build(deps): Bump the npm-production group with 5 updates by dependabot[bot] · Pull Request #26 · SafetyMP/Autonomous-EHS-Management

dependabot · 2026-06-07T10:24:18Z

Bumps the npm-production group with 5 updates:

Package	From	To
@tanstack/react-query	`5.100.14`	`5.101.0`
better-auth	`1.6.12`	`1.6.14`
next	`16.2.6`	`16.2.7`
react	`19.2.6`	`19.2.7`
react-dom	`19.2.6`	`19.2.7`

Updates @tanstack/react-query from 5.100.14 to 5.101.0

Release notes

Sourced from @tanstack/react-query's releases.

@tanstack/react-query-devtools@5.101.0

Patch Changes

Updated dependencies [3042860, e631dc3]:

@tanstack/query-devtools@5.101.0

@tanstack/react-query@5.101.0

@tanstack/react-query-next-experimental@5.101.0

Patch Changes

#10857 7cf5923 - fix(react-query-next-experimental): replace deprecated 'isServer' with 'environmentManager.isServer()'

Updated dependencies []:

@tanstack/react-query@5.101.0

@tanstack/react-query-persist-client@5.101.0

Patch Changes

Updated dependencies []:

@tanstack/query-persist-client-core@5.101.0

@tanstack/react-query@5.101.0

@tanstack/react-query@5.101.0

Patch Changes

Updated dependencies []:

@tanstack/query-core@5.101.0

Changelog

Sourced from @tanstack/react-query's changelog.

5.101.0

Patch Changes

Updated dependencies []:

@tanstack/query-core@5.101.0

Commits

f3d8d2a ci: Version Packages (#10774)
532bb29 fix(tests): disable local coverage instrumentation (#10776)
See full diff in compare view

Updates better-auth from 1.6.12 to 1.6.14

Release notes

Sourced from better-auth's releases.

v1.6.14

better-auth

Bug Fixes

Fixed Google One Tap authenticating the wrong user when the presented Google account was already linked to a different local user.

Fixed null values being rejected for optional fields in the generated database schema (#9841)

Fixed getSessionCookie to prefer the __Secure- prefixed cookie over a non-secure leftover, preventing a stale cookie from shadowing the current session (#9806)

Fixed redirect URI validation to work on all supported runtimes and to reject URIs containing a fragment component per RFC 6749 §3.1.2 (#9845)

Fixed organization invitation verification to restore the normal emailed-invitation flow while enforcing stricter email verification for externally controlled or predictable invitation IDs (#9877)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

Fixed SAML Single Logout leaving the user signed in due to the logout handlers matching the session by ID instead of token.

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@bytaesu, @gustavovalverde

Full changelog: v1.6.13...v1.6.14

v1.6.13

better-auth

Features

Added support for server-side accountInfo calls with an optional userId parameter, allowing trusted callers to read provider profiles without constructing session headers (#9813)

Bug Fixes

Clarified that viewBackupCodes is a server-only function not accessible via HTTP in its API documentation (#9822)

Fixed Google One Tap authenticating the wrong user when the presented Google account is already linked to a different local user, by resolving identity through the shared OAuth path

Fixed storeStateStrategy defaulting to "cookie" instead of "database" when only secondaryStorage is configured, preventing oversized-cookie errors on platforms like AWS Lambda (#9591)

Fixed updateUserInfoOnLink not being applied when linking accounts through the standard OAuth redirect flow (#8758)

Fixed oidc-provider and mcp plugins accepting invalid redirect_uri schemes such as javascript: and data: (#9838)

Fixed organization logo not accepting null, preventing users from clearing an existing logo on create and update (#9842)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.6.14

Patch Changes

#9877 2d9781a Thanks @gustavovalverde! - Restore the normal emailed-invitation flow while documenting the stricter verification posture for organization invitations.

Client-side listUserInvitations now always requires a verified session email because it enumerates invitation IDs from session.user.email. The requireEmailVerificationOnInvitation option now controls recipient calls that carry an invitation ID (acceptInvitation, rejectInvitation, getInvitation). When unset, Better Auth keeps the emailed-invitation sign-up flow for built-in opaque invitation IDs, including the default generator or advanced.database.generateId: "uuid", and requires verified email when invitation IDs are externally controlled or predictable, such as advanced.database.generateId: "serial" / false or custom ID generation. Apps that expose invitation IDs outside the invited user's mailbox, expose organization invitation lists to members, or require stricter ownership proof should set requireEmailVerificationOnInvitation: true or require verified email before sign-in.

#9841 5a2d642 Thanks @bytaesu! - Optional fields (required: false) now accept null, not just omission. The generated input validation previously rejected null even though the column is nullable, so a nullable field could not be cleared by passing null.

#9845 13abc79 Thanks @gustavovalverde! - Harden redirect-URI validation across the OAuth provider plugins. isSafeUrlScheme and SafeUrlSchema no longer call URL.canParse, which is absent on some supported runtimes and could throw or silently disable the dangerous-scheme check. They now parse with a try/catch fallback. SafeUrlSchema also rejects redirect URIs that contain a fragment component, per RFC 6749 §3.1.2.

#9806 9d3450a Thanks @bytaesu! - getSessionCookie now prefers the __Secure- cookie when both it and a non-secure cookie are present, so the non-secure cookie no longer shadows the current session cookie.

Updated dependencies [13abc79]:

@better-auth/core@1.6.14

@better-auth/drizzle-adapter@1.6.14

@better-auth/kysely-adapter@1.6.14

@better-auth/memory-adapter@1.6.14

@better-auth/mongo-adapter@1.6.14

@better-auth/prisma-adapter@1.6.14

@better-auth/telemetry@1.6.14

1.6.13

Patch Changes

#9813 d3919dc Thanks @gustavovalverde! - Support server-side accountInfo calls without session headers.

auth.api.accountInfo now accepts an optional userId, so a trusted server-side caller can read a user's provider profile without constructing session headers. This mirrors getAccessToken and refreshToken. HTTP callers still require a valid session, and a session always takes precedence over a supplied userId.

The shared "resolve the target user, then fetch a valid access token" logic behind these three endpoints now lives in one place. As part of that, a server-side call that supplies neither a session nor a userId reports USER_ID_OR_SESSION_REQUIRED (400) consistently, rather than UNAUTHORIZED on some endpoints.

#9591 5f282bd Thanks @Vishesh-Verma-07! - When only secondaryStorage is configured (no primary database), storeStateStrategy now defaults to "database" instead of "cookie", preventing oversized-cookie errors on platforms like AWS Lambda. The account cookie that holds OAuth tokens in database-less setups stays enabled, so getAccessToken keeps working.

#9818 43c08a2 Thanks @gustavovalverde! - Fix two buggy internalAdapter helpers.

Remove findAccount(accountId). It looked accounts up by account ID alone, which is unique neither across providers nor across users, so it returned a non-deterministic match. All callers now use a user-scoped or provider-scoped lookup.

Replace the ambiguous deleteSessions(string | string[]) with two explicit methods. deleteUserSessions(userId) revokes every session for a user, and deleteSessions(tokens) revokes sessions by token. The old single-string overload silently treated its argument as a user ID, so a caller that meant to delete one session token could instead wipe all of a user's sessions or quietly match nothing.

#9818 43c08a2 Thanks @gustavovalverde! - Fix Google One Tap signing in the wrong user when the presented Google account is already linked to someone else. One Tap now resolves identity through the shared OAuth path, so the user who owns the Google subject is signed in, matching the redirect and signIn.social flows. Previously it matched a local user by the token's email and used the subject only to decide linking, so a Google credential owned by one user could authenticate a different user who happened to share that email.

/account-info now resolves the account from the signed-in user's own linked accounts and accepts an optional providerId to disambiguate when two providers issue the same account ID. A colliding account ID returns a distinct AMBIGUOUS_ACCOUNT error instead of a misleading "not found", and an account with no configured social provider returns a 400 rather than a 500.

#9838 be32012 Thanks @gustavovalverde! - Validate the scheme of OAuth redirect_uris in the oidc-provider and mcp plugins.

Both plugins previously accepted any string as a redirect_uri at registration. They now reject the javascript:, data:, and vbscript: schemes, which are never valid OAuth redirect targets. The @better-auth/oauth-provider package already applied this check, so this change brings the two older plugins in line with it.

... (truncated)

Commits

5038d41 chore: release v1.6.14 (#9846)
2d9781a fix(organization): split invitation verification gates (#9877)
5a2d642 fix: accept null for optional fields in generated schema (#9841)
9d3450a fix(cookies): prefer __Secure- cookie in getSessionCookie (#9806)
a6f38c7 chore: release v1.6.13 (#9804)
87c1a0c fix(organization): allow null logo on create and update (#9842)
be32012 fix(oauth): validate redirect_uri schemes in oidc-provider and mcp (#9838)
9c8ded6 docs(two-factor): mark viewBackupCodes as server-only in its API comment (#...
43c08a2 fix(account): scope OAuth account identity and fix buggy internalAdapter help...
23d7cbf fix(oauth): apply updateUserInfoOnLink in OAuth callback link flow (#8758)
Additional commits viewable in compare view

Updates next from 16.2.6 to 16.2.7

Release notes

Sourced from next's releases.

v16.2.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

Backport documentation fixes for v16.2 (#93804)

[backport] Patch playwright-core to resolve _finishedPromise on requestFailed (#93920)

[backport] Fix dev mode hydration failure when page is served from HTTP cache (#93492)

[backport] Fix catch-all router.query corruption with basePath + rewrites (#93917)

[backport] Encode non-ASCII characters in cache tags at construction (#93918)

[backport] Fix server action forwarding loop with middleware rewrites (#93919)

[backport] Turbopack: switch from base40 to base38 hash encoding (#93932)

[ci] Disable hanging node 24 typescript tests on 16.2 backport branch (#94164)

[backport] Fix "type: module" in project dir when using standalone or adapters (#94050)

[backport] Propagate adapter preferred regions (#94200)

[16.2.x] Don't drop FormData entries (#94240)

[backport] feat(turbopack): add LocalPathOrProjectPath PostCSS config resolution (#94284)

Credits

Huge thanks to @eps1lon, @icyJoseph, @unstubbable, @mischnic, @bgw, @timneutkens, and @lukesandberg for helping!

Commits

9bd3c26 v16.2.7
c63224f [backport] feat(turbopack): add LocalPathOrProjectPath PostCSS config resolut...
63115c7 [16.2.x] Don't drop FormData entries (#94240)
aef22fd [backport] Propagate adapter preferred regions (#94200)
f126e72 [backport] Fix "type: module" in project dir when using standalone or adapter...
bda3e2a [ci] Disable hanging node 24 typescript tests on 16.2 backport branch (#94164)
7e16e07 [backport] Turbopack: switch from base40 to base38 hash encoding (#93932)
6139f4b [backport] Fix server action forwarding loop with middleware rewrites (#93919)
c021d10 [backport] Encode non-ASCII characters in cache tags at construction (#93918)
9184ddb [backport] Fix catch-all router.query corruption with basePath + `rewrite...
Additional commits viewable in compare view

Updates react from 19.2.6 to 19.2.7

Release notes

Sourced from react's releases.

19.2.7 (June 1st, 2026)

React Server Components

Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (#36566 by @unstubbable)

Commits

6117d7c Version 19.2.7 (#36591)
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react since your current version.

Updates react-dom from 19.2.6 to 19.2.7

Release notes

Sourced from react-dom's releases.

19.2.7 (June 1st, 2026)

React Server Components

Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (#36566 by @unstubbable)

Commits

6117d7c Version 19.2.7 (#36591)
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react-dom since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the npm-production group with 5 updates: | Package | From | To | | --- | --- | --- | | [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.100.14` | `5.101.0` | | [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.6.12` | `1.6.14` | | [next](https://github.com/vercel/next.js) | `16.2.6` | `16.2.7` | | [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `19.2.6` | `19.2.7` | | [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `19.2.6` | `19.2.7` | Updates `@tanstack/react-query` from 5.100.14 to 5.101.0 - [Release notes](https://github.com/TanStack/query/releases) - [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md) - [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.101.0/packages/react-query) Updates `better-auth` from 1.6.12 to 1.6.14 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/better-auth@1.6.14/packages/better-auth) Updates `next` from 16.2.6 to 16.2.7 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v16.2.6...v16.2.7) Updates `react` from 19.2.6 to 19.2.7 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react) Updates `react-dom` from 19.2.6 to 19.2.7 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react-dom) --- updated-dependencies: - dependency-name: "@tanstack/react-query" dependency-version: 5.101.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-production - dependency-name: better-auth dependency-version: 1.6.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-production - dependency-name: next dependency-version: 16.2.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-production - dependency-name: react dependency-version: 19.2.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-production - dependency-name: react-dom dependency-version: 19.2.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-production ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-06-07T10:24:19Z

Labels

The following labels could not be found: dependencies, javascript. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

vercel · 2026-06-07T10:24:22Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
autonomous-ehs-management	Ready	Preview, Comment	Jun 7, 2026 10:26am

dependabot · 2026-06-14T10:23:31Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

vercel Bot deployed to Preview June 7, 2026 10:26 View deployment

dependabot Bot closed this Jun 14, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/npm-production-d625104b0f branch June 14, 2026 10:23

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): Bump the npm-production group with 5 updates#26

build(deps): Bump the npm-production group with 5 updates#26
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-production-d625104b0f

dependabot Bot commented on behalf of github Jun 7, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Jun 7, 2026

Uh oh!

vercel Bot commented Jun 7, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Jun 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jun 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

@​tanstack/react-query-devtools@​5.101.0

Patch Changes

@​tanstack/react-query-next-experimental@​5.101.0

Patch Changes

@​tanstack/react-query-persist-client@​5.101.0

Patch Changes

@​tanstack/react-query@​5.101.0

Patch Changes

5.101.0

Patch Changes

v1.6.14

better-auth

Bug Fixes

@better-auth/sso

Bug Fixes

Contributors

v1.6.13

better-auth

Features

Bug Fixes

@better-auth/sso

Bug Fixes

1.6.14

Patch Changes

1.6.13

Patch Changes

v16.2.7

Core Changes

Credits

19.2.7 (June 1st, 2026)

React Server Components

19.2.7 (June 1st, 2026)

React Server Components

Uh oh!

dependabot Bot commented on behalf of github Jun 7, 2026

Labels

Uh oh!

vercel Bot commented Jun 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dependabot Bot commented on behalf of github Jun 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jun 7, 2026 •

edited

Loading

`@tanstack/react-query-devtools@5`.101.0

`@tanstack/react-query-next-experimental@5`.101.0

`@tanstack/react-query-persist-client@5`.101.0

`@tanstack/react-query@5`.101.0

`better-auth`

`@better-auth/sso`

`better-auth`

`@better-auth/sso`

vercel Bot commented Jun 7, 2026 •

edited

Loading