mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-07 07:23:08 +02:00
72d4f2ad99
Bumps [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) from 1.4.18 to 1.6.20. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/better-auth/better-auth/releases">better-auth's releases</a>.</em></p> <blockquote> <h2>v1.6.20</h2> <h2><code>better-auth</code></h2> <h3>Bug Fixes</h3> <ul> <li>Fixed account-linking logs to route through the configured logger (<a href="https://redirect.github.com/better-auth/better-auth/pull/10121">#10121</a>)</li> <li>Fixed TypeScript inference errors by declaring inherited <code>APIError</code> properties (<a href="https://redirect.github.com/better-auth/better-auth/pull/8734">#8734</a>)</li> <li>Fixed refresh cookie <code>Max-Age</code> to be capped at <code>expiresIn</code> (<a href="https://redirect.github.com/better-auth/better-auth/pull/9621">#9621</a>)</li> </ul> <p>For detailed changes, see <a href="https://github.com/better-auth/better-auth/blob/c342f42fff46043b5e195f7f757b0f2c1043414c/packages/better-auth/CHANGELOG.md"><code>CHANGELOG</code></a></p> <h2><code>@better-auth/i18n</code></h2> <h3>Bug Fixes</h3> <ul> <li>Fixed English language fallback behavior and improved i18n documentation (<a href="https://redirect.github.com/better-auth/better-auth/pull/9872">#9872</a>)</li> </ul> <p>For detailed changes, see <a href="https://github.com/better-auth/better-auth/blob/c342f42fff46043b5e195f7f757b0f2c1043414c/packages/i18n/CHANGELOG.md"><code>CHANGELOG</code></a></p> <h2>Contributors</h2> <p>Thanks to everyone who contributed to this release:</p> <p><a href="https://github.com/adityachaudhary99"><code>@adityachaudhary99</code></a>, <a href="https://github.com/dipan-ck"><code>@dipan-ck</code></a>, <a href="https://github.com/sleepe229"><code>@sleepe229</code></a>, <a href="https://github.com/WilsonnnTan"><code>@WilsonnnTan</code></a></p> <p><strong>Full changelog:</strong> <a href="https://github.com/better-auth/better-auth/compare/v1.6.19...v1.6.20"><code>v1.6.19...v1.6.20</code></a></p> <h2>v1.6.19</h2> <h2><code>better-auth</code></h2> <h3>Features</h3> <ul> <li>Added support for pre-binding device codes to a specific user in the device authorization plugin (<a href="https://redirect.github.com/better-auth/better-auth/pull/9995">#9995</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>Fixed headerless session checks (<a href="https://redirect.github.com/better-auth/better-auth/pull/10053">#10053</a>)</li> <li>Fixed cookie cache fallback lookup (<a href="https://redirect.github.com/better-auth/better-auth/pull/9348">#9348</a>)</li> <li>Fixed <code>sendVerificationEmail</code> errors not being surfaced to the client (<a href="https://redirect.github.com/better-auth/better-auth/pull/8863">#8863</a>)</li> <li>Fixed auth client return types not being emitted correctly in TypeScript declaration builds (<a href="https://redirect.github.com/better-auth/better-auth/pull/10071">#10071</a>)</li> <li>Fixed session and account cache cookies being silently dropped when near the browser's per-cookie size limit by splitting them into chunks (<a href="https://redirect.github.com/better-auth/better-auth/pull/10088">#10088</a>)</li> <li>Fixed single-use verification flows (such as magic-link) hanging on connection-limited database adapters by reusing active transactions (<a href="https://redirect.github.com/better-auth/better-auth/pull/10070">#10070</a>)</li> <li>Fixed the domain not being included when clearing cross-subdomain cookies in the <code>last-login-method</code> plugin (<a href="https://redirect.github.com/better-auth/better-auth/pull/9319">#9319</a>)</li> <li>Fixed the <code>oauth-popup</code> plugin leaking internal OAuth state keys into <code>additionalData</code> (<a href="https://redirect.github.com/better-auth/better-auth/pull/10067">#10067</a>)</li> <li>Reverted the headerless session check fix (<a href="https://redirect.github.com/better-auth/better-auth/pull/10074">#10074</a>)</li> </ul> <p>For detailed changes, see <a href="https://github.com/better-auth/better-auth/blob/ac4d81df748b8c09e584fdd6c440f8f327490fd1/packages/better-auth/CHANGELOG.md"><code>CHANGELOG</code></a></p> <h2><code>auth</code></h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md">better-auth's changelog</a>.</em></p> <blockquote> <h2>1.6.20</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10121">#10121</a> <a href="https://github.com/better-auth/better-auth/commit/21448b1b77681e71e80ae0728d8658c936c18eb8"><code>21448b1</code></a> Thanks <a href="https://github.com/adityachaudhary99"><code>@adityachaudhary99</code></a>! - OAuth account-linking and create-user error logs now respect a custom <code>logger</code> configured in <code>betterAuth()</code>, instead of always being written to the default console logger.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/9621">#9621</a> <a href="https://github.com/better-auth/better-auth/commit/8ecf23817f5e501bdd8ab63ad5fdf2554ff1dff5"><code>8ecf238</code></a> Thanks <a href="https://github.com/dipan-ck"><code>@dipan-ck</code></a>! - Session refresh no longer emits a cookie Max-Age above the browser's 400-day ceiling when using a database without fractional-second precision.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/8734">#8734</a> <a href="https://github.com/better-auth/better-auth/commit/930f5341d956bf3075f43758392a5c7f50947104"><code>930f534</code></a> Thanks <a href="https://github.com/sleepe229"><code>@sleepe229</code></a>! - declare inherited APIError properties to fix TypeScript inference errors</p> </li> <li> <p>Updated dependencies []:</p> <ul> <li><code>@better-auth/core</code><a href="https://github.com/1"><code>@1</code></a>.6.20</li> <li><code>@better-auth/drizzle-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.20</li> <li><code>@better-auth/kysely-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.20</li> <li><code>@better-auth/memory-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.20</li> <li><code>@better-auth/mongo-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.20</li> <li><code>@better-auth/prisma-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.20</li> <li><code>@better-auth/telemetry</code><a href="https://github.com/1"><code>@1</code></a>.6.20</li> </ul> </li> </ul> <h2>1.6.19</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10088">#10088</a> <a href="https://github.com/better-auth/better-auth/commit/de4aa52e991f0a56786300af3e0d9ac8331f1996"><code>de4aa52</code></a> Thanks <a href="https://github.com/bytaesu"><code>@bytaesu</code></a>! - Session and account cache cookies near the browser's per-cookie size limit (for example with a long <code>cookiePrefix</code> or many cached fields) are now split into chunks instead of being silently dropped by the browser. A cache too large to fit even when chunked is skipped with a warning rather than failing the request, so reads fall back to the database.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/9995">#9995</a> <a href="https://github.com/better-auth/better-auth/commit/b4b02660c760fe4c8889d1311a3dbf3165f88d0b"><code>b4b0266</code></a> Thanks <a href="https://github.com/ElGauchooooo"><code>@ElGauchooooo</code></a>! - The device authorization plugin now accepts an optional <code>user_id</code> when issuing a device code via <code>/device/code</code>, pre-binding the code to that user. Only the bound user can approve or deny the code, so a publicly visible user code can no longer be claimed by someone else.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10086">#10086</a> <a href="https://github.com/better-auth/better-auth/commit/5bd5e1cc73d2c9c38e69011f03038b61a4312a63"><code>5bd5e1c</code></a> Thanks <a href="https://github.com/gustavovalverde"><code>@gustavovalverde</code></a>! - Refresh-token rotation and token revocation, two-factor backup-code regeneration, device-code claiming, and organization invitation acceptance now work on Prisma. Concurrent or repeat requests in these flows could previously return an error on Prisma instead of the expected result.</p> <p>On MongoDB servers older than 5.0, these flows and other guarded value updates (rate-limit window resets, API-key refills) no longer fail with an empty-update error.</p> <p><code>@better-auth/core</code>: <code>incrementOne</code> now reports a clear error when called with no <code>increment</code> and no <code>set</code>.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/9319">#9319</a> <a href="https://github.com/better-auth/better-auth/commit/581f8271fb911cea2ce74810e086709909457cd3"><code>581f827</code></a> Thanks <a href="https://github.com/ping-maxwell"><code>@ping-maxwell</code></a>! - fix(last-login-method): include domain when clearing cross-subdomain cookies</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10067">#10067</a> <a href="https://github.com/better-auth/better-auth/commit/840788502a13d6fa4aa4540b930ddb4a99dc1ed6"><code>8407885</code></a> Thanks <a href="https://github.com/bytaesu"><code>@bytaesu</code></a>! - The <code>oauth-popup</code> plugin now ignores internal OAuth state fields passed through its <code>additionalData</code> parameter, so <code>additionalData</code> only ever carries your own custom values.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/9555">#9555</a> <a href="https://github.com/better-auth/better-auth/commit/c1a8a64c146fab20c7ad0076ffdf12eff9adc17a"><code>c1a8a64</code></a> Thanks <a href="https://github.com/ChrisMGeo"><code>@ChrisMGeo</code></a>! - Fix invalid OpenAPI output for Better Auth callback, session, and passkey routes so client generators can consume the schema.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10071">#10071</a> <a href="https://github.com/better-auth/better-auth/commit/635f1908702d0c63cf66b4e5f054e9d527a3c8f7"><code>635f190</code></a> Thanks <a href="https://github.com/gustavovalverde"><code>@gustavovalverde</code></a>! - Auth clients exported from wrapper packages can now be emitted in TypeScript declaration builds without extra type annotations.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10070">#10070</a> <a href="https://github.com/better-auth/better-auth/commit/a787e0b66b368a1af0b4ba17c9750c2839668246"><code>a787e0b</code></a> Thanks <a href="https://github.com/gustavovalverde"><code>@gustavovalverde</code></a>! - Single-use verification flows no longer hang on database adapters that use a one-connection pool. This fixes magic-link verification and similar token checks in connection-limited serverless database setups.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/9348">#9348</a> <a href="https://github.com/better-auth/better-auth/commit/c2f718fcdeec0c1767bb8acd5fefdd3810863b0a"><code>c2f718f</code></a> Thanks <a href="https://github.com/ping-maxwell"><code>@ping-maxwell</code></a>! - fix: cookie cache fallback lookup</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/8863">#8863</a> <a href="https://github.com/better-auth/better-auth/commit/7d18175637a0b95a501fde0cf3db080879367a9d"><code>7d18175</code></a> Thanks <a href="https://github.com/ping-maxwell"><code>@ping-maxwell</code></a>! - <code>sendVerificationEmail</code> was invoked via <code>runInBackgroundOrAwait</code>, which could defer work when <code>advanced.backgroundTasks.handler</code> is configured (so the handler could return <strong>200</strong> before the email callback finished) and, in the default path, <strong>caught and logged errors without rethrowing</strong>. User callbacks that throw <code>APIError</code> (e.g. <strong>429</strong> from a rate limiter) were therefore not reliably reflected in the HTTP response (<a href="https://redirect.github.com/better-auth/better-auth/issues/8757">better-auth/better-auth#8757</a>).</p> <p>Now we await <code>sendVerificationEmailFn</code> so failures surface to the client with the correct status. The unauthenticated <code>/send-verification-email</code> path enforces a constant-time floor (500 ms) so that the response duration does not reveal whether the email belongs to a real unverified user.</p> </li> <li> <p>Updated dependencies [<a href="https://github.com/better-auth/better-auth/commit/08959936d29de8a37d469e42d9077859b643d6b3"><code>0895993</code></a>, <a href="https://github.com/better-auth/better-auth/commit/5bd5e1cc73d2c9c38e69011f03038b61a4312a63"><code>5bd5e1c</code></a>, <a href="https://github.com/better-auth/better-auth/commit/a787e0b66b368a1af0b4ba17c9750c2839668246"><code>a787e0b</code></a>]:</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/better-auth/better-auth/commit/c342f42fff46043b5e195f7f757b0f2c1043414c"><code>c342f42</code></a> chore: release v1.6.20 (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10108">#10108</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/21448b1b77681e71e80ae0728d8658c936c18eb8"><code>21448b1</code></a> fix: route account-linking logs through the configured logger (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10121">#10121</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/8ecf23817f5e501bdd8ab63ad5fdf2554ff1dff5"><code>8ecf238</code></a> fix(session): cap refresh cookie Max-Age at expiresIn (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/9621">#9621</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/ac4d81df748b8c09e584fdd6c440f8f327490fd1"><code>ac4d81d</code></a> chore: release v1.6.19 (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10034">#10034</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/1e697250273aff1e80e8103d296d74eafff61874"><code>1e69725</code></a> docs: clarify stateless Cognito token refresh (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10092">#10092</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/de4aa52e991f0a56786300af3e0d9ac8331f1996"><code>de4aa52</code></a> fix(cookies): chunk session and account cookies near the browser size limit (...</li> <li><a href="https://github.com/better-auth/better-auth/commit/5bd5e1cc73d2c9c38e69011f03038b61a4312a63"><code>5bd5e1c</code></a> fix: make guarded state transitions portable on Prisma (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10086">#10086</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/36f345b1bcd5c83eb16d4d967719d101394a99b0"><code>36f345b</code></a> revert: fix: allow headerless get session checks (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10053">#10053</a>) (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10074">#10074</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/635f1908702d0c63cf66b4e5f054e9d527a3c8f7"><code>635f190</code></a> fix(client): name auth client return types (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10071">#10071</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/d009daedc75d0e61eb69e545a6ab40dd75cf541e"><code>d009dae</code></a> fix: allow headerless get session checks (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10053">#10053</a>)</li> <li>Additional commits viewable in <a href="https://github.com/better-auth/better-auth/commits/v1.6.20/packages/better-auth">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for better-auth since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Nicky Leach <nicky@paperclip.ing> Co-authored-by: Paperclip <noreply@paperclip.ing>