Skip to content

chore(deps): bump the npm-deps group with 5 updates - #67

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-deps-6f42531363
Open

chore(deps): bump the npm-deps group with 5 updates#67
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-deps-6f42531363

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 27, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-deps group with 5 updates:

Package From To
@better-auth/oauth-provider 1.6.27 1.7.1
@hono/node-server 2.1.0 2.1.1
better-auth 1.6.27 1.7.1
hono 4.13.1 4.13.3
fallow 3.15.0 3.17.0

Updates @better-auth/oauth-provider from 1.6.27 to 1.7.1

Release notes

Sourced from @​better-auth/oauth-provider's releases.

v1.7.1

better-auth

Bug Fixes

  • Added native database transaction support to test instances for PostgreSQL and MySQL.
  • Updated bundled dependencies (jose, nanostores, noble crypto packages, SimpleWebAuthn) to their latest compatible releases, with no changes required to existing projects.

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

  • Fixed case-insensitive parsing of string Boolean values for SCIM User active and the primary sub-attribute of emails, phoneNumbers, addresses, roles, and entitlements at the HTTP ingress, improving Microsoft Entra interoperability.
  • Added an optional SCIM-owned connection and credential catalog: configure managedConnections to allow trusted server code to create runtime tenant connections and issue, rotate, and revoke bearer credentials through server-only auth.api methods, without a code-defined connection or an application-owned verifier.
  • Fixed an issue where trusted server code could not retain a terminal connection binding before a dynamic SCIM connection's first authenticated request when supplying a provisioning domain during decommissioning.

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

  • Fixed SSO provider registration to allow reusing a SCIM connection ID, as SCIM connections no longer participate in the authentication provider namespace.
  • Fixed SAML assertion signature verification to validate signatures on the raw assertion instead of trusting an already-parsed response, and enforced signing policy and size limits on SP metadata. wantAssertionsSigned now correctly controls whether the SP requires signed assertions, matching real-world IdP signing behavior.

For detailed changes, see CHANGELOG

@better-auth/cimd

Bug Fixes

  • Fixed Client ID Metadata Document caching to follow shared-cache freshness rules: the plugin now prefers s-maxage over max-age and Expires, honors s-maxage=0, conditionally revalidates with ETag or Last-Modified, and treats invalid or duplicate freshness directives as immediately stale. Concurrent refreshes now converge on a single client-resource link instead of failing on a unique constraint.

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

  • Fixed native adapter transactions for raw database instances (better-sqlite3, node:sqlite, bun:sqlite, mysql2, pg) passed directly as database, matching the behavior of the explicit { db }/{ dialect } config shapes. Plugins requiring native transactions (such as @better-auth/scim) now work correctly when using the quickstart database: new Database(...) form.

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

  • Fixed scope error responses so MCP clients now receive a 403 with an RFC 6750 insufficient_scope WWW-Authenticate challenge naming every missing scope, allowing clients to request all needed scopes in a single authorization request.

... (truncated)

Changelog

Sourced from @​better-auth/oauth-provider's changelog.

1.7.1

1.7.0

Minor Changes

  • #10577 5c45abc Thanks @​gustavovalverde! - OAuth clients now store applicationType and expose it as application_type in OAuth metadata. tokenEndpointAuthMethod alone determines authentication: "none" is public, and every other method is confidential. The legacy type and public fields are removed.

    OAuthClient no longer has a catch-all string index. Model custom wire extensions explicitly with a named intersection such as OAuthClient & YourExtensionMetadata; legacy type and public fields no longer type-check as unknown baggage.

    • Dynamic, administrative, and user-managed registrations default an omitted application_type to web. Client ID Metadata Documents preserve an omitted value as null.
    • Web redirects require HTTPS on a non-loopback host. Native redirects accept claimed HTTPS URLs, exact HTTP loopback hosts, or reverse-domain private-use schemes.
    • Registration resource options control resource links. mcp() contributes its protected resource by default, so standards-based clients no longer need a resources extension.
    • mcp() no longer enables unauthenticated Dynamic Client Registration. Compose mcp() with cimd() for Client ID Metadata Documents, or enable both DCR flags explicitly.

    This release requires a database migration. Add applicationType and nullable clientDiscoveryId; map old web and native values directly, map user-agent-based to NULL for manual reclassification, and never derive it from public. Set clientDiscoveryId only from known discovery provenance, never by inspecting an HTTPS client ID. Deduplicate existing (clientId, resourceId) links before adding the new compound unique index, then drop the legacy columns. Deployments with custom schema mappings must apply this backfill manually.

    Machine-to-machine scope authority is now stored separately in nullable oauthClient.clientCredentialsScopes. Missing, NULL, and empty values deny client_credentials token issuance. Only the administrative create and update endpoints expose client_credentials_scopes, and assigning a non-empty value requires clientPrivileges to approve the new configure-client-credentials-scopes action. DCR, CIMD, and user-managed registration cannot assign this field; CIMD refresh preserves an existing administrator-owned value. Remove clientCredentialGrantDefaultScopes, backfill every existing client to [], configure [] as the default for new rows, then explicitly assign every approved machine scope after auditing the client.

  • #10577 5c45abc Thanks @​gustavovalverde! - Client ID Metadata Documents now follow shared-cache freshness rules and fail closed when freshness is ambiguous. The plugin prefers s-maxage over max-age and Expires, honors s-maxage=0, conditionally revalidates with ETag or Last-Modified, and treats invalid or duplicate freshness directives as immediately stale. Concurrent refreshes converge on one client-resource link instead of failing on its unique constraint.

    Shared OAuth metadata validation now rejects a blank client_name without trimming a valid display name. Native private-use redirects require the RFC 8252 single-slash form, such as com.example.app:/callback. Native HTTP redirects accept only exact localhost, 127.0.0.1, or [::1] hosts; other 127.0.0.0/8 addresses and localhost subdomains are rejected.

    CIMD now bounds metadata request amplification through metadataFetchPolicy: same-client fetches coalesce, per-client pacing and global/per-origin concurrency reject immediately, and rolling 60-second budgets cap unique-client sprays. HTTP no-store, private, and Vary: * behavior is unchanged and never feeds metadata or validators into the governor.

    Node.js deployments can import fetchClientMetadataResource from @better-auth/cimd/node. The transport resolves once, rejects any non-public DNS answer, pins the approved connection without using the global HTTPS pool, preserves Host and TLS certificate identity, and returns redirects and response bodies without buffering. Other runtimes remain responsible for providing an equivalent secure transport.

    Unknown draft-02 metadata members are now ignored and never persisted. Recognized secrets, privilege fields, and server controls remain fatal, while generic internal aliases and nonstandard client-credentials authority spellings are stripped.

  • #9159 cd8313b Thanks @​gustavovalverde! - Add @better-auth/cimd for Client ID Metadata Document draft-02. An exact HTTPS metadata-document URL becomes the OAuth client_id, and OAuth discovery advertises support when the plugin is installed. The explicit metadataProfile: "mcp-2026-07-28" mode applies the draft-00 metadata requirements pinned by MCP 2026-07-28.

    • Validate the complete shared OAuth client metadata schema. Generic draft-02 clients may omit client_name and redirect_uris and may use any grant supported by the OAuth Provider; the MCP profile requires client_id, client_name, and redirect_uris.
    • Reject client secrets, private JWK material, back-channel logout metadata, server-owned fields, unsafe metadata URLs, non-JSON responses, oversized documents, redirects, and private or reserved network targets. Loopback Client Identifier URLs are no longer supported.
    • Validate registered, discovered, and remotely fetched client JWKS through one public-asymmetric-key boundary. RFC 7517 JWK Sets must use { "keys": [...] }; replace the removed bare-array form jwks: [key] with jwks: { keys: [key] }. Empty, malformed, symmetric, private, and unsupported key sets fail before they can enter a provider-scoped cache. EC keys must use P-256, P-384, or P-521; OKP keys must use Ed25519. A declared alg must match the key type and curve. Existing OAuth client rows written through oauthToSchema are already normalized, so no database rewrite is required unless rows were written outside Better Auth.
    • Require fetchClientMetadataResource as the deployment-owned transport for both metadata documents and discovery-owned jwks_uri resources. It must resolve once, reject RFC 6890 special-use addresses, pin the approved address for the connection, and refuse redirects. isMetadataDocumentUrlAllowed remains available for additional application policy.
    • Cache only valid successful metadata with bounded storage, HTTP shared-cache freshness rules, ETag and Last-Modified conditional revalidation, and fail-closed refresh behavior. Cache-Control: private and Vary: * are noncacheable, and an unconditional 304 is rejected.
    • Persist oauthClient.clientDiscoveryId as nullable discovery provenance. Discovery IDs are globally unique, and an owned client fails closed when its matching discovery is unavailable. Only that discovery may refresh the client or provide transport for its metadata-owned resources, so managed and DCR HTTPS client IDs cannot be taken over.
    • Preserve custom model names, resource links, and administrator-controlled client flags when clients are created or refreshed. Refresh notifications now receive previousClient.

    OAuth Provider also exposes clientDiscovery for custom verified client-resolution plugins. A discovery may provide fetchClientMetadataResource, and its stable id is persisted as client provenance.

    Prerelease adopters must rename createCimdResolver or cimdClientDiscovery to createCimdClientDiscovery, ClientIdMetadataDocumentResult to CimdMetadataValidationResult, ValidateCimdMetadataOptions to CimdMetadataValidationOptions, isUrlClientId to isCimdClientIdUrlCandidate, and MetadataDocumentFetch to ClientMetadataResourceFetch. Rename refreshRate to metadataRevalidationInterval; there is no compatibility fallback. Numeric revalidation and minimumFetchInterval values are seconds.

    Lifecycle callbacks now receive named CimdClientCreatedEvent and CimdClientRefreshedEvent values. Read validated metadata from clientMetadataDocument instead of metadata, and the endpoint context from context instead of ctx. CimdOptions is now required because fetchClientMetadataResource is mandatory. Remove the prerelease allowFetch, fetchMetadataDocument, and allowLoopback options.

    When adopting CIMD, remove allowUnauthenticatedClientRegistration unless the authorization server deliberately supports Dynamic Client Registration as a separate fallback.

  • #10746 6782647 Thanks @​gustavovalverde! - OAuth device grants now use oauthDeviceAuthorization() alongside oauthProvider() or mcp(). This single integration replaces both the standalone deviceCodeGrant() plugin and the shared-grant configuration. Standalone Device Authorization no longer accepts or stores RFC 8707 resources, and onDeviceAuthRequest receives only clientId and scope. The OAuth integration rejects resource indicators that are not absolute, fragment-free URIs.

    The OAuth integration replaces the optional resource column with oauthClientId and resources. Regenerate and apply the schema when using it. Before upgrading from an earlier 1.7 prerelease, let pending OAuth device codes expire or delete them because they cannot be exchanged through the new integration.

  • #10156 e3125e8 Thanks @​gustavovalverde! - The OIDC provider now honors the claims.userinfo authorization request parameter. A client can ask for individual standard claims, and the UserInfo endpoint returns the ones it can supply in addition to the scope-granted claims. The requested claims become part of the user's consent, and claims_parameter_supported is advertised in discovery.

... (truncated)

Commits

Updates @hono/node-server from 2.1.0 to 2.1.1

Release notes

Sourced from @​hono/node-server's releases.

v2.1.1

What's Changed

Full Changelog: honojs/node-server@v2.1.0...v2.1.1

Commits

Updates better-auth from 1.6.27 to 1.7.1

Release notes

Sourced from better-auth's releases.

v1.7.1

better-auth

Bug Fixes

  • Added native database transaction support to test instances for PostgreSQL and MySQL.
  • Updated bundled dependencies (jose, nanostores, noble crypto packages, SimpleWebAuthn) to their latest compatible releases, with no changes required to existing projects.

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

  • Fixed case-insensitive parsing of string Boolean values for SCIM User active and the primary sub-attribute of emails, phoneNumbers, addresses, roles, and entitlements at the HTTP ingress, improving Microsoft Entra interoperability.
  • Added an optional SCIM-owned connection and credential catalog: configure managedConnections to allow trusted server code to create runtime tenant connections and issue, rotate, and revoke bearer credentials through server-only auth.api methods, without a code-defined connection or an application-owned verifier.
  • Fixed an issue where trusted server code could not retain a terminal connection binding before a dynamic SCIM connection's first authenticated request when supplying a provisioning domain during decommissioning.

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

  • Fixed SSO provider registration to allow reusing a SCIM connection ID, as SCIM connections no longer participate in the authentication provider namespace.
  • Fixed SAML assertion signature verification to validate signatures on the raw assertion instead of trusting an already-parsed response, and enforced signing policy and size limits on SP metadata. wantAssertionsSigned now correctly controls whether the SP requires signed assertions, matching real-world IdP signing behavior.

For detailed changes, see CHANGELOG

@better-auth/cimd

Bug Fixes

  • Fixed Client ID Metadata Document caching to follow shared-cache freshness rules: the plugin now prefers s-maxage over max-age and Expires, honors s-maxage=0, conditionally revalidates with ETag or Last-Modified, and treats invalid or duplicate freshness directives as immediately stale. Concurrent refreshes now converge on a single client-resource link instead of failing on a unique constraint.

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

  • Fixed native adapter transactions for raw database instances (better-sqlite3, node:sqlite, bun:sqlite, mysql2, pg) passed directly as database, matching the behavior of the explicit { db }/{ dialect } config shapes. Plugins requiring native transactions (such as @better-auth/scim) now work correctly when using the quickstart database: new Database(...) form.

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

  • Fixed scope error responses so MCP clients now receive a 403 with an RFC 6750 insufficient_scope WWW-Authenticate challenge naming every missing scope, allowing clients to request all needed scopes in a single authorization request.

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.1

Patch Changes

  • #10863 845bbd1 Thanks @​gustavovalverde! - auth migrate no longer attempts to add a required column with no default value to a table that already has rows. It stops with an error naming the column and the backfill to run first. Previously the generated statement failed on SQLite, Postgres, and SQL Server; on MySQL it filled the new column with an empty string for every existing row and reported success. If auth migrate already ran against a MySQL database on 1.7, run the check in the upgrade guide's account identity section.

    getMigrations throws the new UnsafeMigrationError (exported from better-auth/db/migration) for this refusal, so callers can distinguish it from other migration errors such as an index-definition conflict.

    auth generate still emits the statements for external migration tooling, with a comment banner naming any column that needs a manual backfill first.

    A required field whose database column is still nullable logs a warning instead of blocking the migration.

    A CLI command that fails now prints its error and exits with a non-zero code instead of an unhandled promise rejection.

  • Updated dependencies []:

    • @​better-auth/core@​1.7.1
    • @​better-auth/drizzle-adapter@​1.7.1
    • @​better-auth/kysely-adapter@​1.7.1
    • @​better-auth/memory-adapter@​1.7.1
    • @​better-auth/mongo-adapter@​1.7.1
    • @​better-auth/prisma-adapter@​1.7.1
    • @​better-auth/telemetry@​1.7.1

1.7.0

Minor Changes

  • #8733 4e8e4c7 Thanks @​bytaesu! - Add hydrateSession to seed the client with a server-fetched session so useSession returns data on the first render.

  • #9930 0cbaf81 Thanks @​gustavovalverde! - Anonymous account linking now works after social and generic OAuth sign-in in Expo and other in-app browsers, where the OAuth callback returns without the session cookie. onLinkAccount fires and the anonymous user is migrated; before, it was silently skipped.

    Plugins can now carry server-trusted data across an OAuth redirect with the new addOAuthServerContext API, read back on the callback via getOAuthState().serverContext. Unlike additionalData, it cannot be set from the request body, so it is the right place for values the server must trust.

    For @better-auth/oauth-provider, the post-login authorization query now travels through that server-only channel, so it can no longer be injected through additionalData.

  • #10004 b36c38f Thanks @​bytaesu! - The captcha plugin now requires endpoint entries to match full auth paths unless they use wildcard patterns. This prevents requests like /sign-in//email from bypassing captcha while preserving trailing-slash matches like /sign-in/email/. To protect multiple routes, replace partial paths like /sign-in with explicit wildcards such as /sign-in/* or /sign-in/**.

  • #10746 6782647 Thanks @​gustavovalverde! - OAuth device grants now use oauthDeviceAuthorization() alongside oauthProvider() or mcp(). This single integration replaces both the standalone deviceCodeGrant() plugin and the shared-grant configuration. Standalone Device Authorization no longer accepts or stores RFC 8707 resources, and onDeviceAuthRequest receives only clientId and scope. The OAuth integration rejects resource indicators that are not absolute, fragment-free URIs.

    The OAuth integration replaces the optional resource column with oauthClientId and resources. Regenerate and apply the schema when using it. Before upgrading from an earlier 1.7 prerelease, let pending OAuth device codes expire or delete them because they cannot be exchanged through the new integration.

  • #10402 763a267 Thanks @​gustavovalverde! - Plugin database schemas can now define named or generated table-level indexes across multiple fields. SQL migrations and generated Drizzle or Prisma schemas resolve configured table and column names consistently, while the MongoDB adapter creates the same indexes before the first index-enforcing write.

  • #9766 bf39cbf Thanks @​GautamBytes! - Add a server-only auth.api.consumePhoneNumberOTP API for custom phone OTP flows that need to verify and consume a code without creating or updating users or sessions.

  • #10330 081d3c3 Thanks @​ping-maxwell! - Allow the username plugin's separate displayUsername field to be omitted by setting displayUsername: false on both the server and client plugins.

  • #10059 49b5cf6 Thanks @​GautamBytes! - Device Authorization now creates unique database indexes for deviceCode and userCode, so each generated code must be unique in its column. Existing installations on every adapter must resolve duplicate values before applying the migration. MySQL and SQL Server installations must also convert both columns to bounded strings and clean up values longer than 191 characters before running it.

... (truncated)

Commits

Updates hono from 4.13.1 to 4.13.3

Release notes

Sourced from hono's releases.

v4.13.3

What's Changed

  • fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in honojs/hono#5227
  • fix(etag): copy pending stream bytes in honojs/hono#5239
  • fix(etag): avoid skipping headers when filtering 304 response headers in honojs/hono#5234
  • fix(cors): append Origin to Vary header on OPTIONS preflight in honojs/hono#5235
  • docs(context): add custom headers append option example to Context JSDoc in honojs/hono#5248
  • fix(trie-router): match suffix wildcard routes in honojs/hono#5236
  • fix(pattern-router/linear-router): prevent prefix overmatch on wildcard routes in honojs/hono#5252
  • fix(csrf): exempt OPTIONS request from CSRF validation in honojs/hono#5250
  • fix(utils/ipaddr): avoid truncation on embedded IPv4 addresses in expand IPv6 in honojs/hono#5247
  • feat(pretty-json): support structured JSON content-types (+json) in honojs/hono#5226

Full Changelog: honojs/hono@v4.13.2...v4.13.3

v4.13.2

What's Changed

  • fix(secure-headers): output standard empty parentheses () instead of none for disabled Permissions-Policy directives in honojs/hono#5197
  • fix(jsx): render async children of document metadata tags instead of [object Promise] in honojs/hono#5204
  • fix(etag): resolve incorrect incremental hashing for chunked responses in honojs/hono#5199
  • fix(client): serialize multiple cookies correctly in honojs/hono#5202
  • fix(etag): stabilize digest across stream chunks in honojs/hono#5205
  • fix(url): strip trailing question mark correctly for optional params with regex quantifiers in honojs/hono#5209
  • perf(cors): pre-join static array header options during initialization in honojs/hono#5210
  • fix(client): send falsy JSON bodies in honojs/hono#5215
  • feat(secure-headers): add missing W3C Permissions-Policy directives in honojs/hono#5214

Full Changelog: honojs/hono@v4.13.1...v4.13.2

Commits
  • 0293343 4.13.3
  • 5ad469a feat(pretty-json): support structured JSON content-types (+json) (#5226)
  • c91ec9b fix(utils/ipaddr): avoid truncation on embedded IPv4 addresses in expandIPv6 ...
  • eea9735 fix(csrf): exempt OPTIONS request from CSRF validation (#5250)
  • a194628 fix(pattern-router/linear-router): prevent prefix overmatch on wildcard route...
  • 63bbcf5 fix(trie-router): match suffix wildcard routes (#5236)
  • ef0739d docs(context): add custom headers append option example to Context JSDoc (#5248)
  • 8bf03c3 fix(cors): append Origin to Vary header on OPTIONS preflight (#5235)
  • 546eca0 fix(etag): avoid skipping headers when filtering 304 response headers (#5234)
  • 7195c24 fix(etag): copy pending stream bytes (#5239)
  • Additional commits viewable in compare view

Updates fallow from 3.15.0 to 3.17.0

Release notes

Sourced from fallow's releases.

v3.17.0: Type-aware CI output and Windows reliability

Type-aware analysis is easier to use in CI, more accurate around ambiguous exports, and more reliable across platforms.

Highlights

  • Type-aware results render directly in CI: check and audit now support pr-comment-github, pr-comment-gitlab, review-github, and review-gitlab. fallow report --from <results.json> supports the same formats while preserving audit conclusions, semantic completeness, diff positions, ownership groups, and repository path prefixes. Required incomplete analysis fails closed. Thanks @​Jerc92 for #2272.
  • Type-aware analysis starts reliably from npm and VS Code on Windows: the npm launcher uses Node for the companion, the VSIX includes every supported native semantic backend, and native child processes stay hidden without weakening process-tree cleanup. Thanks @​VariableVince for reporting #2284.

Accuracy and reliability

  • Ambiguous export * collisions no longer blame contributing source files: Fallow suppresses ambiguity-attributable unused declaration, unused member, unrendered component, and unprovided injection findings. fallow trace exposes the additive star_export_ambiguity field with the contributing origins and namespaces. #2268, #2283
  • External generic constraints stay bounded: type-aware public-signature scans avoid expanding complete external structural graphs while preserving project-local constraint edges. Unsupported Svelte virtual-module exports now fail closed with the stable svelte-virtual-module-exports reason instead of claiming complete evidence. Thanks @​cmoyates for the detailed reports behind #2271.
  • Action binary verification has a hard deadline: the bundled Action supervises verification from a file, preserves normal exit statuses, and returns status 124 with one focused workflow error on timeout. Thanks @​Jonathangadeaharder for reporting #2273.

Performance

  • Duplicate spread calculation, local type extraction, named-export indexing, and JSON root serialization now avoid unnecessary sorting, allocation, and copying. #2266, #2267, #2281, #2282

Compatibility

  • Strict machine-readable consumers should update for type-aware wire protocol 7 and semantic schema 3. Every versioned JSON root that can embed this contract has a corresponding schema-version bump. Unversioned trace and inspect roots remain unchanged. Regenerate validators from the current output schema.

Full Changelog: fallow-rs/fallow@v3.16.0...v3.17.0

v3.16.0: honest template scoring, prunable audit cache, visible demotion

Health scoring gets more honest and more configurable in this release: template-family units drop the CRAP dimension they could never earn coverage for, Svelte {#snippet} blocks are scored as their own units, and thresholdOverrides finally reach file scores and refactoring targets. The audit cache becomes observable and prunable, new-only duplication demotion is no longer invisible, and a batch of correctness fixes lands across the type-aware sidecar, manual-mock detection, and the resolver.

Features

  • fallow audit-cache prune: the audit cache garbage collector now explains what it does, and a new audit-cache prune subcommand removes stale entries on demand. --dry-run previews the policy without touching disk, --max-age-days overrides the age ceiling (flag, then FALLOW_AUDIT_CACHE_MAX_AGE_DAYS, then audit.cacheMaxAgeDays, then the 30-day default), and the JSON maintenance envelope reports per-entry dispositions with reclaimed_bytes counting only bytes actually removed from disk. Legacy git registrations that are only deregistered report under deregistered and are never counted as reclaimed. RUST_LOG=fallow=debug surfaces per-entry GC decisions during normal audit runs. (#2221)
  • Observable duplication demotion: when --gate new-only demotes an introduced clone group to inherited, the decision is now visible. Demoted entries carry demotion_reason (currently no-added-lines), audit-family JSON always includes attribution.duplication_demoted, and --explain prints the demotion decision with the diff source it used. (#2220)
  • Svelte {#snippet} blocks are their own complexity units: top-level snippets score as <snippet:NAME> units with nesting rebased to zero, so extracting markup into a snippet moves the score. Snippet units are exact-match keys for health.thresholdOverrides[].functions. (#2227)
  • Broader declarative plugin manifests: typed manifest field paths with bounded [*] object-array traversal and exact exists predicates, strict JSON rules that reject JSONC input, and deterministic plugin-check limit diagnostics. Thanks @​M-Hassan-Raza. (#2165)

Health scoring changes

  • Template-family units no longer participate in the CRAP dimension: a template carries no direct test coverage, so \<template> and <snippet:NAME> findings gate on the cyclomatic and cognitive dimensions only and never report crap, coverage_pct, or coverage_tier. A maxCrap override scoped to a template unit reports a matched row explaining the entry can be removed. (#2235)
  • thresholdOverrides and maxCrap reach file scores and refactoring targets: file scoring and the add_test_coverage target rule now compare CRAP against the effective per-function ceiling instead of a fixed 30. Rows whose breaches were let through by configuration carry crap_exempted and crap_effective_threshold. (#2228)

Bug fixes

  • Windows: --gate new-only no longer fails on pre-existing findings: the base-snapshot focus set is built from git rev-parse --show-toplevel, whose spelling can differ from the canonicalized project root (8.3 path components, drive-letter case), so no path mapped into the base worktree and the base dead-code results were filtered away entirely. Every inherited finding then looked introduced and failed the gate. Path matching now compares simplified and canonicalized forms, and a base run whose focus set cannot be expressed leaves its results unfiltered.
  • jest/vitest __mocks__ parity: vitest root-level __mocks__ manual mocks for node modules are no longer reported as unused files, and literal X/__mocks__ imports and the /__mocks__ virtual package suffix now follow each framework's actual semantics. (#2225, #2226)
  • Type-aware sidecar and root typescript stay in lockstep: the root lockfile pins the same typescript the sidecar needs, and a new preflight exits with a message naming the resolved version, its path, and the install command when the resolvable install is missing or too old, instead of a bare module-resolution error. (#2236)
  • No wasted sidecar work when private-type-leaks is off: the type-aware layer only requests the api-surface capability when the check is active, pinned by an end-to-end config test in both directions. (#2218, #2219)
  • MCP audit tool description matches the payload: the description now documents the nested complexity block that audit JSON actually carries. (#2217)
  • Effective barrel exports resolve through one binding model: explicit-over-star precedence, ambiguous star origins vs convergent diamonds, separate type and value namespaces, and canonical binding identity now hold through usage propagation, public exports, duplicate analysis, trace provenance, caches, and the type-aware sidecar. Thanks @​M-Hassan-Raza. (#2210)
  • Package tooling stays out of production reachability: build and tooling scripts no longer make devDependencies look like production dependencies. Thanks @​Jerc92. (#2211)
  • Partial GitLab review posts now warn: inline-review jobs surface a warning when posting only partially succeeds instead of reporting clean success. Thanks @​Jerc92. (#2209)
  • Scoped-package manual mocks: factory-less jest.mock/vi.mock of a scoped package no longer fabricates an unused-file candidate. (#2213)

... (truncated)

Commits
  • ecf5a31 fix(release): install Windows platform candidate
  • e08e3e0 chore: release v3.17.0
  • 7e8519b fix: start type-aware reliably on Windows
  • 78632bb feat(ci): render type-aware feedback from saved results
  • 8437d52 fix: close analysis and audit follow-ups
  • 4084184 perf(extract): deduplicate local type declarations once
  • 7a84424 perf(types): bucket clone spread locations
  • e6a86ac fix(action): bound installed binary verification
  • f66e6e8 ci(benchmarks): add round five walltime suites
  • 6ab2c84 fix(type-aware): bound generic scans and identify Svelte host gaps
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the npm-deps group with 5 updates
c887f54 
Bumps the npm-deps group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [@better-auth/oauth-provider](https://github.com/better-auth/better-auth/tree/HEAD/packages/oauth-provider) | `1.6.27` | `1.7.1` |
| [@hono/node-server](https://github.com/honojs/node-server) | `2.1.0` | `2.1.1` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.6.27` | `1.7.1` |
| [hono](https://github.com/honojs/hono) | `4.13.1` | `4.13.3` |
| [fallow](https://github.com/fallow-rs/fallow) | `3.15.0` | `3.17.0` |


Updates `@better-auth/oauth-provider` from 1.6.27 to 1.7.1
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/oauth-provider/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.1/packages/oauth-provider)

Updates `@hono/node-server` from 2.1.0 to 2.1.1
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v2.1.0...v2.1.1)

Updates `better-auth` from 1.6.27 to 1.7.1
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.1/packages/better-auth)

Updates `hono` from 4.13.1 to 4.13.3
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.1...v4.13.3)

Updates `fallow` from 3.15.0 to 3.17.0
- [Release notes](https://github.com/fallow-rs/fallow/releases)
- [Changelog](https://github.com/fallow-rs/fallow/blob/main/release.toml)
- [Commits](fallow-rs/fallow@v3.15.0...v3.17.0)

---
updated-dependencies:
- dependency-name: "@better-auth/oauth-provider"
  dependency-version: 1.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-deps
- dependency-name: better-auth
  dependency-version: 1.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: hono
  dependency-version: 4.13.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-deps
- dependency-name: fallow
  dependency-version: 3.17.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants