[dependabot]

Bumps the npm-deps group with 10 updates in the / directory:

Package	From	To
@better-auth/oauth-provider	1.7.7	1.7.14
@hono/node-server	2.1.4	2.1.5
better-auth	1.7.7	1.7.14
hono	4.13.13	4.13.14
@commitlint/cli	21.2.3	21.2.4
@commitlint/config-conventional	21.2.3	21.2.4
@playwright/test	1.64.0	1.64.1
eslint	10.12.0	10.13.0
fallow	3.32.0	3.37.0
prettier	3.9.9	3.9.10

Updates @better-auth/oauth-provider from 1.7.7 to 1.7.14

Release notes

Sourced from @​better-auth/oauth-provider's releases.

v1.7.14

better-auth

Bug Fixes

• Fixed two-factor TOTP to accept imported Base32 secrets stored as base32:<secret> (#12031)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed Kakao sign-in to forward loginHint so the Kakao Account login page opens with the ID field prefilled (#12045)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​bytaesu, @​honuuk

Full changelog: v1.7.13...v1.7.14

v1.7.13

better-auth

Bug Fixes

• Fixed type declarations so type-only exports are no longer listed as values, making a value import fail type checking instead of failing at runtime (#11985)

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added token endpoint authentication options to the Vercel social provider, including dynamic OIDC tokens and private key JWT client assertions, without replacing the built-in sign-in flow (#11948)

Bug Fixes

• Added tokenEndpointAuth: { method } to the Cloudflare provider and deprecated tokenEndpointAuthMethod, which remains supported (#11997)

For detailed changes, see CHANGELOG

@better-auth/stripe

Features

... (truncated)

Changelog

Sourced from @​better-auth/oauth-provider's changelog.

1.7.14

1.7.13

1.7.12

1.7.11

Patch Changes

• #11830 a1f6f0b Thanks @​gustavovalverde! - Apps using the CIMD plugin no longer lose an administrator's change to a discovered client when a metadata refresh is running at the same time. Before, disabling the client, setting skipConsent or enableEndSession, or assigning client_credentials scopes while its document was being fetched could be undone by the refresh. No action is needed.

• #10881 37debaa Thanks @​sahiljagtap08! - Corrected the OpenAPI response schemas for /oauth2/consent and /oauth2/continue to describe { redirect: true, url: string }, so generated clients no longer expect a nonexistent redirect_uri field. Runtime responses are unchanged.

1.7.10

Patch Changes

• #11786 cdd491b Thanks @​gustavovalverde! - DPoP proofs are accepted again for two setups that broke in v1.7.9:

  • Plugin endpoints with route params, such as /extension/:tenant/token, that issue tokens with a DPoP proof. A valid proof for /extension/acme/token was rejected with invalid_dpop_proof, because the expected htu contained the literal :tenant.
  • Token and UserInfo requests to a URL with a trailing slash, such as /api/auth/oauth2/token/, when advanced.skipTrailingSlashes is on. The proof was rejected because the expected htu dropped the slash.

  The expected htu still takes its origin and base path from baseURL, so keep baseURL set to the public URL clients call. Other setups are unaffected.

• #11815 44f14bb Thanks @​gustavovalverde! - Device-code clients that request offline_access and poll the token endpoint for only some of the RFC 8707 resources the user approved can now refresh for any approved resource. Previously, a refresh for an approved resource left out of the poll failed with invalid_target. Device codes polled without resource, or for every approved resource, are unaffected.

• #11695 fe550a9 Thanks @​gustavovalverde! - Confidential private_key_jwt clients that register inline jwks can now replace their own signing keys without a user session. Until now those keys were fixed at registration. The feature is off by default; set allowClientKeyRotation: true to enable it. No database migration is needed, but the provider refuses to start with it enabled on the memory adapter or with advanced.database.generateId: "serial", because neither enforces single-use client assertions.

  The client calls POST /oauth2/client/rotate-keys with its complete new jwks and a client assertion signed by one of its current keys, whose aud includes the rotation endpoint's URL. An assertion addressed only to the token endpoint or the issuer is rejected. Keys left out of the new set stop working at once, so roll a key in two steps: send the old and new keys together, then drop the old key once every instance signs with the new one.

• #11801 99cdfe7 Thanks @​gustavovalverde! - If postLogin.consentReferenceId returns no reference for some authorizations (for example, it returns an organization ID only for organization scopes), consent is now kept separate per reference. Approving consent without a reference no longer overwrites the consent stored for an organization, and an authorization without a reference no longer skips the consent prompt because the user consented under an organization. Previously, approving read write without a reference could replace an organization's stored read consent, so later authorizations for that organization were granted write without asking. For new authorizations, an empty string is treated the same as no reference, including the referenceId passed to token claim callbacks.

  Users may see the consent prompt once for authorizations that were previously approved through another reference's consent. Until they do, silent (prompt=none) authorizations in these setups return consent_required. Consent overwritten before this release is not repaired; users can review or revoke it through the consent management endpoints. Setups that never configured consentReferenceId, or that always return a reference, are unaffected.

• #11797 906c32f Thanks @​gustavovalverde! - If you enable dynamic client registration, Claude's MCP connector can now register. It requests urn:ietf:params:oauth:grant-type:jwt-bearer along with authorization_code and refresh_token, and Better Auth rejected the whole registration with invalid_client_metadata because one grant was unsupported. Dynamic registration now keeps the requested grants the server supports and lists them in the registration response. A request that shares no grant with the server is still rejected. Clients created with createOAuthClient or adminCreateOAuthClient still reject unsupported grants.

• #11798 2fa7e2f Thanks @​gustavovalverde! - With clientRegistrationDefaultApplicationType: "infer", clients that register an http callback on localhost, 127.0.0.1, or [::1] without application_type now register as native. This includes older Claude Code releases, which register http://127.0.0.1:<port>/callback. Current Claude Code releases send application_type: "native" and were not affected. Before, "infer" chose native only for callbacks whose scheme is not http or https, so these registrations were treated as web and rejected with invalid_redirect_uri. The "web" default and the "native" setting are unchanged, and an application_type the client sends is never overridden.

• #11176 8f3da46 Thanks @​Bekacru! - The token endpoint now returns invalid_client instead of invalid_grant when a request names a client_id that is not registered, for the authorization_code, refresh_token, and device code grants. MCP clients whose registration was deleted, for example by a database reset or an upgrade that dropped OAuth tables, now register again and prompt the user to sign in. Before, they kept the deleted client_id and stayed signed out until the user cleared their saved credentials by hand. A registered client that sends wrong credentials also gets invalid_client now, even when its code or refresh token is also invalid.

• #11596 963b7f9 Thanks @​mahoor! - /oauth2/userinfo, /oauth2/introspect and /oauth2/revoke now answer a JWT that fails verification the way they answer any unknown token. Before, they returned an empty 500. This covers an alg: none token, a tampered signature, an unknown kid and a wrong issuer: userinfo returns 401 invalid_token with a WWW-Authenticate challenge, introspection returns { "active": false }, and revocation returns its unknown-token error. Valid JWT and opaque access tokens are unaffected, including JWT-shaped tokens issued by generateOpaqueAccessToken.

  If you set disableJwtPlugin: true, a JWT-shaped token that is not a stored access token, such as an ID token, now gets the same unknown-token response instead of a 500.

  A key set the server cannot use, such as one where two keys share a kid, still returns 500.

• #11781 e34b828 Thanks @​gustavovalverde! - If you configure cachedTrustedClients, attempts to update, delete, or rotate the secret of one of those clients through the client management endpoints now fail with HTTP 400 instead of 500. The response body is unchanged (error: "invalid_client"), so only code that branches on the status code is affected. A 500 previously made a deliberate refusal look like a server failure.

• #11799 f42c0c2 Thanks @​gustavovalverde! - Requests that name a client_id the server does not know now fail with error_description set to client not found. Before, /oauth2/authorize said client_id is required, which read as a missing parameter, /oauth2/token, /oauth2/revoke, and /oauth2/introspect said missing client, and requests that authenticate with a private_key_jwt client assertion said unknown client. You would see this, for example, when an MCP client kept a registration the server had deleted. The invalid_client error code is unchanged.

... (truncated)

Commits

• a936663 chore: release v1.7.14 (#12055)
• 7f61081 chore: release v1.7.13 (#11994)
• f4260a9 chore: release v1.7.12 (#11922)
• 52ab801 chore: release v1.7.11 (#11827)
• a1f6f0b fix(oauth-provider): keep admin changes made during a CIMD refresh (#11830)
• 37debaa fix(oauth-provider): correct consent and continue OpenAPI response schemas (#...
• b734a41 chore: release v1.7.10 (#11795)
• 61c913d fix(oauth-provider): report an unknown client in a client assertion as not fo...
• 4d7da0b fix(oauth-provider): return 400 invalid_grant on PKCE verifier mismatch (#11724)
• 8f3da46 fix(oauth-provider): return invalid_client for an unknown client at the token...
• Additional commits viewable in compare view

Updates @hono/node-server from 2.1.4 to 2.1.5

Release notes

Sourced from @​hono/node-server's releases.

v2.1.5

What's Changed

• fix(listener): abort the request signal when an HTTP/2 client resets the stream by @​affanmomin in honojs/node-server#404
• fix(serve-static): only serve GET and HEAD requests by @​usualoma in honojs/node-server#405

New Contributors

• @​affanmomin made their first contribution in honojs/node-server#404

Full Changelog: honojs/node-server@v2.1.4...v2.1.5

Commits

• 4b47a0d 2.1.5
• e77824a fix(serve-static): only serve GET and HEAD requests (#405)
• 1b6e6bf fix(listener): abort the request signal when an HTTP/2 client resets the stre...
• See full diff in compare view

Updates better-auth from 1.7.7 to 1.7.14

Release notes

Sourced from better-auth's releases.

v1.7.14

better-auth

Bug Fixes

• Fixed two-factor TOTP to accept imported Base32 secrets stored as base32:<secret> (#12031)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed Kakao sign-in to forward loginHint so the Kakao Account login page opens with the ID field prefilled (#12045)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​bytaesu, @​honuuk

Full changelog: v1.7.13...v1.7.14

v1.7.13

better-auth

Bug Fixes

• Fixed type declarations so type-only exports are no longer listed as values, making a value import fail type checking instead of failing at runtime (#11985)

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added token endpoint authentication options to the Vercel social provider, including dynamic OIDC tokens and private key JWT client assertions, without replacing the built-in sign-in flow (#11948)

Bug Fixes

• Added tokenEndpointAuth: { method } to the Cloudflare provider and deprecated tokenEndpointAuthMethod, which remains supported (#11997)

For detailed changes, see CHANGELOG

@better-auth/stripe

Features

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.14

Patch Changes

• #12031 d2cb7f5 Thanks @​bytaesu! - Two-factor TOTP now accepts imported Base32 secrets stored as base32:<secret>.

• Updated dependencies [2947ab7]:

  • @​better-auth/core@​1.7.14
  • @​better-auth/drizzle-adapter@​1.7.14
  • @​better-auth/kysely-adapter@​1.7.14
  • @​better-auth/memory-adapter@​1.7.14
  • @​better-auth/mongo-adapter@​1.7.14
  • @​better-auth/prisma-adapter@​1.7.14
  • @​better-auth/telemetry@​1.7.14

1.7.13

Patch Changes

• #11985 9cb95fe Thanks @​bytaesu! - Type declarations no longer list type-only exports as values, so importing one as a value now fails type checking instead of failing at runtime.

• Updated dependencies [2712441, 1cf4b2c]:

  • @​better-auth/core@​1.7.13
  • @​better-auth/drizzle-adapter@​1.7.13
  • @​better-auth/kysely-adapter@​1.7.13
  • @​better-auth/memory-adapter@​1.7.13
  • @​better-auth/mongo-adapter@​1.7.13
  • @​better-auth/prisma-adapter@​1.7.13
  • @​better-auth/telemetry@​1.7.13

1.7.12

Patch Changes

• #11925 fb48619 Thanks @​bytaesu! - The JWT plugin now verifies JWTs and session cookie-cache JWTs with the algorithm of the stored key instead of the one named in the token header, and logs a warning when it signs or verifies a JWT without an issuer or audience.

• #11924 681aa5c Thanks @​bytaesu! - auth.api.getSession() now keeps the original database error as error.cause when the session lookup fails, so server code can tell a transient failure from a bug.

• #11930 b18e3b8 Thanks @​bytaesu! - OAuth callbacks completed through the OAuth proxy now run the same checks as the standard OAuth callback, including issuer and ID token nonce validation.

• Updated dependencies [681aa5c, 4bc78ba, 876608d, 083a743, 492134a]:

  • @​better-auth/core@​1.7.12
  • @​better-auth/drizzle-adapter@​1.7.12
  • @​better-auth/kysely-adapter@​1.7.12
  • @​better-auth/memory-adapter@​1.7.12
  • @​better-auth/mongo-adapter@​1.7.12
  • @​better-auth/prisma-adapter@​1.7.12
  • @​better-auth/telemetry@​1.7.12

1.7.11

... (truncated)

Commits

• a936663 chore: release v1.7.14 (#12055)
• d2cb7f5 fix(two-factor): accept imported Base32 TOTP secrets (#12031)
• 7f61081 chore: release v1.7.13 (#11994)
• ea3cbfd docs(organization): addMember requires userId (#12007)
• 2712441 refactor(cloudflare): standardize token endpoint auth options (#11997)
• 1cf4b2c feat(vercel): support token endpoint authentication strategies (#11948)
• 7a1ecde chore(deps): bump next to 16.4.2 (#11976)
• f4260a9 chore: release v1.7.12 (#11922)
• b18e3b8 fix(oauth-proxy): run the standard callback checks on proxied callbacks (#11930)
• fb48619 fix(jwt): verify tokens with the stored key's algorithm (#11925)
• Additional commits viewable in compare view

Updates hono from 4.13.13 to 4.13.14

Release notes

Sourced from hono's releases.

v4.13.14

What's Changed

• docs(contributing): ask for issues instead of RPs honojs/hono#5526
• docs(readme): sync the contributing list with CONTRIBUTING.md honojs/hono#5527
• fix(adapters): accept Hono v5 prereleases in the hono peer range honojs/hono#5537
• chore: unified oxfmt and oxlint config honojs/hono#5518
• docs(readme): remove the deepwiki badge honojs/hono#5548
• fix(serve-static): only serve GET and HEAD requests honojs/hono#5514
• fix(build): keep barrel imports in the bundled d.ts honojs/hono#5557
• fix(jsx): preserve self-closing void elements in cloneElement honojs/hono#5314
• fix(css): keep "//" inside an unquoted url() when minifying honojs/hono#5450
• fix(css): keep the descendant combinator before a pseudo-class when minifying honojs/hono#5451
• fix(serve-static): respect q-values in Accept-Encoding for precompressed files honojs/hono#5436
• fix(helper/route): match regex params in basePath() the same way as the router honojs/hono#5498
• fix(trie-router): keep first value for duplicate path params honojs/hono#5423
• fix(hono-base): disallow getPath when strict is false honojs/hono#5563
• fix(css): Fix multiline CSS handling in style replacement honojs/hono#5405
• feat(bearer-auth): allow MessageFunction to return a Response honojs/hono#5269
• fix(utils/url): preserve encoded duplicate query order honojs/hono#5495

Full Changelog: honojs/hono@v4.13.13...v4.13.14

Commits

• bac5c4a 4.13.14
• eb78eca fix(utils/url): preserve encoded duplicate query order (#5495)
• 06a45bc feat(bearer-auth): allow MessageFunction to return a Response (#5269)
• 5ca49b0 fix(css): Fix multiline CSS handling in style replacement (#5405)
• e9c0107 fix(hono-base): disallow getPath when strict is false (#5563)
• 08807ce fix(trie-router): keep first value for duplicate path params (#5422) (#5423)
• e77c7c8 fix(helper/route): match regex params in basePath() the same way as the route...
• d54720d fix(serve-static): respect q-values in Accept-Encoding for precompressed file...
• ae401f0 fix(css): keep the descendant combinator before a pseudo-class when minifying...
• 2013fed fix(css): keep "//" inside an unquoted url() when minifying (#5450)
• Additional commits viewable in compare view

Updates @commitlint/cli from 21.2.3 to 21.2.4

Release notes

Sourced from @​commitlint/cli's releases.

v21.2.4

21.2.4 (2026-10-18)

Bug Fixes

• fix(load): replace config file arrays with seed arrays by @​escapedcat in conventional-changelog/commitlint#5056
• fix: update dependency jsonc to v3 by @​renovate[bot] in conventional-changelog/commitlint#5020

Performance Improvements

• perf(load): load typescript configs with jiti directly by @​escapedcat in conventional-changelog/commitlint#5052

Docs, etc

• docs: add AGENTS.md with commit type guidance by @​escapedcat in conventional-changelog/commitlint#5053
• test(ensure): pin case conversion of digits, punctuation and accents by @​escapedcat in conventional-changelog/commitlint#5055

Full Changelog: conventional-changelog/commitlint@v21.2.3...v21.2.4

Changelog

Sourced from @​commitlint/cli's changelog.

21.2.4 (2026-10-18)

Note: Version bump only for package @​commitlint/cli

Commits

• d8e3656 v21.2.4
• See full diff in compare view

Updates @commitlint/config-conventional from 21.2.3 to 21.2.4

Release notes

Sourced from @​commitlint/config-conventional's releases.

v21.2.4

21.2.4 (2026-10-18)

Bug Fixes

• fix(load): replace config file arrays with seed arrays by @​escapedcat in conventional-changelog/commitlint#5056
• fix: update dependency jsonc to v3 by @​renovate[bot] in conventional-changelog/commitlint#5020

Performance Improvements

• perf(load): load typescript configs with jiti directly by @​escapedcat in conventional-changelog/commitlint#5052

Docs, etc

• docs: add AGENTS.md with commit type guidance by @​escapedcat in conventional-changelog/commitlint#5053
• test(ensure): pin case conversion of digits, punctuation and accents by @​escapedcat in conventional-changelog/commitlint#5055

Full Changelog: conventional-changelog/commitlint@v21.2.3...v21.2.4

Changelog

Sourced from @​commitlint/config-conventional's changelog.

21.2.4 (2026-10-18)

Note: Version bump only for package @​commitlint/config-conventional

Commits

• d8e3656 v21.2.4
• See full diff in compare view

Updates @playwright/test from 1.64.0 to 1.64.1

Release notes

Sourced from @​playwright/test's releases.

v1.64.1

Bug Fixes

• #43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
• #43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

Commits

• cfe490d cherry-pick(#43353): docs: release notes for v1.64 Python
• 866cbb8 chore: mark v1.64.1 (#43354)
• 1b29247 cherry-pick(#43250): fix(electron): do not drop windows that have not navigat...
• 632d976 cherry-pick(#43249): fix(chromium): disable AvoidCorsURLLoaderRestartOnRedirect
• 824d0c5 cherry-pick(#43217): chore(dotnet): fix async suffix of optional-arg overload...
• See full diff in compare view

Updates eslint from 10.12.0 to 10.13.0

Release notes

Sourced from eslint's releases.

v10.13.0

Features

• 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238) (Irfan fandi)
• a39d9fb feat: add globalThis to no-obj-calls (#21382) (synthex-byte)
• 66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#21399) (xbinaryx)

Bug Fixes

• 87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#21389) (Daniel Pinto)

Documentation

• 4783a68 docs: Update README (GitHub Actions Bot)
• 43f0ac9 docs: clarify parameter description in getText (#21287) (lumir)

Chores

• b59d889 chore: update github/codeql-action action to v4.38.3 (#21412) (renovate[bot])
• 95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410) (Francesco Trotta)
• 317fcb3 chore: update ecosystem plugins (#21409) (ESLint Bot)
• b92decf perf: skip no-redeclare scan for single-declaration variables (#21365) (James Ross)
• 47b7063 chore: update dependency @​eslint/json to ^2.1.1 (#21398) (renovate[bot])
• e5aea41 chore: update ecosystem plugins (#21390) (ESLint Bot)

Commits

• 4637f98 10.13.0
• 96df05c Build: changelog update for 10.13.0
• 4783a68 docs: Update README
• b59d889 chore: update github/codeql-action action to v4.38.3 (#21412)
• 95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410)
• 317fcb3 chore: update ecosystem plugins (#21409)
• 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238)
• 43f0ac9 docs: clarify parameter description in getText (#21287)
• a39d9fb feat: add globalThis to no-obj-calls (#21382)
• b92decf perf: skip no-redeclare scan for single-declaration variables (#21365)
• Additional commits viewable in compare view

Updates fallow from 3.32.0 to 3.37.0

Release notes

Sourced from fallow's releases.

v3.37.0: resumable mutation runs, CSS classes from template files, and signed Windows binaries

Features

• fallow health --css reads server-side template files as class references. Fallow now reads .liquid, .njk, .hbs, .handlebars, .twig and .blade.php files, and each class-like word in them counts as used. A class that only a Shopify Liquid section applies is no longer an unreferenced-css-class. A class prefix before a {{ echo, as in grid--{{ columns }}, also counts. The {{ rule also applies to .vue, .html, .md and .astro sources with dynamic class syntax, so these sources can report fewer classes. Use the new top-level markupExtensions key to add other template extensions, for example ["tpl", "erb"]. These files do not join source discovery, so they never become unused files. Thanks @​james2doyle for the report. (#3917)

• The npm package now ships rule-pack-schema.json. Point the $schema of a rule pack at ./node_modules/fallow/rule-pack-schema.json to get a schema that matches the installed version. The package also exports the file as fallow/rule-pack-schema.json. Thanks @​hckhanh for the report and @​tahodev for the change. (#3851)

• An interrupted fallow mutation run keeps its finished results, and --resume continues it. Each run writes each killed and retry-confirmed survived mutant to .fallow/mutation/journal.jsonl when its result is final, also with --no-cache. fallow mutation --resume reuses these results and runs only the other mutants. When the journal comes from other inputs, the run exits 2 with FALLOW_MUTATION_RESUME_MISMATCH and names each input that differs. A resumed mutant has resumed: true, and the report has a resume object. A complete run removes the journal, and a partial run keeps it. (#3783)

Changed

• A bare machine run that exits 0 on a failing gate now says so on stderr. Bare fallow in a machine format exits 0 on findings, but fallow dead-code --format json exits 1 on the same findings. Before, nothing showed why. Now the run prints one stderr line, also under --quiet, that names each failing findings gate and the flag that enforces it. The exit code and stdout do not change. Thanks @​Smrtnyk for the report. (#3826)

• The exit-code contract no longer says that exit 0 means a clean run. fallow schema (exit_codes), the fallow skill and the npm README now say that 0 means no enforced gate failed. Exit 1 means findings, not a tool failure. A bare machine run gates on findings only with --fail-on-issues. To see a failing gate that did not set the exit code, read gate_outcomes.

• fallow mutation gives no mutant for a pure condition whose only effect is a logging call. An if statement such as if (count > 0) { console.info("Items", count); } no longer gives mutants. The condition must be pure, and each branch must hold only console.* or debug(...) calls with pure arguments. In a file that declares or imports console or debug, the conditions that call that name keep their mutants. (#3719)

Bug fixes

• thin-wrapper and duplicate-prop-shape set to error now fail the gates. At error, these rules count in issue totals, the dead-code and audit gates, and CI reports. A rule at warn does not fail a gate, also with --fail-on-issues. Thanks @​luciocabrera for the report. (#3867)

• A CommonJS postcss.config.cjs no longer reports its module.exports keys as unused exports. When a plugin credits only default for a CommonJS module, Fallow now credits every key of module.exports. The fix applies to the CommonJS config files of all plugins that read the default export. Thanks @​waldoluisribeiro for the report. (#3876)

• fallow security resolves a string enum member in the same module. Fallow no longer reports a template literal such as `<meta name="${MetaName.BUILD_NUMBER}">` that goes to an HTML sink as non-literal HTML. Enums and constants that you import from another module stay unresolved. The first run after the update parses all files again. Thanks @​Smrtnyk for the report. (#3854)

• Component export queries no longer stop type-aware refinement for the whole run. Fallow now gives Vue, Astro, Svelte and MDX query files an unsupported-syntax abstention. Supported TypeScript and JavaScript queries in the same batch continue to resolve. (#3763)

• fallow dead-code follows child_process.fork targets built from the module directory. A file that fork(path.join(path.dirname(fileURLToPath(import.meta.url)), "child.ts")) starts is no longer an unused file. path.resolve, __dirname, import.meta.dirname and a constant that holds the module directory also work. Thanks @​VariableVince for the report. (#3919)

• Fallow now reads config values from a same-file constant. A config can keep part of its value in a top-level constant, for example projects: [UNIT]. Fallow now uses the value of the constant, so the setup files of such a Vitest project are no longer unused files. The fix applies to all plugins that read config files. Thanks @​Smrtnyk for the report. (#3852)

• fallow dead-code no longer reports a class member as unused when an array pattern or a getter on a held object is its only read. An array pattern around an object pattern, such as const [{ m }] = [service], now credits the member. Fallow also credits the member for a src.k.m read through a getter on an object literal that a variable holds. Both forms now credit the member without --type-aware. (#3799)

• Package scripts and CI steps that run a local shell helper now credit the commands of that helper. For bash scripts/build.sh or ./scripts/release.sh, Fallow reads the helper without running it. A binary that the helper runs makes its package used, and a file that the helper runs with tsx or node becomes an entry. Fallow follows nested helpers and literal cd steps. Thanks @​VariableVince for the report in #3918. (#3886)

• fallow dead-code now credits a store member that a helper reads through a store alias declared in a function body. An alias such as type X = ReturnType<typeof useXStore> in a function body or block now credits the store member. An inner type of the same name still shadows the alias. (#3550)

• Deeply nested defaults in an object pattern no longer make extraction hang. In a declaration such as const { k: { k: { m } = s } = s } = s, the work doubled at each level of nesting. A step budget now bounds the walk of one declaration.

• fallow dead-code now credits Expo config plugins that come from a local array binding. An app config can hold its plugins list in a top-level const or let. Fallow now reads that list, its spreads, and push, unshift or splice calls on it. An expo object with a type assertion, such as satisfies ExpoConfig, now also counts. (#3883)

• --production --type-aware no longer credits an export that only a test file uses. A type-aware reference from a file outside the analysis scope no longer removes a dead-code finding. Thanks @​Smrtnyk for the report. (#3869)

• Audit cleanup preserves unrelated Git worktree registrations. When Fallow removes old snapshots, it keeps each user worktree registered while its directory is temporarily unavailable. (#3884)

• Extraction is no longer slow on malformed input. Incomplete script and style tags in Astro and incomplete template tags in Vue and Angular no longer cause repeated scans. An unfinished multiline import or export in MDX no longer makes the parser run again for each line. CODEOWNERS lookups with long patterns no longer use too much memory or time. Results and source offsets do not change.

• Type-aware refinement on the tsrs backend no longer fails on public APIs with many non-generic interfaces. The semantic sidecar now asks for type arguments only on type references...

  Description has been truncated

[mroderick]

Dependency Upgrade Review

Verdict: Compatible (head 1ead0a76a802e7fe05bc57b53bab077070acbe23) · Confidence: Medium

Dependency-only PR (package.json + package-lock.json) bumping four runtime deps — better-auth 1.7.7→1.7.14, @better-auth/oauth-provider same range, hono 4.13.13→4.13.14, @hono/node-server 2.1.4→2.1.5 — plus six dev tools. Runtime changes are patch-level fixes on better-auth; the OAuth 2.1/JWKS/userinfo/id_token surface this repo emits to the planner is exercised by the repo's own integration tests at the new versions plus the round-trip probe, all passing, so this is safe to merge.

Checks

Check	Result
planner suite	pass
auth suite	pass
round-trip probe	pass

Contracts

Contract	Status	Basis
OAuth 2.1 authorize: PKCE S256, client_id planner, 302 with code+state	Verified	Executed by test/integration/oauth-flow.test.js steps 1-2 (auth-suite pass) at the locked 1.7.14 versions.
Token exchange returns access_token/id_token, token_type Bearer	Verified	Executed by test/integration/oauth-flow.test.js step 3 plus the round-trip probe at the locked versions.
id_token payload carries github_id for GitHub-linked users, omits it otherwise	Verified	Both cases asserted in test/integration/jwt-payload.test.js (auth-suite pass) at 1.7.14.
JWKS serves an RS256 key whose kid verifies the issued id_token	Verified	test/integration/oauth-flow.test.js step 4 verifies the id_token signature against the JWKS response.
UserInfo carries sub plus email, email_verified, name	Verified	test/integration/oauth-flow.test.js step 5 asserts sub, email, email_verified, name.
Session/state cookie emission survives better-call 1.4.0→1.4.4 cookie-attribute change	Partially verified	Session and magic-link cookie flows exercised by tests; emission code lives in transitive better-call 1.4.4 and was not line-traced, Cloudflare ingress not exercised locally.

Compatibility analysis — 12 packages

• better-auth 1.7.7 → 1.7.14: Patch-level fixes only. The planner-facing surface (authorize/PKCE, token exchange, id_token with customIdTokenClaims, JWKS, userinfo) changed in error-shape details: invalid PKCE now returns 400 invalid_grant instead of 401, unknown client_id wording changed, userinfo answers failed-JWT with 401 invalid_token instead of an empty 500. All before/after outcomes are failures the planner maps to omniauth failure callbacks with fresh error reasons.
• @better-auth/oauth-provider 1.7.7 → 1.7.14: Same range as better-auth core. Notable items: startup resource-seeding failure no longer bricks auth routes (repo configures no resources), web redirect URI rules unchanged, consent and DPoP changes apply to option values the repo does not set. exactOptionalPropertyTypes fix is type-only.
• better-auth (JWT plugin, bundled) 1.7.7 → 1.7.14: JWT plugin verify/sign fixes land transitively in this range (1.7.12): verification uses the stored key's algorithm and signing warns when issuer/audience are unset. The repo sets alg RS256, issuer and audience explicitly, and signs rather than verifies JWKS-side.
• hono 4.13.13 → 4.13.14: Patch: static asset serving restricted to GET/HEAD, query-order fix in utils/url. Repo serves /static/* only; no basePath, regex params, or strict:false routing in use.
• @hono/node-server 2.1.4 → 2.1.5: Patch: HTTP/2 stream-reset signal abort, GET/HEAD-only serve-static. Repo only uses serve() and /serve-static on an HTTP/1.heroku stack.
• better-auth (cookies via better-call) — transitive, locked: Patch bump; transitive better-call 1.4.0 → 1.4.4 carries an RFC 6265bis cookie-attribute alignment. Cookie forwarding in this repo is a pass-through of Set-Cookie, and session/magic-link cookie tests pass.
• @commitlint/cli 21.2.3 → 21.2.4: Development-only patch bump in commit validation job and husky hooks.
• @commitlint/config-conventional 21.2.3 → 21.2.4: Development-only patch bump, same commit-validation surface as cli.
• @playwright/test 1.64.0 → 1.64.1: Development-only patch bump; e2e oauth-flow.spec.js runner version.
• eslint 10.12.0 → 10.13.0: Minor bump, dev lint only. New rule behavior could surface findings in the CI smoke job that were not part of the provided verification results.
• fallow 3.32.0 → 3.37.0: Minor bump, dev static-analysis tool only. Exit-code semantics wording changed but enforced-gate behavior unchanged; CI smoke runs npm run fallow and may surface new findings from new features.
• prettier 3.9.9 → 3.9.10: Development-only patch bump in prettier:check and lint-staged.

Usage of 10 dependencies

• better-auth: src/auth.js — betterAuth() config; admin, magicLink, jwt from better-auth/plugins; session middleware in src/app/app.js; type-only use in src/app/utils/auth.js.
• @better-auth/oauth-provider: src/auth.js — oauthProvider() with validAudiences ["planner"], customIdTokenClaims injecting github_id.
• hono: src/app/app.js and all route/component files — Hono context, app.route() registration, std responses.
• @hono/node-server: src/index.js — serve(); src/app/app.js — serveStatic for /static/*.
• @commitlint/cli: commitlint.config.js; CI ci.yml commitlint job; husky hooks via package.json.
• @commitlint/config-conventional: commitlint.config.js extends.
• @playwright/test: e2e/oauth-flow.spec.js, playwright.config.js, npm run e2e.
• eslint: eslint.config.js, npm run lint, lint-staged, CI smoke job.
• fallow: .fallowrc.json entry config, npm run fallow, CI smoke job.
• prettier: npm run prettier:check/write, lint-staged, CI smoke job.

Test coverage

• Strong: planner-facing OAuth contract end to end — authorize/PKCE, token exchange, id_token payload incl. github_id, JWKS RS256, userinfo claims — exercised by test/integration/oauth-flow.test.js and test/integration/jwt-payload.test.js at the new versions; round-trip probe also passes.
• Strong: auth flows around session and magic-link cookies covered by test/features/magic-links.test.js and authentication tests.
• Thin: CI smoke gate (prettier:check, eslint 10.13, fallow 3.37) was not among the provided verification results — new eslint rules or fallow findings could fail that job.
• Thin: the Cloudflare cookie-prefix pathway behind skipStateCookieCheck is not exercised by any local test.

Calibration and confidence

Confidence: Medium — All planner-read payload contracts are verified by the repo's own integration tests running against 1.7.14 and the passing round-trip probe, but the cookie-attribute contract is only partially verified and the CI smoke gate (prettier:check, eslint, fallow) was not part of the provided verification results.

1. Weakest claim: The 1.7.12 JWT-plugin sign/verify change is assessed from its changelog text rather than a line-trace of sign.ts; the JWKS-verification integration test at 1.7.14 is what keeps it from being a bare assumption — a line-trace of the signing path at v1.7.14 would shore it up fully.
2. Relied on but unverified: That no silent change in id_token construction or customIdTokenClaims merge order exists among the ~174 commits in the better-auth range beyond the documented ones — error-path diffs were reviewed item by item, claim-construction code was not line-traced.
3. Falsifier: Run the CI test job (db:generate, db:migrate, npm test) plus the smoke job (prettier:check, lint, fallow) at the new lockfile — any failing step, or a failing planner-side codebar-strategy spec after the upgrade, disproves this verdict.