v1.2.3 - Credentials stop leaking through a downgraded MySQL handshake

A security release. Three high-severity advisories are cleared, and the
dependency backlog that was hiding behind them is folded in, Better Auth 1.7
included.

This release carries a schema migration. Run prisma migrate deploy before
the new build serves traffic. Skipping it makes every password sign-in fail with
User not found, because Better Auth 1.7 looks accounts up by a column that
does not exist yet.

Security

mysql2 allowed an auth plugin downgrade to mysql_clear_password, which
leaks the connection's credentials in plaintext. The package sits three levels
down, pinned at 3.15.3 by prisma, so Dependabot could not bump it on its
own and the fix is a package.json override to 3.22.0 or later.

browserslist at 4.28.6 and below carried unbounded cache growth with no
eviction, an eventual out-of-memory (GHSA-c83g-rgw3-j3cx), and an uncaught crash
plus a prototype write reachable through an untrusted browserslist-stats.json
(GHSA-73wf-gq98-2v4g). Also overridden, also transitive.

Both were blocking the dependency audit on every open dependency PR, which is
how a backlog of three had accumulated.

Better Auth 1.7

Account identity is now keyed on the issuer. Lookups use
(issuer, accountId) rather than (providerId, accountId), so an identity
survives a provider being renamed. The Account model gains a required issuer
column. The migration adds it nullable, backfills each row from what it already
states, local:credential for password accounts and the advertised issuer from
the matching SsoProvider row for SSO accounts, then makes it NOT NULL and
indexes the pair.

Every place that writes an account row by hand, invitation acceptance and the
seed scripts included, now stamps the issuer from the library's own helper
rather than from a string typed out here, so a change upstream surfaces as a
type error instead of a silent sign-in failure.

Enrolling a second factor returns a discriminated union. Only the TOTP arm
carries the URI and the backup codes, so the enrollment call asks for TOTP by
name and narrows before reading them.

The three better-auth packages are pinned to 1.7.2 exactly. Dependabot
proposed 1.7.1, which no longer installs: the passkey plugin's caret floats to
1.7.2 and that version requires better-auth@^1.7.2. Pinning the family
together stops a caret from splitting it again.

Dependencies

Prisma and its adapter to 7.10.0, Next.js to 16.3.3, @react-pdf/renderer
to 4.8.1, plus the AWS SDK, pg, lucide-react, @tanstack/react-table and
the type packages. CodeQL moves to 4.37.8 and TruffleHog to 3.97.1.

Verification

The full suite ran against throwaway databases shaped like CI: 250 unit tests,
88 integration tests on a UTC database and again on a Europe/Paris one, and 16
Playwright end-to-end tests, alongside a clean audit, the license gate, the type
check and the build.