.10, express-rate-limit >=8.2.2.
    • demo/oidc-client: override next ^16.2.3 (pulled via geist).

Written for commit 17165440af. Summary will update on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/9168 **Author:** [@gustavovalverde](https://github.com/gustavovalverde) **Created:** 4/14/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `chore/demo-vulnerability-overrides` --- ### 📝 Commits (1) - [`1716544`](https://github.com/better-auth/better-auth/commit/17165440af1fe2f290079785e8d8d794dc3f2912) chore(demo): pin patched versions in demo lockfiles ### 📊 Changes **8 files changed** (+902 additions, -770 deletions) <details> <summary>View changed files</summary> 📝 `demo/electron/package.json` (+7 -1) 📝 `demo/electron/pnpm-lock.yaml` (+49 -24) 📝 `demo/expo/package.json` (+7 -0) 📝 `demo/expo/pnpm-lock.yaml` (+26 -21) 📝 `demo/nextjs/package.json` (+9 -1) 📝 `demo/nextjs/pnpm-lock.yaml` (+44 -38) 📝 `demo/oidc-client/package.json` (+5 -0) 📝 `demo/oidc-client/pnpm-lock.yaml` (+755 -685) </details> ### 📄 Description Each demo under `demo/*` keeps its own `pnpm-lock.yaml` and is never published, so the workspace overrides in `pnpm-workspace.yaml` do not reach them. This PR adds per-demo `pnpm.overrides` (and two direct dep bumps) so the demo lockfiles resolve to patched versions for every Dependabot-flagged transitive. Changes: - `demo/electron`: `electron` devDep to `^39.8.1` (GHSA-532v-xpq5-8h95). Overrides for `@xmldom/xmldom >=0.8.12` (GHSA-wh4c-j3r5-mjhp) and `tar >=7.5.11` (GHSA-9ppj-qmqm-q256, GHSA-qffp-2rhf-9h96), both pulled by `electron-builder` tooling. - `demo/expo`: overrides for `node-forge >=1.4.0` (four advisories), `picomatch@>=4 >=4.0.4` (GHSA-c2c7-rcm5-vvqj), and `@xmldom/xmldom >=0.8.12`. The 2.x branch of `picomatch` is pinned by `micromatch` and cannot be overridden without breaking it; upstream fix pending. - `demo/nextjs`: `kysely` direct dep to `^0.28.14` (GHSA-8cpq-38p9-67gx, GHSA-wmrf-hv6w-mr66). Overrides for `path-to-regexp >=8.4.0` (GHSA-j3q9-mxjg-w52f), `hono >=4.12.4` (GHSA-q5qw-h33p-qvwr), `@hono/node-server >=1.19.10` (GHSA-wc8c-qw6v-h7f6), and `express-rate-limit >=8.2.2` (GHSA-46wh-pxpv-q5gq). - `demo/oidc-client`: override for `next ^16.2.3` (GHSA-q4gf-8mx6-v5v3), pulled transitively via `geist`. Install succeeds for all four demos; lockfile resolutions confirmed to pick the overridden versions. Two pre-existing demo typecheck failures (`@better-auth/dash` d.mts parse, `oauth4webapi` API drift) exist on `main` too and are out of scope. <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Pins patched versions in each demo by adding per-app `pnpm.overrides` and bumping two direct deps, so their isolated lockfiles resolve to patched transitives and keep vulnerability scans clean. - **Dependencies** - `demo/electron`: bump `electron` to `^39.8.1`; overrides `@xmldom/xmldom >=0.8.12`, `tar >=7.5.11`. - `demo/expo`: overrides `node-forge >=1.4.0`, `picomatch@>=4 >=4.0.4`, `@xmldom/xmldom >=0.8.12` (note: `micromatch` pins `picomatch@2`, can’t override that branch yet). - `demo/nextjs`: bump `kysely` to `^0.28.14`; overrides `path-to-regexp >=8.4.0`, `hono >=4.12.4`, `@hono/node-server >=1.19.10`, `express-rate-limit >=8.2.2`. - `demo/oidc-client`: override `next ^16.2.3` (pulled via `geist`). <sup>Written for commit 17165440af1fe2f290079785e8d8d794dc3f2912. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-15 22:51:46 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#25383
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?