Skip to content

chore(deps)(deps): bump the auth-minor-patch group across 1 directory with 9 updates - #590

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/services/auth/auth-minor-patch-1915d5d71d
Closed

chore(deps)(deps): bump the auth-minor-patch group across 1 directory with 9 updates#590
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/services/auth/auth-minor-patch-1915d5d71d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the auth-minor-patch group with 9 updates in the /services/auth directory:

Package From To
@aws-sdk/client-kms 3.1063.0 3.1079.0
@hono/node-server 2.0.4 2.0.8
better-auth 1.6.14 1.6.23
hono 4.12.24 4.12.28
@biomejs/biome 2.4.16 2.5.2
@testcontainers/postgresql 12.0.1 12.0.4
testcontainers 12.0.1 12.0.4
tsx 4.22.4 4.23.0
vitest 4.1.8 4.1.10

Updates @aws-sdk/client-kms from 3.1063.0 to 3.1079.0

Release notes

Sourced from @​aws-sdk/client-kms's releases.

v3.1079.0

3.1079.0(2026-07-02)

Chores
  • deps: bump @​aws/lambda-invoke-store to ^0.3.0 (#8140) (aeb7e071)
New Features
  • clients: update client endpoints as of 2026-07-02 (cc43668e)
  • client-config-service: AWS Config now supports tag-on-create for organization-managed Config rules and conformance packs through the PutOrganizationConfigRule and PutOrganizationConformancePack APIs. (2ca9232a)
  • client-odb: Updated model definitions for ODB service. (a9d3fd5e)
  • client-cognito-identity-provider: Add support for provisioned limit management, enabling customers to view and update their provisioned API rate limits for Amazon Cognito User Pools programmatically through the new GetProvisionedLimit and UpdateProvisionedLimit APIs. (160778dc)
  • client-outposts: Tighten Outpost site ContactPhoneNumber regex to perform phone number validation. (4e2b31db)
  • client-elementalinference: Adding new BDD representation of endpoint ruleset (dd21a6ec)
  • client-mediatailor: Added dual-stack (IPv4 and IPv6) endpoint fields to SSAI and Channel Assembly API responses. (63a258ce)
  • client-customer-profiles: Amazon Connect Customer Profiles adds support for diversityConfig to recommenderConfig which can be used for diversifying the recommendations. This release also includes model versioning support which helps customer to rollback trained models. (202ec32a)
Bug Fixes
Tests
  • client-kinesis: resolve e2e endpoint from client config (#8142) (4cfd7f42)

For list of updated packages, view updated-packages.md in assets-3.1079.0.zip

v3.1078.0

3.1078.0(2026-07-01)

Chores
  • codegen: sync for thinner command classes, endpoint parameter type fix (#8136) (c39b6765)
  • ci: allow AWS maintained packages in yarn age gate (#8139) (3bddc2a6)
  • deps-dev: bump yarn to 4.17.0 (#8137) (14dc3ae8)
Documentation Changes
  • client-cloud9: Since Amazon Linux 2 (AL2) will reach its end-of-life (EOL) and stop receiving security updates on June 30, 2026, Cloud9 will remove AL2 from AMI options in public API create-environment-ec2. (bbd7a342)
  • client-marketplace-metering: The usage reporting window for the BatchMeterUsage API has been extended from 6 hours to 24 hours. Sellers can now submit usage records for up to 24 hours after a metered event occurs. (980d5415)
New Features
  • clients: update client endpoints as of 2026-07-01 (0c0bc427)
  • client-opensearch: To create a Mustang domain via the AWS CLI, you must pass EngineMode OPTIMIZED (along with UseCase OBSERVABILITY or MIXED) without it, the domain defaults to a regular (GENERAL) domain. Also this release includes Insights Feedback API which user can use to provide feedback for Insight API. (8927c3ad)
  • client-ec2: Use declarative policies to enable VPC Encryption Controls across your organization or select accounts. Added AMD SEV-SNP support for EC2 Dedicated Hosts. Managed resource visibility settings control whether AWS-provisioned resources in your account appear in console views and API list operations. (6d82b78d)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-kms's changelog.

3.1079.0 (2026-07-02)

Note: Version bump only for package @​aws-sdk/client-kms

3.1078.0 (2026-07-01)

Note: Version bump only for package @​aws-sdk/client-kms

3.1077.0 (2026-06-30)

Note: Version bump only for package @​aws-sdk/client-kms

3.1076.0 (2026-06-29)

Note: Version bump only for package @​aws-sdk/client-kms

3.1075.0 (2026-06-23)

Note: Version bump only for package @​aws-sdk/client-kms

3.1074.0 (2026-06-22)

Note: Version bump only for package @​aws-sdk/client-kms

3.1073.0 (2026-06-19)

... (truncated)

Commits
  • 74dc940 Publish v3.1079.0
  • 661087f Publish v3.1078.0
  • c39b676 chore(codegen): sync for thinner command classes, endpoint parameter type fix...
  • 5c490b6 Publish v3.1077.0
  • c4b42a4 chore(codegen): sync for internal checksum impls and IMDSv2 region fallback (...
  • dfd62f6 Publish v3.1076.0
  • aa94fa0 chore(codegen): sync for checksum impls, hostLabel validation (#8127)
  • b6d6a75 chore(codegen): sync for CBOR serde performance and retry fixes (#8125)
  • 29ee199 Publish v3.1075.0
  • c48dfa0 Publish v3.1074.0
  • Additional commits viewable in compare view

Updates @hono/node-server from 2.0.4 to 2.0.8

Release notes

Sourced from @​hono/node-server's releases.

v2.0.8

What's Changed

Full Changelog: honojs/node-server@v2.0.7...v2.0.8

v2.0.7

What's Changed

Full Changelog: honojs/node-server@v2.0.6...v2.0.7

v2.0.6

What's Changed

Full Changelog: honojs/node-server@v2.0.5...v2.0.6

v2.0.5

Security Fix

Fixed a security issue in Serve Static Middleware where prefix-mounted middleware could be bypassed on Windows. This only affects applications running on Windows that use Serve Static Middleware. Affected users are encouraged to upgrade to this version.

See GHSA-frvp-7c67-39w9 for details.

Commits
  • 114c15e 2.0.8
  • 5db2d5d ci(release): add --no-git-checks option for pnpm stage publish (#369)
  • a528a77 2.0.7
  • b2d610c chore: bump supertest (#368)
  • 1b0040a fix(serve-static): serve precompressed files for application/octet-stream (#366)
  • ad5b13a chore: migrate to pnpm (#367)
  • ff75c61 2.0.6
  • 814720f fix: preserve status and statusText when cloning a Response with live headers...
  • a76209a ci: use npm Staged publishing (#364)
  • 44c365a ci: publish to npm from CI with OIDC trusted publishing and bump np (#361)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​hono/node-server since your current version.


Updates better-auth from 1.6.14 to 1.6.23

Release notes

Sourced from better-auth's releases.

v1.6.23

better-auth

Features

  • Added Yandex as a social OAuth provider (#9138)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

  • Fixed affected row counting for D1 and postgres-js adapters (#10257)

For detailed changes, see CHANGELOG

@better-auth/stripe

Bug Fixes

  • Fixed organization subscription actions (cancel, upgrade, restore, and the billing portal) that could act on the wrong organization.

For detailed changes, see CHANGELOG

auth

Bug Fixes

  • Fixed string default values not being properly escaped in the generated Drizzle schema (#10259)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​bytaesu, @​vladflotsky

Full changelog: v1.6.22...v1.6.23

v1.6.22

better-auth

Bug Fixes

  • Fixed unproven credentials not being revoked during magic link and email OTP sign-in (#10239)
  • Fixed server-side OAuth requests to refuse redirect responses instead of following them (#10241)

For detailed changes, see CHANGELOG

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.6.23

Patch Changes

  • #9138 8581f97 Thanks @​vladflotsky! - Add a pre-configured Yandex provider helper for the generic OAuth plugin.

  • Updated dependencies [930b260]:

    • @​better-auth/drizzle-adapter@​1.6.23
    • @​better-auth/core@​1.6.23
    • @​better-auth/kysely-adapter@​1.6.23
    • @​better-auth/memory-adapter@​1.6.23
    • @​better-auth/mongo-adapter@​1.6.23
    • @​better-auth/prisma-adapter@​1.6.23
    • @​better-auth/telemetry@​1.6.23

1.6.22

Patch Changes

  • #10239 c06a56d Thanks @​gustavovalverde! - Magic-link and email-OTP sign-in now reset the credentials on an account whose email had never been confirmed. When verification resolves to such an account, any existing password on it is removed and its sessions are revoked before the user is signed in, so proven control of the mailbox is the source of truth for the account.

    If you signed up with email and password but first signed in through a magic link or email OTP rather than confirming the verification email, your password is cleared and you will need to set a new one through password reset.

  • #10240 3a035e9 Thanks @​gustavovalverde! - Add account-level lockout for two-factor verification. The attempt limit applies per account across sign-in challenges and across factors: TOTP, email-OTP, and backup codes share one counter, and a successful verification resets it.

    Enabled by default: an account locks for 15 minutes after 10 consecutive failed verifications, and locked attempts return 429 with the ACCOUNT_TEMPORARILY_LOCKED error code. Configure it with twoFactor({ accountLockout: { enabled, maxFailedAttempts, durationSeconds } }).

    Run a database migration after upgrading: this adds failedVerificationCount and lockedUntil columns to the twoFactor table.

  • Updated dependencies [8bd43d9]:

    • @​better-auth/core@​1.6.22
    • @​better-auth/drizzle-adapter@​1.6.22
    • @​better-auth/kysely-adapter@​1.6.22
    • @​better-auth/memory-adapter@​1.6.22
    • @​better-auth/mongo-adapter@​1.6.22
    • @​better-auth/prisma-adapter@​1.6.22
    • @​better-auth/telemetry@​1.6.22

1.6.21

Patch Changes

  • #10212 e0762a1 Thanks @​bytaesu! - In root-mounted deployments, requests whose path does not start with the configured basePath now return 404 instead of resolving to an endpoint.

  • #10187 882cf9e Thanks @​ping-maxwell! - Admin permission changes and bans now take effect immediately for admin APIs, even when session cookie cache is enabled. Sensitive session checks also continue to work in stateless apps where signed cookies are the session record.

  • #9939 f52e1ab Thanks @​benpsnyder! - fixes a bug causing deviceAuthorization() throwing a ZodError at construction when called without a schema option

  • #10196 b5bec19 Thanks @​Paola3stefania! - OAuth sign-up and account-link profile sync now ignore provider profile values for user fields marked input: false. Input-allowed additional fields still persist from mapProfileToUser, and schema defaults still apply when OAuth creates a user. Apps that used mapProfileToUser to fill input: false fields should set those fields in server-side provisioning code instead.

... (truncated)

Commits

Updates hono from 4.12.24 to 4.12.28

Release notes

Sourced from hono's releases.

v4.12.28

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.27...v4.12.28

v4.12.27

Security fixes

This release includes fixes for the following security issues:

hono/jsx does not isolate context per request

Affects: hono/jsx, hono/jsx-renderer. During SSR, context was stored process-wide instead of per request, so useContext()/useRequestContext() read after an await in an async component could return another concurrent request's value — leading to cross-request data disclosure or authorization checks against the wrong request. GHSA-hvrm-45r6-mjfj

Server-Side XSS via JSX escaping bypass in cx()

Affects: hono/css. cx() marked its composed class name as already-escaped without escaping the input, so untrusted input passed as a class name could break out of the JSX class attribute during SSR and inject markup (XSS). GHSA-w62v-xxxg-mg59

API Gateway v1 adapter can drop a repeated request header value

Affects: hono/aws-lambda. The API Gateway v1 (and VPC Lattice) adapter de-duplicated repeated header values by substring instead of exact match, dropping a value that is a substring of another (e.g. 203.0.113.1 dropped when 203.0.113.10 is present) — affecting logic such as X-Forwarded-For-based IP restriction. GHSA-xgm2-5f3f-mvvc

Users of hono/jsx/hono/jsx-renderer, hono/css (cx()), or the hono/aws-lambda API Gateway v1 / VPC Lattice adapters are encouraged to upgrade.

v4.12.26

What's Changed

Full Changelog: honojs/hono@v4.12.25...v4.12.26

... (truncated)

Commits
  • 626b185 4.12.28
  • d6b1d32 docs(context-storage): fix JSDoc (#5086)
  • 45b081b fix(aws-lambda): detect V2 events by request context, not rawPath alone (#5033)
  • a05813c chore: bump devDependencies (#5085)
  • 872997d fix(bun): report the requested subprotocol on WSContext.protocol (#5059)
  • 82b321b fix: avoid circular dependency between body.ts and request.ts (#5071)
  • b20d422 fix(utils/body,validator): normalize Content-Type media type for case-insensi...
  • 9728702 chore: don't publish *.tsbuildinfo (#5066)
  • ed8795e docs(MIGRATION): fix req.raw.headers reference (property, not method) (#5047)
  • 03a9416 fix(serve-static): treat empty string content as found (#5062)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.


Updates @biomejs/biome from 2.4.16 to 2.5.2

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.2

2.5.2

Patch Changes

  • #10595 f458028 Thanks @​pkallos! - Added the option ignoreBooleanCoercion to useNullishCoalescing. When enabled, Biome ignores || and ||= used inside a Boolean() call, where coalescing on falsy values is intentional.

  • #10798 4a32b63 Thanks @​pkallos! - Added the option ignorePrimitives to useNullishCoalescing. When enabled, Biome ignores ||, ||=, and ternary expressions whose non-nullish operands are all primitives the option opts out of. Use true to ignore all primitives, or an object selecting string, number, boolean, or bigint.

  • #10545 f3d4c00 Thanks @​Mokto! - Added the new nursery rule noSvelteUnnecessaryStateWrap, which reports unnecessary $state() wrapping of classes from svelte/reactivity that are already reactive.

    <script>
import { SvelteMap } from "svelte/reactivity";
const map = $state(new SvelteMap()); // redundant
</script>

  • #10752 f62fb8b Thanks @​ematipico! - Fixed #10739. Now the rule useValidAutocomplete correctly flags the autoComplete attribute.

  • #10796 f1b3ab2 Thanks @​ematipico! - Fixed #10768. Improved the performance of the Biome Language Server by cancelling certain in-flight operations when there are fast updates.

  • #10719 aa649b5 Thanks @​minseong0324! - Fixed noMisleadingReturnType false positive on returns that use a widening type assertion: "a" as string is no longer reported as misleading. The rule now also reports a literal-pinning assertion such as false as false, matching the existing as const behavior.

    // No longer flagged (returns are `string`):
function getValue(b: boolean): string {
  if (b) return "a" as string;
  return "b" as string;
}
// Now also reported, like as const (returns false):
function isReady(): boolean {
return false as false;
}

  • #10678 8f073a7 Thanks @​PranavAchar01! - Fixed #7718: Biome now correctly parses CSS nesting selectors when & appears as a trailing sub-selector after a type selector, e.g. h1& { color: red; }.

  • #10756 5ec965a Thanks @​denbezrukov! - Fixed CSS formatter output for selector lists with allowWrongLineComments and // comments after a selector comma. Biome now keeps the selector before the line comment inline instead of breaking it across descendant combinators.

    -.powerPathNavigator
-  .helm
-  button.pressedButton, // pressed
+.powerPathNavigator .helm button.pressedButton, // pressed
 .powerPathNavigator .helm button:active:not(.disabledButton) {
 }

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.2

Patch Changes

  • #10595 f458028 Thanks @​pkallos! - Added the option ignoreBooleanCoercion to useNullishCoalescing. When enabled, Biome ignores || and ||= used inside a Boolean() call, where coalescing on falsy values is intentional.

  • #10798 4a32b63 Thanks @​pkallos! - Added the option ignorePrimitives to useNullishCoalescing. When enabled, Biome ignores ||, ||=, and ternary expressions whose non-nullish operands are all primitives the option opts out of. Use true to ignore all primitives, or an object selecting string, number, boolean, or bigint.

  • #10545 f3d4c00 Thanks @​Mokto! - Added the new nursery rule noSvelteUnnecessaryStateWrap, which reports unnecessary $state() wrapping of classes from svelte/reactivity that are already reactive.

    <script>
import { SvelteMap } from "svelte/reactivity";
const map = $state(new SvelteMap()); // redundant
</script>

  • #10752 f62fb8b Thanks @​ematipico! - Fixed #10739. Now the rule useValidAutocomplete correctly flags the autoComplete attribute.

  • #10796 f1b3ab2 Thanks @​ematipico! - Fixed #10768. Improved the performance of the Biome Language Server by cancelling certain in-flight operations when there are fast updates.

  • #10719 aa649b5 Thanks @​minseong0324! - Fixed noMisleadingReturnType false positive on returns that use a widening type assertion: "a" as string is no longer reported as misleading. The rule now also reports a literal-pinning assertion such as false as false, matching the existing as const behavior.

    // No longer flagged (returns are `string`):
function getValue(b: boolean): string {
  if (b) return "a" as string;
  return "b" as string;
}
// Now also reported, like as const (returns false):
function isReady(): boolean {
return false as false;
}

  • #10678 8f073a7 Thanks @​PranavAchar01! - Fixed #7718: Biome now correctly parses CSS nesting selectors when & appears as a trailing sub-selector after a type selector, e.g. h1& { color: red; }.

  • #10756 5ec965a Thanks @​denbezrukov! - Fixed CSS formatter output for selector lists with allowWrongLineComments and // comments after a selector comma. Biome now keeps the selector before the line comment inline instead of breaking it across descendant combinators.

    -.powerPathNavigator
-  .helm
-  button.pressedButton, // pressed
+.powerPathNavigator .helm button.pressedButton, // pressed
 .powerPathNavigator .helm button:active:not(.disabledButton) {
 }

  • #10757 6232fcd Thanks @​PranavAchar01! - Fixed #8269: the CSS parser now accepts Tailwind @variant and @utility names that start with a digit, such as the 2xl breakpoint.

... (truncated)

Commits

Updates @testcontainers/postgresql from 12.0.1 to 12.0.4

Release notes

Sourced from @​testcontainers/postgresql's releases.

v12.0.3

Changes

🐛 Bug Fixes

📦 Dependency Updates

v12.0.2

Changes

🐛 Bug Fixes

📦 Dependency Updates

Commits
  • 4286661 Stop Jest smoke test from flaking on babel/browserslist load (#1395)
  • c46ccae Fix container exec output truncation (#1381)
  • 8cc4bb5 Reuse insecure HTTP wait agent across retries (#1382)
  • aef8483 Bump the dependencies group across 3 directories with 2 updates (#1393)
  • 1022d61 Bump the dependencies group with 3 updates (#1394)
  • d8c015d Pin Dependabot weekly schedule to Monday (#1392)
  • b6e39e2 Document cross-language Testcontainers implementations in AGENTS.md (#1391)
  • d6d99a4 NPM audit (#1388)
  • e2c6aed Add missing languages and reorder docs navigation (#1385)
  • 9130826 Bump the dependencies group across 8 directories with 11 updates (#1386)
  • Additional commits viewable in compare view

Updates testcontainers from 12.0.1 to 12.0.4

Release notes

Sourced from testcontainers's releases.

v12.0.3

Changes

🐛 Bug Fixes

📦 Dependency Updates

v12.0.2

Changes

🐛 Bug Fixes

📦 Dependency Updates

Commits
  • 4286661 Stop Jest smoke test from flaking on babel/browserslist load (#1395)
  • c46ccae Fix container exec output truncation (#1381)
  • 8cc4bb5 Reuse insecure HTTP wait agent across retries (#1382)
  • aef8483 Bump the dependencies group across 3 directories with 2 updates (#1393)
  • 1022d61 Bump the dependencies group with 3 updates (#1394)
  • d8c015d Pin Dependabot weekly schedule to Monday (#1392)
  • b6e39e2 Document cross-language Testcontainers implementations in AGENTS.md (#1391)
  • d6d99a4 NPM audit (#1388)
  • e2c6aed Add missing languages and reorder docs navigation (

@dependabot
chore(deps)(deps): bump the auth-minor-patch group across 1 directory…
06b7b93 
… with 9 updates

Bumps the auth-minor-patch group with 9 updates in the /services/auth directory:

| Package | From | To |
| --- | --- | --- |
| [@aws-sdk/client-kms](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-kms) | `3.1063.0` | `3.1079.0` |
| [@hono/node-server](https://github.com/honojs/node-server) | `2.0.4` | `2.0.8` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.6.14` | `1.6.23` |
| [hono](https://github.com/honojs/hono) | `4.12.24` | `4.12.28` |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.4.16` | `2.5.2` |
| [@testcontainers/postgresql](https://github.com/testcontainers/testcontainers-node) | `12.0.1` | `12.0.4` |
| [testcontainers](https://github.com/testcontainers/testcontainers-node) | `12.0.1` | `12.0.4` |
| [tsx](https://github.com/privatenumber/tsx) | `4.22.4` | `4.23.0` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.8` | `4.1.10` |



Updates `@aws-sdk/client-kms` from 3.1063.0 to 3.1079.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-kms/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1079.0/clients/client-kms)

Updates `@hono/node-server` from 2.0.4 to 2.0.8
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v2.0.4...v2.0.8)

Updates `better-auth` from 1.6.14 to 1.6.23
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.6.23/packages/better-auth)

Updates `hono` from 4.12.24 to 4.12.28
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.24...v4.12.28)

Updates `@biomejs/biome` from 2.4.16 to 2.5.2
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.2/packages/@biomejs/biome)

Updates `@testcontainers/postgresql` from 12.0.1 to 12.0.4
- [Release notes](https://github.com/testcontainers/testcontainers-node/releases)
- [Commits](testcontainers/testcontainers-node@v12.0.1...v12.0.4)

Updates `testcontainers` from 12.0.1 to 12.0.4
- [Release notes](https://github.com/testcontainers/testcontainers-node/releases)
- [Commits](testcontainers/testcontainers-node@v12.0.1...v12.0.4)

Updates `tsx` from 4.22.4 to 4.23.0
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.22.4...v4.23.0)

Updates `vitest` from 4.1.8 to 4.1.10
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-kms"
  dependency-version: 3.1079.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: auth-minor-patch
- dependency-name: "@hono/node-server"
  dependency-version: 2.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: auth-minor-patch
- dependency-name: better-auth
  dependency-version: 1.6.23
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: auth-minor-patch
- dependency-name: hono
  dependency-version: 4.12.28
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: auth-minor-patch
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: auth-minor-patch
- dependency-name: "@testcontainers/postgresql"
  dependency-version: 12.0.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: auth-minor-patch
- dependency-name: testcontainers
  dependency-version: 12.0.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: auth-minor-patch
- dependency-name: tsx
  dependency-version: 4.23.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: auth-minor-patch
- dependency-name: vitest
  dependency-version: 4.1.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: auth-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jul 6, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: typescript. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 6, 2026
@dependabot
dependabot Bot requested a review from Aztec03hub as a code owner July 6, 2026 11:56
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 6, 2026
@github-actions

github-actions Bot commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

auto-recover: Trivy scan failed. Top finding:\n\n\n2026-07-06T11:57:37.0673935Z │ starlette │ CVE-2026-48818 │ HIGH │ fixed │ 1.0.0 │ 1.1.0 │ starlette: Starlette: SSRF and NTLM credential theft via UNC │\n\n\nMitigation options: (a) bump the affected dep to a fixed version, (b) if unfixed-upstream, add to .trivyignore with a comment and TODO date, (c) pass --ignore-unfixed if the workflow does not already (it does on this repo, so this case implies a real fixable CVE).

@dependabot @github

dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Jul 27, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/services/auth/auth-minor-patch-1915d5d71d branch July 27, 2026 11:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Aztec03hub Aztec03hub Awaiting requested review from Aztec03hub Aztec03hub is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file needs-trivy-fix

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants