chore(deps): bump the production-dependencies group with 2 updates

[dependabot]

Bumps the production-dependencies group with 2 updates: better-auth and openai.

Updates better-auth from 1.6.25 to 1.6.26

Release notes

Sourced from better-auth's releases.

v1.6.26

better-auth

Bug Fixes

• Fixed session cleanup on user deletion to also remove sessions from secondary storage (#10520)
• Fixed findSessions to skip invalid secondary-storage session entries without discarding other valid sessions (#10580)
• Fixed email OTP sign-up to pass the verification type to custom OTP generators (#10608)
• Fixed email OTP password reset to allow retrying after entering an invalid password (#10552)
• Fixed email OTP verification to no longer reveal whether an email is registered before the OTP is verified (#10605)
• Fixed jwtClient() collapsing createAuthClient type inference when combined with other client plugins (#10513)
• Fixed JWT key minting inside database transactions to use the transaction-scoped adapter, preventing deadlocks on SQLite and ensuring keys commit with their surrounding transaction on Postgres and MySQL (#10623)
• Fixed oAuthProxy to preserve Apple user data from form_post callbacks (#10599)
• Fixed oneTapClient() collapsing createAuthClient type inference when combined with other client plugins (#10635)
• Fixed database rate-limit cleanup to complete when no background task handler is configured (#10619)
• Improved nextCookies performance in instrumented Next.js applications by reusing the next/headers import promise (#10467)

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added a utility for creating stable, namespaced placeholder emails on the reserved placeholder.invalid domain (#10576)

For detailed changes, see CHANGELOG

@better-auth/redis-storage

Bug Fixes

• Fixed listKeys() and clear() to use SCAN instead of KEYS so large keyspaces no longer block the Redis server (#10507)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​bytaesu, @​Emmaccen, @​gustavovalverde, @​jashkarangiya, @​jeroenvandermerwe, @​jlucaso1, @​krish-vachhani, @​mrosberghaus, @​XXMOHAMED012

Full changelog: v1.6.25...v1.6.26

Changelog

Sourced from better-auth's changelog.

1.6.26

Patch Changes

• #10619 9ede805 Thanks @​jeroenvandermerwe! - Ensure database rate-limit cleanup completes when no background task handler is configured.

• #10608 5a811f1 Thanks @​bytaesu! - Pass the email verification type to custom OTP generators after email sign-up.

• #10605 d8327f1 Thanks @​XXMOHAMED012! - The email OTP verification check no longer reveals whether an email is registered before the OTP itself is verified.

• #10513 e2c73fb Thanks @​mrosberghaus! - Fix jwtClient() collapsing createAuthClient type inference when combined with other client plugins such as inferAdditionalFields. Additional user fields (for example on updateUser) are preserved again.

• #10635 af50c45 Thanks @​krish-vachhani! - Fix oneTapClient() collapsing createAuthClient type inference when combined with other client plugins. The oneTap action is available on the client again.

• #10633 701cd43 Thanks @​gustavovalverde! - Minting or reading a JWKS signing key inside an active database transaction now uses the transaction-scoped adapter instead of the root connection. On a single-connection SQLite database with native transactions enabled, this no longer deadlocks, and on Postgres and MySQL the key commits with the surrounding transaction instead of independently of it.

• #10599 e7b0eba Thanks @​bytaesu! - Preserve Apple user data from form_post callbacks when using oAuthProxy.

• #10552 2b4a14f Thanks @​bytaesu! - Allow users to retry email OTP password resets after entering an invalid password.

• #10467 7552a3b Thanks @​jlucaso1! - Improve nextCookies performance in instrumented Next.js applications.

• #10580 ea38fca Thanks @​Emmaccen! - Skip invalid secondary-storage session entries without discarding other valid sessions.

• #10520 a03e4c1 Thanks @​bytaesu! - Ensure deleting a user also removes their sessions from secondary storage.

• Updated dependencies [a30e274]:

  • @​better-auth/core@​1.6.26
  • @​better-auth/drizzle-adapter@​1.6.26
  • @​better-auth/kysely-adapter@​1.6.26
  • @​better-auth/memory-adapter@​1.6.26
  • @​better-auth/mongo-adapter@​1.6.26
  • @​better-auth/prisma-adapter@​1.6.26
  • @​better-auth/telemetry@​1.6.26

Commits

• a16b30e chore: release v1.6.26 (#10521)
• 9ede805 fix(rate-limit): await database cleanup by default (#10619)
• af50c45 fix(one-tap): preserve client plugin inference with oneTapClient (#10635)
• 222facf fix(jwt): resolve the transaction-scoped adapter when signing (#10623)
• d8327f1 fix(email-otp): verify OTP before revealing whether the email exists (#10605)
• e7b0eba fix(oauth-proxy): preserve Apple user data (#10599)
• 5a811f1 fix(email-otp): pass verification type on sign-up (#10608)
• e18606b chore(deps): upgrade OpenTelemetry to v2 (#10601)
• ea38fca fix(db): skip null-parsed session token in findSessions instead of returning ...
• 7552a3b perf(next-js): reuse the next/headers import promise in production (#10467)
• Additional commits viewable in compare view

Updates openai from 7.3.0 to 7.4.0

Release notes

Sourced from openai's releases.

v7.4.0

7.4.0 (2026-08-03)

Features

• api: Add gpt-5.5 model and tool metadata fields (#2049) (6d8fb53)

Bug Fixes

• defer release PR output parsing (#2052) (395bdde)

Documentation

• add HTTP mTLS transport examples (#2029) (2cc5f96)

Build System

• deps-dev: bump @​smithy/hash-node from 4.3.5 to 4.4.15 (#2064) (481b325)
• deps-dev: bump @​types/web from 0.0.194 to 0.0.354 (#2061) (f61f267)
• deps-dev: bump publint from 0.2.12 to 0.3.22 (#2058) (823d7df)
• deps: bump dotenv from 16.6.1 to 17.4.2 (#2065) (3576574)
• deps: bump fast-uri from 3.1.4 to 3.1.5 in /ecosystem-tests/vercel-edge (#2050) (590982f)
• deps: bump ip-address from 10.2.0 to 10.4.0 in /ecosystem-tests/vercel-edge (#2056) (4d927de)
• migrate release workflow to upstream release-please (#2048) (d41c272)

Changelog

Sourced from openai's changelog.

7.4.0 (2026-08-03)

Features

• api: Add gpt-5.5 model and tool metadata fields (#2049) (6d8fb53)

Bug Fixes

• defer release PR output parsing (#2052) (395bdde)

Documentation

• add HTTP mTLS transport examples (#2029) (2cc5f96)

Build System

• deps-dev: bump @​smithy/hash-node from 4.3.5 to 4.4.15 (#2064) (481b325)
• deps-dev: bump @​types/web from 0.0.194 to 0.0.354 (#2061) (f61f267)
• deps-dev: bump publint from 0.2.12 to 0.3.22 (#2058) (823d7df)
• deps: bump dotenv from 16.6.1 to 17.4.2 (#2065) (3576574)
• deps: bump fast-uri from 3.1.4 to 3.1.5 in /ecosystem-tests/vercel-edge (#2050) (590982f)
• deps: bump ip-address from 10.2.0 to 10.4.0 in /ecosystem-tests/vercel-edge (#2056) (4d927de)
• migrate release workflow to upstream release-please (#2048) (d41c272)

Commits

• 83c437f release: 7.4.0 (#2055)
• a97cbff ci: prepare checks for merge queue (#2066)
• 481b325 build(deps-dev): bump @​smithy/hash-node from 4.3.5 to 4.4.15 (#2064)
• 3576574 build(deps): bump dotenv from 16.6.1 to 17.4.2 (#2065)
• 823d7df build(deps-dev): bump publint from 0.2.12 to 0.3.22 (#2058)
• f61f267 build(deps-dev): bump @​types/web from 0.0.194 to 0.0.354 (#2061)
• 85ea6b2 [dependabot] Configure a seven-day npm cooldown (#2054)
• 4d927de build(deps): bump ip-address from 10.2.0 to 10.4.0 in /ecosystem-tests/vercel...
• 590982f build(deps): bump fast-uri from 3.1.4 to 3.1.5 in /ecosystem-tests/vercel-edg...
• 6d8fb53 feat(api): Add gpt-5.5 model and tool metadata fields (#2049)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[StuartMeeks]

Automated approval: version-update:semver-minor dependency update.