mirror of
https://github.com/better-auth/better-auth.git
synced 2026-07-26 02:16:23 -05:00
Gustavo Valverde
a99a331376
Reconcile pnpm-lock.yaml (root) and demo/nextjs/pnpm-lock.yaml with the merged package.json and pnpm-workspace.yaml overrides: next's workspace versions plus main's security bumps (samlify 2.13.1, fast-xml-parser 5.8.0) and the #9820 transitive-version overrides. demo/nextjs is a standalone pnpm project whose lockfile was resolved to next's during the merge while its workspace took main's overrides, so it is regenerated to match. Two root overrides pin dependencies to next's working versions: - kysely 0.28.17 (main's resolved version). The catalog range permits 0.29, but kysely 0.29's ESM build dropped the migration-table exports the kysely-adapter node:sqlite introspector imports, breaking table discovery. - zod 4.x to 4.3.6. better-call's zod peer otherwise resolves to 4.4.3, which produces a third zod copy that makes the docs app resolve zod to the 3.x line and fails react-hook-form's zodResolver type check. main reaches these versions through its release-age policy; next pins them explicitly because that policy does not resolve in every environment. Remove the pins once the kysely 0.29 and zod 4.4 upgrades land with their fixes. Verified: frozen install (root and all demos) under the strict policy, docs tsc, build, and the OAuth/SSO/oauth-provider regression suites.