Restart-when: npm view better-auth dist-tags shows a stable (non-prerelease) 1.7.x latest — the #5024 probe fires this; then run the action items in the body. Note the current rc pin IS the fix for GHSA-p2fr-6hmx-4528 and GHSA-j8v8-g9cx-5qf4 (patched only in >=1.7.0-beta.4), so reverting to 1.6.x is not an option
Context
PR #2986 (fixing #2974) pinned the entire better-auth family to the prerelease 1.7.0-rc.1 in pnpm-workspace.yaml overrides. This was the only way to remediate GHSA-p2fr-6hmx-4528 (@better-auth/oauth-provider, Medium 6.4): the advisory is patched only in the 1.7 line, whose plugins import symbols (e.g. CLIENT_ASSERTION_TYPE) that exist only in @better-auth/core 1.7.x — so the whole stack had to move together (mixing a 1.7 plugin with 1.6.23 core 500s on sign-in).
It also matched the pre-existing @better-auth/scim@1.7.0-rc.1 pin already in plugin-auth.
Why this is a follow-up
Running the auth stack on a release candidate in main is a temporary measure. When a stable 1.7.x ships, we should move to a normal ^1.7.x range so we're not carrying an rc long-term.
Pinned packages (all → 1.7.0-rc.1, in pnpm-workspace.yaml)
better-auth@better-auth/core@better-auth/oauth-provider@better-auth/scim@better-auth/sso@better-auth/drizzle-adapter, kysely-adapter, memory-adapter, mongo-adapter, prisma-adapter@better-auth/telemetry
Action items (when stable 1.7.x is available)
Ref: #2974, #2986.
Generated by Claude Code
Restart-when: npm view better-auth dist-tags shows a stable (non-prerelease) 1.7.x latest — the #5024 probe fires this; then run the action items in the body. Note the current rc pin IS the fix for GHSA-p2fr-6hmx-4528 and GHSA-j8v8-g9cx-5qf4 (patched only in >=1.7.0-beta.4), so reverting to 1.6.x is not an option
Context
PR #2986 (fixing #2974) pinned the entire better-auth family to the prerelease
1.7.0-rc.1inpnpm-workspace.yamloverrides. This was the only way to remediate GHSA-p2fr-6hmx-4528 (@better-auth/oauth-provider, Medium 6.4): the advisory is patched only in the 1.7 line, whose plugins import symbols (e.g.CLIENT_ASSERTION_TYPE) that exist only in@better-auth/core1.7.x — so the whole stack had to move together (mixing a 1.7 plugin with 1.6.23 core 500s on sign-in).It also matched the pre-existing
@better-auth/scim@1.7.0-rc.1pin already inplugin-auth.Why this is a follow-up
Running the auth stack on a release candidate in
mainis a temporary measure. When a stable1.7.xships, we should move to a normal^1.7.xrange so we're not carrying an rc long-term.Pinned packages (all →
1.7.0-rc.1, inpnpm-workspace.yaml)better-auth@better-auth/core@better-auth/oauth-provider@better-auth/scim@better-auth/sso@better-auth/drizzle-adapter,kysely-adapter,memory-adapter,mongo-adapter,prisma-adapter@better-auth/telemetryAction items (when stable 1.7.x is available)
…@<1.7.0-rc.1': '1.7.0-rc.1'overrides with a stable^1.7.x(or drop the overrides entirely ifplugin-auth's declared ranges already resolve to the fixed line).plugin-auth's direct@better-auth/scimpin (currently exact1.7.0-rc.1) to^1.7.x.osv-scanner --lockfile=pnpm-lock.yamlto confirm GHSA-p2fr-6hmx-4528 stays resolved.@objectstack/dogfoodsuite (the sign-in / JWKS path exercised by better-auth 1.7).CustomAdaptermethods (consumeOne/incrementOne) and thesys_jwks.alg/crvcolumns are still correct against the stable release (no further schema/contract drift).Ref: #2974, #2986.
Generated by Claude Code