chore(deps)(deps): Bump the production-dependencies group with 21 updates

[dependabot]

Bumps the production-dependencies group with 21 updates:

Package	From	To
@oclif/core	4.13.3	4.14.0
js-yaml	5.2.3	5.4.1
sql.js	1.14.1	1.14.2
mongodb	7.5.0	7.6.0
@better-auth/core	1.7.1	1.7.2
@better-auth/oauth-provider	1.7.1	1.7.2
@better-auth/scim	1.7.1	1.7.2
@better-auth/sso	1.7.1	1.7.2
@noble/hashes	2.3.0	2.4.0
better-auth	1.7.1	1.7.2
jose	6.2.8	6.2.10
hono	4.13.2	4.13.5
nodemailer	9.0.5	9.0.6
pinyin-pro	3.29.1	3.29.3
@noble/ciphers	2.3.0	2.4.0
fumadocs-core	16.14.4	16.15.4
fumadocs-mdx	15.2.3	15.4.0
fumadocs-ui	16.14.4	16.15.4
lucide-react	1.31.0	1.35.0
mermaid	11.16.1	11.17.2
next	16.3.1	16.3.3

Updates @oclif/core from 4.13.3 to 4.14.0

Release notes

Sourced from @​oclif/core's releases.

4.14.0

Features

• bumping to eslint v10 (W-23473845) (248de04)

4.13.5

Bug Fixes

• replaced require with dynamic import (W-23807278) (d35e325)

4.13.4

Bug Fixes

• resolved security vulnerability in powershell path (W-23807278) (911e9d2)

Changelog

Sourced from @​oclif/core's changelog.

4.14.0 (2026-08-19)

Features

• bumping to eslint v10 (W-23473845) (248de04)

4.13.5 (2026-08-14)

Bug Fixes

• replaced require with dynamic import (W-23807278) (d35e325)

4.13.4 (2026-08-14)

Bug Fixes

• resolved security vulnerability in powershell path (W-23807278) (911e9d2)

Commits

• 1d2903e chore(release): 4.14.0 [skip ci]
• 45c7f0a Merge pull request #1635 from oclif/d/W-23473845
• 395c8bc chore: prune stale eslint suppressions after merge
• 35ddd2e chore: merge main into d/W-23473845
• 0d01467 chore(release): 4.13.5 [skip ci]
• 06949eb Merge pull request #1638 from oclif/d/W-23807278-2
• d35e325 fix: replaced require with dynamic import (W-23807278)
• 85370b7 chore(release): 4.13.4 [skip ci]
• 3318c6e Merge pull request #1636 from oclif/d/W-23807278
• 911e9d2 fix: resolved security vulnerability in powershell path (W-23807278)
• Additional commits viewable in compare view

Updates js-yaml from 5.2.3 to 5.4.1

Changelog

Sourced from js-yaml's changelog.

[5.4.1] - 2026-08-26

Changed

• Hard-limit merge sequence size to 100.

Security

• Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

[5.4.0] - 2026-08-25

Added

• Added the scalarStyleRules dumper option to customize string formatting. See Scalar styling for details.

Changed

• [breaking] Flattened the low-level AST node style representation. Scalar and collection nodes now use SCALAR_STYLE and COLLECTION_STYLE values; explicit tags use the separate tagged property. Alias nodes now contain only kind and anchor. This only affects code that directly constructs or edits AST nodes.
• [breaking] The sortKeys option was rewritten using AST mutation to avoid side effects.
• Reworked scalar style selection. This can change formatting without changing loaded values; in particular, whitespace-only strings are now double-quoted.

Fixed

• Accept a byte order mark at the start of each document in a stream, #791.
• Produce valid flow mappings with quoteFlowKeys and flowSkipColonSpace, including alias and property-only keys, #786.
• Preserve empty scalar items when converting block sequences to flow style.
• Do not apply the 1024-character simple-key limit to flow mapping keys.
• Count Unicode code points, rather than UTF-16 code units, for the 1024-character simple-key limit.
• Add an explicit document-end marker after keep-chomped block scalars when needed to preserve trailing newlines.

[5.3.0] - 2026-08-14

This release focuses on reworking the documentation and making small architectural improvements before moving forward.

Added

• Added completely new documentation.
• Exported DUMP_SCHEMA, the default schema used by the dumper.
• Added YAMLException.throwAt() for throwing an error at a source position.

Changed

... (truncated)

Commits

• e5a3ba0 5.4.1 released
• e54dea3 Hard-limit merge sequence size to 100
• dfd3a29 Cleanup 6a8e05f, #797
• 6a8e05f fix: count empty merge sources against maxTotalMergeKeys (#797)
• 6b4ff5e 5.4.0 released
• 3b3625e Update changelog
• 4f25a74 Fix file name
• 3bd003b Expose new scalar styling API
• fbb3e9d Remove regex lookbehind for ES2015 compatibility
• d43c185 Fix flowSkipColonSpace by forcing quoteFlowKeys
• Additional commits viewable in compare view

Updates sql.js from 1.14.1 to 1.14.2

Commits

• 9c4e167 ci: debug npm publish http log
• 1d5db45 ci: use npm 11 for OIDC trusted publishing
• c2c6909 debug: oidc env dump
• 17159df debug: oidc
• 7e943bd ci: publish to npm via OIDC trusted publishing
• c11695f Bump version to 1.14.2
• 5489808 fix: restore WASM stack in Database.exec to prevent stack leak (#631)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for sql.js since your current version.

Updates mongodb from 7.5.0 to 7.6.0

Release notes

Sourced from mongodb's releases.

v7.6.0

7.6.0 (2026-08-21)

The MongoDB Node.js team is pleased to announce version 7.6.0 of the mongodb package!

Release Notes

Support for MongoDB 4.2 is removed

[!WARNING] When the driver connects to a MongoDB server of version 4.2 or less, it will now throw an error.

HTTP proxy support for KMS requests in CSFLE and Queryable Encryption

In-use encryption can now route KMS requests through an HTTP proxy. Set kmsConnectCallback on your ClientEncryption or auto-encryption options to control how the driver connects to a KMS host. The callback receives the target host and port and returns a connected socket (for example, a tunnel opened with HTTP CONNECT); the driver then performs the KMS TLS handshake over that socket using the provider's configured TLS options. This unblocks CSFLE and Queryable Encryption in environments that require an HTTP forward proxy for outbound KMS traffic, which the existing SOCKS5 proxyOptions does not cover.

const clientEncryption = new ClientEncryption(keyVaultClient, {
  keyVaultNamespace,
  kmsProviders,
  // Establish the KMS connection through your HTTP proxy; the driver adds TLS.
  kmsConnectCallback: ({ host, port }) => connectThroughHttpProxy(host, port)
});

Improved Intelligent Workload Management

Improved performance for MongoDB 9.0's Intelligent Workload Management (IWM) by only retrying overload errors when doing so is expected to not worsen server conditions

Bundling the driver into ESM no longer throws ReferenceError: require is not defined

v7.2.0 introduced the experimental runtimeAdapters option and, as part of it, replaced the driver’s static import of Node’s os module with a runtime require('os'). That works in a CommonJS build, but when the driver is bundled into ESM output (e.g. a Vite/esbuild/rollup server build with "type": "module"), there is no require in module scope, so constructing a client threw ReferenceError: require is not defined. The driver now loads the default os adapter through a dynamic import() that survives bundling, so new MongoClient() works in ESM bundles. CommonJS usage is unchanged, and supplying your own runtimeAdapters.os continues to work.

Bulk writes serialize each document only once

insertMany and bulkWrite previously processed each document twice - once to measure its size for batch splitting (a full recursive walk via calculateObjectSize) and again to serialize it into the command sent to the server. Documents are now serialized a single time and the resulting bytes are reused for both, decreasing the BSON-encoding CPU spent on bulk writes and reducing event-loop blocking during large batches. The improvement is most noticeable with high document counts and documents that have many fields.

Features

• NODE-7546: add HTTP Proxy support for QE & CSFLE (#5007) (3366c21)
• NODE-7547: bump minimum support server/wire versions to '4.4' & '9' respectively (#4994) (3d97028)
• NODE-7624: support baseBackoffMS and update client backpressure backoff (#5020) (560837b)

Bug Fixes

• NODE-7603: emit dynamic import('os') via tsconfig (#4992) (52f5e61)

Performance Improvements

... (truncated)

Changelog

Sourced from mongodb's changelog.

7.6.0 (2026-08-21)

Features

• NODE-7546: add HTTP Proxy support for QE & CSFLE (#5007) (3366c21)
• NODE-7547: bump minimum support server/wire versions to '4.4' & '9' respectively (#4994) (3d97028)
• NODE-7624: support baseBackoffMS and update client backpressure backoff (#5020) (560837b)

Bug Fixes

• NODE-7603: emit dynamic import('os') via tsconfig (#4992) (52f5e61)

Performance Improvements

• NODE-7660: serialize bulk write documents a single time (#4999) (1217aa1)

Commits

• 0fb2c13 chore(main): release 7.6.0 (#5001)
• bb35ded docs: Add preliminary checks to release instructions (#5028)
• 560837b feat(NODE-7624): support baseBackoffMS and update client backpressure backoff...
• ce33c59 chore(NODE-7767): bson compat tests snappy fix (#5025)
• 0f2ed29 chore(NODE-7770): add server 9.0 to the test matrix (#5024)
• bc92c29 chore(NODE-7767): snappy 7.4 is incompatible in CI (#5021)
• dce7939 chore(NODE-7759): pin bson-compat server (#5018)
• 7f8edf3 chore: run bson compat tests against latest server (#5017)
• 30c31e5 ci(deps): bump drivers-evergreen-tools from 3741fa9 to e86753e (#5016)
• 3366c21 feat(NODE-7546): add HTTP Proxy support for QE & CSFLE (#5007)
• Additional commits viewable in compare view

Updates @better-auth/core from 1.7.1 to 1.7.2

Release notes

Sourced from @​better-auth/core's releases.

v1.7.2

better-auth

Bug Fixes

• Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
• Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
• Added warnings for invalid signed session data in the cookie cache. (#10934)
• Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
• Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
• Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
• Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
• Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
• Improved getTestInstance performance with a faster default password hasher. (#10879)
• Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
• Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
• Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
• Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
• Added synchronous and optional access to the current auth endpoint context. (#10938)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
• Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
• Fixed relative redirect URLs containing fragments. (#10983)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
• Added validation for missing Drizzle schema fields in compound where clauses. (#10859)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

... (truncated)

Changelog

Sourced from @​better-auth/core's changelog.

1.7.2

Patch Changes

• #10938 557e19b Thanks @​bytaesu! - Added synchronous auth endpoint context access with getCurrentAuthEndpointContext and optional access with tryGetCurrentAuthEndpointContext. The existing getCurrentAuthContext and getCurrentAuthContextAsyncLocalStorage functions remain available as deprecated compatibility APIs.

• #10855 64da15b Thanks @​bytaesu! - Prevent async context loss in Cloudflare Workers bundles that enable multiple runtime conditions.

• #10982 b4ad5a1 Thanks @​bytaesu! - Built-in placeholder emails now consistently use the namespaced {identifier}@{namespace}.placeholder.invalid format.

• #10979 fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.

• #10939 e1d4011 Thanks @​bytaesu! - Logs emitted while handling auth requests now respect the configured custom logger, log level, and disabled setting.

Commits

• ba12fcd chore: release v1.7.2 (#10870)
• 79904f0 fix(origin-check): support fragments in relative redirect URLs (#10983)
• e1d4011 fix(logger): respect configured logger in auth request context (#10939)
• 557e19b refactor(context): clarify auth endpoint context access (#10938)
• b4ad5a1 refactor: centralize placeholder email generation (#10982)
• 64da15b fix(core): prioritize workerd over edge exports (#10855)
• See full diff in compare view

Updates @better-auth/oauth-provider from 1.7.1 to 1.7.2

Release notes

Sourced from @​better-auth/oauth-provider's releases.

v1.7.2

better-auth

Bug Fixes

• Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
• Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
• Added warnings for invalid signed session data in the cookie cache. (#10934)
• Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
• Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
• Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
• Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
• Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
• Improved getTestInstance performance with a faster default password hasher. (#10879)
• Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
• Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
• Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
• Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
• Added synchronous and optional access to the current auth endpoint context. (#10938)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
• Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
• Fixed relative redirect URLs containing fragments. (#10983)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
• Added validation for missing Drizzle schema fields in compound where clauses. (#10859)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

... (truncated)

Changelog

Sourced from @​better-auth/oauth-provider's changelog.

1.7.2

Patch Changes

• #11010 bb8d7c4 Thanks @​bytaesu! - Client ID Metadata Document clients that declare a grant the server does not offer (such as Claude's enterprise jwt-bearer grant) can now register. Only documents sharing no grant with the server are refused.

• #10979 fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.

Commits

• ba12fcd chore: release v1.7.2 (#10870)
• bb8d7c4 fix(oauth-provider): backport CIMD grant intersection (#11010)
• 79904f0 fix(origin-check): support fragments in relative redirect URLs (#10983)
• See full diff in compare view

Updates @better-auth/scim from 1.7.1 to 1.7.2

Release notes

Sourced from @​better-auth/scim's releases.

v1.7.2

better-auth

Bug Fixes

• Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
• Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
• Added warnings for invalid signed session data in the cookie cache. (#10934)
• Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
• Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
• Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
• Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
• Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
• Improved getTestInstance performance with a faster default password hasher. (#10879)
• Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
• Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
• Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
• Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
• Added synchronous and optional access to the current auth endpoint context. (#10938)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
• Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
• Fixed relative redirect URLs containing fragments. (#10983)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
• Added validation for missing Drizzle schema fields in compound where clauses. (#10859)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

... (truncated)

Changelog

Sourced from @​better-auth/scim's changelog.

1.7.2

Commits

• ba12fcd chore: release v1.7.2 (#10870)
• See full diff in compare view

Updates @better-auth/sso from 1.7.1 to 1.7.2

Release notes

Sourced from @​better-auth/sso's releases.

v1.7.2

better-auth

Bug Fixes

• Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
• Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
• Added warnings for invalid signed session data in the cookie cache. (#10934)
• Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
• Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
• Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
• Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
• Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
• Improved getTestInstance performance with a faster default password hasher. (#10879)
• Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
• Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
• Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
• Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
• Added synchronous and optional access to the current auth endpoint context. (#10938)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
• Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
• Fixed relative redirect URLs containing fragments. (#10983)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
• Added validation for missing Drizzle schema fields in compound where clauses. (#10859)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

... (truncated)

Changelog

Sourced from @​better-auth/sso's changelog.

1.7.2

Patch Changes

• #10979 fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.

Commits

• ba12fcd chore: release v1.7.2 (#10870)
• 79904f0 fix(origin-check): support fragments in relative redirect URLs (#10983)
• See full diff in compare view

Updates @noble/hashes from 2.3.0 to 2.4.0

Release notes

Sourced from @​noble/hashes's releases.

2.4.0

Security and correctness

• Protect passed options against mutation / pollution
• keccakprg: fail until entropy is added
• webcrypto: reject output sizes which crashed engine
• blake3: fix tree merging for multi-terabyte streams
• Improve zeroization

Misc

• Speed-up Argon2 by 20%
• Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
• Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
• nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.

Full Changelog: paulmillr/noble-hashes@2.3.0...2.4.0

Changelog

Sourced from @​noble/hashes's changelog.

2.4.0 (2026-08-27)

Security and correctness

• Protect passed options against mutation / pollution
• keccakprg: fail until entropy is added
• webcrypto: reject output sizes which crashed engine
• blake3: fix tree merging for multi-terabyte streams
• Improve zeroization

Misc

• Speed-up Argon2 by 20%
• Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
• Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
• nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.

Commits

• 663c2ae Release 2.4.0.
• a6f7519 Add changelog
• 1bbc433 webcrypto: snapshot opts
• 5bd2e15 Remove unused files
• a3bc7ff Bump vectors
• fcb6cb6 README
• 64f3033 readme
• 9ac6165 Bump ci workflows
• 6587b51 Fix test on bun
• 91ecf91 Fix tests
• Additional commits viewable in compare view

Updates better-auth from 1.7.1 to 1.7.2

Release notes

Sourced from better-auth's releases.

v1.7.2

better-auth

Bug Fixes

• Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
• Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
• Added warnings for invalid signed session data in the cookie cache. (#10934)
• Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
• Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
• Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
• Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
• Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
• Improved getTestInstance performance with a faster default password hasher. (#10879)
• Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
• Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
• Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
• Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
• Added synchronous and optional access to the current auth endpoint context. (#10938)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
• Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
• Fixed relative redirect URLs containing fragments. (#10983)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
• Added validation for missing Drizzle schema fields in compound where clauses. (#10859)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.2

Patch Changes

• #10875 d5d889b Thanks @​bytaesu! - Fix programmatic migrations failing on Cloudflare D1 while preserving existing-index validation across supported databases.

• #10982 b4ad5a1 Thanks @​bytaesu! - Built-in placeholder emails now consistently use the namespaced {identifier}@{namespace}.placeholder.invalid format.

• #10934 c7a5c1a Thanks @​bytaesu! - Cookie-cache reads now warn when signed session data is invalid instead of silently appearing as a signed-out session.

• #10879 78f0c39 Thanks @​starslingdev! - Test suites using getTestInstance now run faster because the shared fixture avoids production password-hashing costs by default. Custom emailAndPassword.password implementations continue to take precedence.

• #10823 ce8a3ab Thanks @​sosyz! - Ensure permanently banning a user clears any expiration from a previous temporary ban.

• #10907 a021eaf Thanks @​heliohm! - A client created with more plugins is again assignable to a client type declaring fewer plugins, as in 1.6.

• #10959 c8dcfa5 Thanks @​bytaesu! - Allow same-origin form submissions from pages using Referrer-Policy: no-referrer while continuing to reject untrusted request origins.

• #10979 fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.

• #10041 f6891a2 Thanks @​GautamBytes! - Allow ~...

  Description has been truncated

[github-actions]

📓 Docs Drift Check

⚠️ 9 changed file(s) yielded no anchor (packages/cli/package.json, packages/drivers/driver-mongodb/package.json, packages/drivers/driver-sqlite-wasm/package.json, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 9 changed package(s)).

What this run could not see

• 9 changed file(s) yielded no anchor (packages/cli/package.json, packages/drivers/driver-mongodb/package.json, packages/drivers/driver-sqlite-wasm/package.json, …) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 46 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 9b21037d4198cd14105abd354b019e9323b4fe57 → packageMentionDocs.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.