Found during the new-developer first-run journey audit, #10264. Observed on a brand-new scaffold from published create-objectstack@17.1.0, with nothing configured by the user.
better-auth 1.7.1
✕ unmet peer better-sqlite3@^12.0.0: found 13.0.3
@better-auth/scim 1.7.0-rc.1
✕ unmet peer better-call@1.3.7: found 1.4.0
Nothing broke. The install completed, the project booted, and every subsequent stage of the audit passed. So this is presentation, not breakage — but it is presentation on the one screen where a newcomer is deciding whether this project is solid, and there is nothing they did to cause it and nothing they can do about it.
Two sub-questions for whoever takes this, since they may not have the same answer:
better-sqlite3 12 vs 13 — is the resolved 13.0.3 actually fine, in which case the peer range wants widening; or is the pin wrong?@better-auth/scim 1.7.0-rc.1 — an -rc dependency in the default install path of a scaffolded project is worth a deliberate look independent of the peer warning it generates.
Suggested landing (hint for triage, not a routing decision)
Dependency pinning in whichever package owns the better-auth dependency — likely packages/plugins/plugin-auth, possibly packages/runtime. The audit's dev named both and the PM did not narrow it further.
Filed by the PM loop from the audit in #10264. Not yet graded or routed.
Found during the new-developer first-run journey audit, #10264. Observed on a brand-new scaffold from published
create-objectstack@17.1.0, with nothing configured by the user.Nothing broke. The install completed, the project booted, and every subsequent stage of the audit passed. So this is presentation, not breakage — but it is presentation on the one screen where a newcomer is deciding whether this project is solid, and there is nothing they did to cause it and nothing they can do about it.
Two sub-questions for whoever takes this, since they may not have the same answer:
better-sqlite312 vs 13 — is the resolved 13.0.3 actually fine, in which case the peer range wants widening; or is the pin wrong?@better-auth/scim 1.7.0-rc.1— an-rcdependency in the default install path of a scaffolded project is worth a deliberate look independent of the peer warning it generates.Suggested landing (hint for triage, not a routing decision)
Dependency pinning in whichever package owns the
better-authdependency — likelypackages/plugins/plugin-auth, possiblypackages/runtime. The audit's dev named both and the PM did not narrow it further.Filed by the PM loop from the audit in #10264. Not yet graded or routed.