fix(deps): update dependency better-auth to v1.4.5 [security] #606

renovate · 2025-10-09T17:13:36Z

Note: This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
better-auth (source)	`1.2.12` → `1.4.5`

GitHub Vulnerability Alerts

CVE-2025-61928

Summary

A critical authentication bypass was identified in the API key creation and update endpoints. An attacker could create or modify API keys for arbitrary users by supplying a victim’s user ID in the request body. Due to a flaw in how the authenticated user was derived, the endpoints could treat attacker-controlled input as an authenticated user object under certain conditions.

Details

The vulnerability originated from fallback logic used when determining the current user. When no session was present, the handler incorrectly allowed request-body data to populate the user context used for authorization decisions. Because server-side validation only executed when authentication was required, privileged fields were not properly protected. As a result, the API accepted unauthenticated requests that targeted other users.

This same pattern affected both the API key creation and update routes.

Impact

Unauthenticated attackers could generate or modify API keys belonging to any user. This granted full authenticated access as the targeted user and, depending on the user’s privileges, could lead to account compromise, access to sensitive data, or broader application takeover.

GHSA-569q-mpph-wgww

Summary

Affected versions of Better Auth allow an external request to configure baseURL when it isn’t defined through any other means. This can be abused to poison the router’s base path, causing all routes to return 404 for all users.

This issue is only exploitable when baseURL is not explicitly configured (e.g., BETTER_AUTH_URL is missing) and the attacker is able to make the very first request to the server after startup. In properly configured environments or typical managed hosting platforms, this fallback behavior cannot be reached.

Details

A combination of X-Forwarded-Host and X-Forwarded-Proto is implicitly trusted. This allows the first request to configure baseURL whenever it is not explicitly configured.

Here's the code that reads the headers:

Here's the call to getBaseURL(), the result is assigned to ctx.baseURL.

Here's the router receiving the poisoned basePath:

X-Forwarded-Host and X-Forwarded-Proto can be used to modify the pathname of a parsed URL object which forms baseURL. basePath is then derived from the pathname of baseURL. Once the router basePath is poisoned it fails to match & route incoming requests.

Repro

Start a better-auth server with no baseURL configuration.

Send the following request as the first request to the server:

curl -i --location 'https://example.com/api/auth/ok' \
--header 'X-Forwarded-Proto: some:' \
--header 'X-Forwarded-Host: junk'

The better-auth API check endpoint returns 404.

Now send a regular request without the X-Forwarded-Proto and X-Forwarded-Host headers.

curl -i --location 'https://example.com/api/auth/ok'

The better-auth API check endpoint still returns 404.

Example result

We have modified the basePath for the router until the server is restarted. An attacker can repeatedly send these attack requests aiming to persistently exploit the vulnerability.

GHSA-x732-6j76-qmhm

Summary

An issue in the underlying router library rou3 can cause /path and //path to be treated as identical routes. If your environment does not normalize incoming URLs (e.g., by collapsing multiple slashes), this can allow bypasses of disabledPaths and path-based rate limits.

Details

Better Auth uses better-call, which internally relies on rou3 for routing. Affected versions of rou3 normalize paths by removing empty segments. As a result:

/sign-in/email
//sign-in/email
///sign-in/email

…all resolve to the same route.

Some production setups automatically collapse multiple slashes. This includes:

Vercel with Nextjs (default)
Cloudflare - when normalize to urls origin is enabled (https://developers.cloudflare.com/rules/normalization/settings/#normalize-urls-to-origin)

In these environments and other configurations where //path reach Better Auth as /path, the issue does not apply.

Fix

Updating rou3 to the latest version resolves the issue:

better-call previously depended on "rou3": "^0.5.1"
The fix was introduced after that version
(commit: https://github.com/h3js/rou3/commit/f60b43fa648399534507c9ac7db36d705b8874c3)

Better Auth recommends:

Upgrading to Better Auth v1.4.5 or later, which includes the updated rou3.
Ensuring the proxy normalizes URLs.
If project maintainers cannot upgrade yet, they can protect their app by normalizing url before it reaches better-auth handler. See example below:

const req = new Request(...) // this would be the actual request object
const url = new URL(req.url);
const normalizedPath = url.pathname.replace(/\/+/g, "/");

if (url.pathname !== normalizedPath) {
  url.pathname = normalizedPath;
  // Update the raw request pathname
  Object.defineProperty(req, "url", {
    value: url.toString(),
    writable: true,
    configurable: true,
  });
}

Impact

Bypass disabledPaths
Bypass path-based rate limits

The impact of bypassing disabled paths could vary based on a project's configuration.

Release Notes

better-auth/better-auth (better-auth)

`v1.4.5`

Compare Source

`v1.4.4`

Compare Source

🚀 Features

cli: Better-auth-command - by @Ridhim-RR in #6362 (5e06f)
scim: Add support to parse custom scim+json media type - by @jonathansamines in #6365 (6e9ec)

🐞 Bug Fixes

Customizing fields should be optional for rate limit options - by @ceolinwill in #6398 (115c9)
Chunk account data cookie when exceeding limit - by @jslno in #6393 (c9eca)
Remove applying user-agent by default - by @Bekacru in #6417 (34d7d)
Additional fields default values should apply when creating session - by @Bekacru in #5763 (d5713)
Return null early if userid isn't defined - by @Bekacru in #6418 (e4508)
logger: Log level priority - by @danielfinke in #6411 (4c25b)
mcp: Return origin url as authorization server - by @jslno in #6397 (594bb)
multi-session: Endpoints breaks with invalid signatures - by @ping-maxwell in #6342 (9433e)
oidc-provider: Resolve getSignedCookie return type - by @bytaesu in #6346 (425dd)

View changes on GitHub

`v1.4.3`

Compare Source

🚀 Features

Add Vercel as OAuth provider - by @anatrajkovska in #6316 (6fd02)
Add support for trusted proxy headers in base URL inference - by @Bekacru and Copilot in #6285 (c4c0b)

🐞 Bug Fixes

Support @tanstack/solid-start in tanstackStartCookies plugin " - by @Bekacru in #6235 (781d7)
open-api: Clean up incorrect null type in OpenAPI - by @bytaesu in #6293 (f9cba)
two-factor: Remove incorrect blocking logic in OTP setup and verification - by @isaacriehm in #6322 (e75d2)

View changes on GitHub

`v1.4.2`

Compare Source

🚀 Features

cli: Check /auth for auth.ts - by @ping-maxwell in #6273 (53a74)
github: Add PKCE support for Github - by @Shridhad in #6276 (deb62)
jwt: Allow custom jwks endpoint - by @luist18 in #6269 (1c45f)

🐞 Bug Fixes

Support @tanstack/solid-start in tanstackStartCookies plugin - by @jakst in #6235 (c69b3)
SignIn/signUp API returns user additional field - by @himself65 in #6287 (5ea36)
cli:
- Kysely migration fails due to chaining addIndex and addColumn on the same alterTable builder - by @ping-maxwell in #6214 (b8a73)
- Prevent duplicate index creation in Prisma schema generation - by @rovertrack in #6234 (0bbd8)
client:
- Get-session gets triggered twice on foucs - by @Bekacru in #6186 (54852)
email-otp:
- Sign-in email-otp bugs with capitalized emails - by @ping-maxwell in #6237 (fd010)
oidc-provider:
- Session shouldn't be required - by @Bekacru in #6282 (201a7)
organization:
- Have deleteOrganization use adapter.deleteMany instead of delete - by @kefimoto in #6226 (32d3f)

View changes on GitHub

`v1.4.1`

Compare Source

🚀 Features

api-key: Support secondary storage - by @ping-maxwell and @Bekacru in #6014 (44308)

🐞 Bug Fixes

Custom fn field default values should be properly evaluted - by @Bekacru and Copilot in #6212 (590a2)
jwt: Retrieve latest keys from storage properly - by @Bekacru in #6208 (6aca4)
passkey: Change generate-authenticate-options from POST to GET - by @mburumaxwell in #6199 (f922c)

View changes on GitHub

`v1.4.0`

Compare Source

🚀 Features

Bypass transaction with async local storage - by @himself65 in #4711 (52af6)
Add returnHeaders to getSession - by @frectonz in #3983 (19d4b)
Waku integration guide - by @rmarscher in #3990 (3e75a)
Add support for custom callback for authorization url - by @Bekacru in #4919 (78506)
Additional fields on account - by @dvanmali in #4935 (bf0ac)
Add support for custom callback for token url - by @acusti in #5027 (6bb94)
Enum support for drizzle schema - by @himself65 in #5287 (fd780)
Nextjs 16 guide - by @Kinfe123 and @himself65 in #5296 (8db97)
Add storeStateStrategy - by @himself65 and Copilot in #5470 (b5f3b)
Enhance PostgreSQL support for non-public schema by respecting search_path configuration - by @okisdev in #5449 (bef33)
Add polar oauth provider - by @ephraimduncan in #5506 (4b075)
Session store chunking - by @himself65 and Copilot in #5645 (0aa6d)
Stateless session management - by @Bekacru, Copilot, @ping-maxwell and @himself65 in #5601 (afce9)
Esm only - by @himself65 in #5703 (b6977)
Implement automatic server-side IP detection - by @GautamBytes in #5695 (06e8c)
Async import in getAdapter - by @himself65 in #5722 (10249)
Improved API error page - by @ping-maxwell and @Bekacru in #5272 (f9964)
Add request state - by @himself65 in #5742 (cea5b)
Add support for uuids - by @Bekacru in #5809 (4ac34)
Auto-index CLI - by @ping-maxwell and @Bekacru in #5357 (af6eb)
Expose additional http methods - by @jonathansamines and @Bekacru in #5754 (956e2)
better-auth/minimal - by @bytaesu and @Bekacru in #5704 (1ebc6)
Add support for custom response status codes - by @jonathansamines and @Bekacru in #5806 (fa595)
Support pass raw function as middleware - by @himself65 in #5888 (48a20)
Support pass raw function as middleware " - by @himself65 in #5888 (a391a)
Adapter join support - by @ping-maxwell in #5730 (f5bbb)
Refactor fetch plugins config disableDefaultFetchPlugins to include userAgentPlugin - by @kaandok and @himself65 in #6020 (8e754)
Utilize database joins across better-auth - by @ping-maxwell in #6004 (e9f5b)
Support storing account data in a cookie - by @Bekacru in #6013 (06606)
Adding support for SCIM provisioning - by @jonathansamines in #5685 (ffa29)
Add support for organization slug on list members - by @Bekacru in #5862 (31a81)
anonymous:
- Support phone number verification for account linking - by @Bekacru in #5294 (07654)
- Allow customizing random email generator - by @bytaesu in #5922 (5d168)
captcha:
- Add support for CaptchaFox - by @tgrassl in #4944 (e03e5)
cli:
- Add mcp client configs from cli - by @Kinfe123 and @himself65 in #4872 (70cb4)
- Support Cloudflare Workers virtual module imports - by @chhoumann in #5559 (cf050)
client:
- Refetch session when browser state changes - by @himself65 and Copilot in #5630 (522cf)
- Add type helper AuthClient - by @himself65 in #5815 (7caa2)
- Introduce disableSignal client option - by @ping-maxwell in #6108 (f4c43)
core:
- Replace ZodType with @standard-schema/spec - by @himself65 in #5629 (36315)
db:
- Delete hooks - by @Kinfe123 and @himself65 in #4792 (eb76a)
device-authorization:
- Add verification uri - by @bytaesu and @himself65 in #5451 (8b2b6)
discord:
- Allow specification of permissions - by @TheUntraceable and @Bekacru in #4717 (69c9b)
docs:
- Adding missing auth & colour in builder - by @okisdev in #5982 (63518)
email-otp:
- Allow returning undefined in generateOTP - by @ping-maxwell in #4723 (8ac4f)
expo:
- Support multiple cookie prefixes for better-auth detection - by @himself65 in #6080 (f5285)
generic-oauth:
- Provide pre configured provider helpers - by @Paola3stefania in #6085 (07b7e)
- Add custom token exchange support for non-standard providers - by @bytaesu in #6179 (0ac6a)
jwt:
- Support custom adapter option for jwt - by @Bekacru in #5812 (10cee)
- Add JWT verification endpoint and refactor verification logic - by @himself65 in #6122 (18cf7)
- Add key rotation - by @Bekacru, Copilot and @Paola3stefania in #6147 (0bd9b)
last-login-method:
- Update OAuth login method tracking for multiple auth type - by @Kinfe123 in #4693 (5e7b5)
- Add support for 'siwe' as a last login method and added tests - by @rovertrack in #6027 (08316)
mongodb:
- Support string IDs over ObjectIDs - by @ping-maxwell and @ahmedriad1 in #5384 (0dfe6)
oauth-proxy:
- Stateless mode compatibility - by @bytaesu and Copilot in #6131 (05fa1)
oidc-provider:
- Add RP-Initiated Logout endpoint - by @himself65 and Copilot in #6094 (c9085)
organization:
- Support createdAt on invitations - by @iRoachie and @himself65 in #2346 (fc321)
- Refactor organization schema to use BetterAuth types - by @himself65 in #5515 (a58f1)
passkey:
- Allow multiple passkey origins - by @kevcube in #4800 (3783b)
paybin:
- Add Paybin OAuth provider - by @redoh and Copilot in #5626 (b5813)
phone-number:
- Allow custom verifyOTP implementation - by @bytaesu and @zain in #5926 (b855a)
plugin-openapi:
- Allow passing nonce for CSP - by @GautamBytes in #5751 (fa147)
prisma:
- Enhance JSON default value handling for arrays and objects in schema generation - by @rovertrack in #5904 (09162)
session:
- Use JWE for cookie cache by default - by @himself65 in #5510 (f654b)
sso:
- DefaultSSO options and ACS endpoint - by @Kinfe123 and @Bekacru in #3660 (b3ead)
- Provide default service provider metadata - by @dvanmali in #4866 (e892a)
- Add option to provide login hint - by @tnkuehne and Copilot in #5283 (6f231)
- Add domain verification for SSO providers - by @jonathansamines and @ping-maxwell in #5910 (da965)
stripe:
- Upgrade stripe support to v19.1.0 - by @okisdev in #5346 (3a8f4)
- Add StripePlugin type - by @himself65 in #5509 (34431)
- Allow any scheme - by @hyoban, @Bekacru and Copilot in #5725 (2451c)
- Allow flexible types in plan limits - by @bytaesu and @Bekacru in #5821 (4011c)

🐞 Bug Fixes

Device authorization plugin - by @bytaesu in #4695 (b9cbd)
Device authorization plugin - by @bytaesu in #4695 (c3001)
Reduce any type in generator.ts - by @himself65 in #4710 (0770c)
Refresh secondary storage sessions on user update - by @frectonz in #4522 (ea89d)
Allow disable database transaction - by @himself65 in #4733 (a8776)
Wrap Math.floor around the division when calculating TTL - by @DevDuki, Dusan Misic, ping-maxwell and @himself65 in #4768 (14b9e)
Ttl sessions list expiration - by @dvanmali in #3836 (57e04)
Tests failing due to clock drift - by @dvanmali in #4915 (63ca1)
Refresh secondary storage sessions on user update - by @frectonz in #4522 (ccc7c)
Refresh secondary storage sessions on user update - by @frectonz in #4522 (f1b0a)
Support compressed ipv6 format - by @Velka-DEV in #4982 (d8f11)
Add required constraint to slug filed in org plugin - by @bytaesu in #4989 (0581a)
Use consistent messaging on requestPasswordReset - by @Eazash in #5014 (2f94b)
Cookie size limit shouldn't throw error - by @Bekacru and @himself65 in #5031 (72ecc)
Handle symbols in proxy get trap to prevent TypeError - by @zbeyens and @himself65 in #4924 (8d46c)
Ttl for rate limited secondary storage - by @dvanmali in #4961 (f246d)
Properly encode callback url for email verificaiton - by @Bekacru in #5052 (41d2e)
Session update database hook should expect partial session type - by @Bekacru in #5056 (ade06)
Deprecate options.advanced.generateId type - by @himself65 (48249)
Api keys should properly check if a request is from client or server - by @Bekacru (2e236)
Refactor account deletion functions to trigger database hooks - by @xuchenhao001 in #5114 (dade3)
Improve username transformation logic - by @ping-maxwell in #5115 (b2a9e)
Ensure falsy values are valid default values - by @ocherry341 in #5182 (03d62)
Import node:async_hooks directly - by @himself65 in #5198 (0717e)
Undeclared variable reference on docs - by @Kinfe123 in #5235 (6d6df)
Argument where of type TwoFactorWhereUniqueInput needs at least one of id arguments - by @AlexStrNik in #5180 (2dab4)
Mobile ai search responsiveness - by @Kinfe123 in #5269 (08d95)
Type compatibility with exactOptionalPropertyTypes - by @Kinfe123 and @himself65 in #5236 (f2723)
Remove deprecated ssoClient export from client plugin - by @Kinfe123 in #5307 (ee229)
GetAcccessToken refresh should properly refresh when oauth tokens are encrypted - by @bsklaroff in #5094 (16236)
Resolve custom URL scheme origin matching with wildcards - by @AntonVishal and antonvishal in #5248 (82de6)
Respect additionalFields returned config for user data when setting cookie cache - by @ahmed-abdat and @Bekacru in #5327 (a048f)
Correct type HookEndpointContext and InternalContext - by @himself65 in #5359 (89475)
Add optional chaining for process.platform - by @bytaesu in #5390 (f547d)
User-agent requirement when fetching from clients - by @dvanmali in #5420 (5deb8)
Unused peer dependency - by @himself65 in #5465 (3a343)
Rename sha to branch and made it canary by default - by @max-programming in #5491 (5bc26)
Remove deprecated forgetPassword endpoints - by @bytaesu in #5455 (7b62d)
Respect onAPIError.errorURL in OAuth callback flow - by @GautamBytes and @ping-maxwell in #5523 (9c51f)
Call db hooks when calling deleteUser - by @ping-maxwell in #5553 (216dc)
Allow user update to handle additional fields and validation - by @Bekacru (9c508)
Missing email validation - by @ahmedriad1 and @ping-maxwell in #5593 (bf8e9)
Urls without protocol shouldn't be able to satisfy a wildcard origin - by @Bekacru in #5624 (8b355)
Use standard validator - by @himself65 in #5627 (285e3)
Add undefined type for optional property types - by @himself65 in #5654 (b6d40)
Type mismatch for 'banned' on UserWithRole - by @GautamBytes in #5701 (6d7e3)
Delete duplicate email existence check in changeEmail endpoint - by @DevDuki and Dusan Misic in #5699 (c6241)
Add missing userId in listAccounts response - by @bytaesu in #5731 (9d4ef)
Trigger use session on revoke sessions - by @Bekacru in #5761 (e62d3)
string[] inference for additionalFields - by @GautamBytes in #5778 (414d0)
Unsanitized endpoints provided dates will cause DB insert failure - by @ping-maxwell and @Bekacru in #5042 (5c8dd)
Update hooks return should merge with original data - by @Bekacru in #5852 (0d41f)
Dont trigger session refresh on magic-link sign-in - by @ping-maxwell in #5221 (e843e)
Treat generateId "serial" as numeric ID and correct UUID column types across adapters - by @ping-maxwell in #5823 (705f7)
Validate baseURL protocol and improve error messages - by @dmmulroy in #5902 (1c0ac)
U

Configuration

📅 Schedule: Branch creation - "" in timezone Asia/Shanghai, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

vercel · 2025-10-09T17:13:38Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
shiro	Ready	Preview, Comment	Jan 6, 2026 8:51am

safedep · 2025-10-09T17:13:41Z

SafeDep Report Summary

Package Details

Package	Malware	Vulnerability	Risky License	Report
`@better-auth/core @ 1.4.5` _{pnpm-lock.yaml}				🔗
`@better-auth/telemetry @ 1.4.5` _{pnpm-lock.yaml}				🔗
`@better-auth/utils @ 0.3.0` _{pnpm-lock.yaml}				🔗
`@noble/ciphers @ 2.1.1` _{pnpm-lock.yaml}				🔗
`@noble/hashes @ 2.0.1` _{pnpm-lock.yaml}				🔗
`@standard-schema/spec @ 1.1.0` _{pnpm-lock.yaml}				🔗
`better-auth @ 1.4.5` _{pnpm-lock.yaml}				🔗
`better-call @ 1.1.4` _{pnpm-lock.yaml}				🔗
`jose @ 6.1.3` _{pnpm-lock.yaml}				🔗
`kysely @ 0.28.9` _{pnpm-lock.yaml}				🔗
`ms @ 4.0.0-nightly.202508271359` _{pnpm-lock.yaml}				🔗
`nanostores @ 1.1.0` _{pnpm-lock.yaml}				🔗
`rou3 @ 0.7.12` _{pnpm-lock.yaml}				🔗
`zod @ 4.3.5` _{pnpm-lock.yaml}				🔗

_{This report is generated by SafeDep Github App}

github-actions · 2025-10-09T17:16:36Z

📦 Next.js Bundle Analysis for Shiro

This analysis was generated by the Next.js Bundle Analysis action. 🤖

⚠️ Global Bundle Size Increased

Page	Size (compressed)
`global`	`87.35 KB` (🟡 +1 B)

Details

The global bundle is the javascript bundle that loads alongside every page. It is in its own category because its impact is much higher - an increase to its size means that every page on your website loads slower, and a decrease means every page loads faster.

Any third party scripts you have added directly to your app using the <script> tag are not accounted for in this analysis

If you want further insight into what is behind the changes, give @next/bundle-analyzer a try!

github-actions · 2025-11-11T00:44:40Z

📦 Next.js Bundle Analysis for Shiro

This analysis was generated by the Next.js Bundle Analysis action. 🤖

⚠️ Global Bundle Size Increased

Page	Size (compressed)
`global`	`87.35 KB` (🟡 +1 B)

Details

The global bundle is the javascript bundle that loads alongside every page. It is in its own category because its impact is much higher - an increase to its size means that every page on your website loads slower, and a decrease means every page loads faster.

Any third party scripts you have added directly to your app using the <script> tag are not accounted for in this analysis

If you want further insight into what is behind the changes, give @next/bundle-analyzer a try!

github-actions · 2025-12-02T01:42:13Z

📦 Next.js Bundle Analysis for Shiro

This analysis was generated by the Next.js Bundle Analysis action. 🤖

⚠️ Global Bundle Size Increased

Page	Size (compressed)
`global`	`87.35 KB` (🟡 +3 B)

Details

The global bundle is the javascript bundle that loads alongside every page. It is in its own category because its impact is much higher - an increase to its size means that every page on your website loads slower, and a decrease means every page loads faster.

Any third party scripts you have added directly to your app using the <script> tag are not accounted for in this analysis

If you want further insight into what is behind the changes, give @next/bundle-analyzer a try!

github-actions · 2025-12-18T19:56:21Z

📦 Next.js Bundle Analysis for Shiro

This analysis was generated by the Next.js Bundle Analysis action. 🤖

⚠️ Global Bundle Size Increased

Page	Size (compressed)
`global`	`87.35 KB` (🟡 +1 B)

Details

The global bundle is the javascript bundle that loads alongside every page. It is in its own category because its impact is much higher - an increase to its size means that every page on your website loads slower, and a decrease means every page loads faster.

Any third party scripts you have added directly to your app using the <script> tag are not accounted for in this analysis

If you want further insight into what is behind the changes, give @next/bundle-analyzer a try!

github-actions · 2025-12-31T15:46:44Z

📦 Next.js Bundle Analysis for Shiro

This analysis was generated by the Next.js Bundle Analysis action. 🤖

⚠️ Global Bundle Size Increased

Page	Size (compressed)
`global`	`87.35 KB` (🟡 +4 B)

Details

The global bundle is the javascript bundle that loads alongside every page. It is in its own category because its impact is much higher - an increase to its size means that every page on your website loads slower, and a decrease means every page loads faster.

Any third party scripts you have added directly to your app using the <script> tag are not accounted for in this analysis

If you want further insight into what is behind the changes, give @next/bundle-analyzer a try!

renovate bot added the renovate label Oct 9, 2025

vercel bot deployed to Preview October 9, 2025 17:16 View deployment

renovate bot force-pushed the renovate/npm-better-auth-vulnerability branch from 320634a to 6eb5420 Compare October 21, 2025 17:05

vercel bot deployed to Preview October 21, 2025 17:10 View deployment

renovate bot force-pushed the renovate/npm-better-auth-vulnerability branch from 6eb5420 to 34e1c42 Compare November 11, 2025 00:41

vercel bot deployed to Preview November 11, 2025 00:45 View deployment

renovate bot force-pushed the renovate/npm-better-auth-vulnerability branch from 34e1c42 to 6f297a2 Compare November 18, 2025 22:48

vercel bot deployed to Preview November 18, 2025 23:03 View deployment

renovate bot force-pushed the renovate/npm-better-auth-vulnerability branch from 6f297a2 to e850539 Compare December 2, 2025 01:39

renovate bot changed the title ~~fix(deps): update dependency better-auth to v1.3.26 [security]~~ fix(deps): update dependency better-auth to v1.4.2 [security] Dec 2, 2025

vercel bot deployed to Preview December 2, 2025 01:42 View deployment

renovate bot force-pushed the renovate/npm-better-auth-vulnerability branch from e850539 to 9261e59 Compare December 3, 2025 18:25

vercel bot deployed to Preview December 3, 2025 18:28 View deployment

renovate bot force-pushed the renovate/npm-better-auth-vulnerability branch from 9261e59 to 6a671b8 Compare December 18, 2025 19:53

renovate bot changed the title ~~fix(deps): update dependency better-auth to v1.4.2 [security]~~ fix(deps): update dependency better-auth to v1.4.5 [security] Dec 18, 2025

vercel bot deployed to Preview December 18, 2025 19:56 View deployment

renovate bot force-pushed the renovate/npm-better-auth-vulnerability branch from 6a671b8 to f557930 Compare December 31, 2025 15:43

vercel bot deployed to Preview December 31, 2025 15:46 View deployment

fix(deps): update dependency better-auth to v1.4.5 [security]

b98bfd5

renovate bot force-pushed the renovate/npm-better-auth-vulnerability branch from f557930 to b98bfd5 Compare January 6, 2026 08:43

vercel bot deployed to Preview January 6, 2026 08:51 View deployment

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(deps): update dependency better-auth to v1.4.5 [security] #606

fix(deps): update dependency better-auth to v1.4.5 [security] #606

Uh oh!

renovate bot commented Oct 9, 2025 •

edited

Loading

Uh oh!

vercel bot commented Oct 9, 2025 •

edited

Loading

Uh oh!

safedep bot commented Oct 9, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Oct 9, 2025

Uh oh!

github-actions bot commented Nov 11, 2025

Uh oh!

github-actions bot commented Dec 2, 2025

Uh oh!

github-actions bot commented Dec 18, 2025

Uh oh!

github-actions bot commented Dec 31, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

fix(deps): update dependency better-auth to v1.4.5 [security] #606

Are you sure you want to change the base?

fix(deps): update dependency better-auth to v1.4.5 [security] #606

Uh oh!

Conversation

renovate bot commented Oct 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

Summary

Details

Impact

Summary

Details

Repro

Summary

Details

Fix

Impact

Release Notes

🚀 Features

🐞 Bug Fixes

🚀 Features

🐞 Bug Fixes

🚀 Features

🐞 Bug Fixes

🚀 Features

🐞 Bug Fixes

🚀 Features

🐞 Bug Fixes

Configuration

Uh oh!

vercel bot commented Oct 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

safedep bot commented Oct 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

SafeDep Report Summary

Uh oh!

github-actions bot commented Oct 9, 2025

📦 Next.js Bundle Analysis for Shiro

⚠️ Global Bundle Size Increased

Uh oh!

github-actions bot commented Nov 11, 2025

📦 Next.js Bundle Analysis for Shiro

⚠️ Global Bundle Size Increased

Uh oh!

github-actions bot commented Dec 2, 2025

📦 Next.js Bundle Analysis for Shiro

⚠️ Global Bundle Size Increased

Uh oh!

github-actions bot commented Dec 18, 2025

📦 Next.js Bundle Analysis for Shiro

⚠️ Global Bundle Size Increased

Uh oh!

github-actions bot commented Dec 31, 2025

📦 Next.js Bundle Analysis for Shiro

⚠️ Global Bundle Size Increased

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate bot commented Oct 9, 2025 •

edited

Loading

vercel bot commented Oct 9, 2025 •

edited

Loading

safedep bot commented Oct 9, 2025 •

edited

Loading