v1.4.0 - The image moves to Alpine and ships with no known advisory

The published image moves from Debian to Alpine. It drops from 1.19 GB to
540 MB on disk and ships with no known advisory, where the previous image
carried 4 critical and 59 high.

1.3.1 was cut but never tagged nor published as an image. Its changes ship
here, so an operator coming from 1.3.0 also gets the critical next/og fix and
one schema migration, described below.

Upgrading

An operator who extends the image must install packages with apk instead of
apt-get, and anything relying on glibc has to adapt. Environment variables,
port and migrate-on-start are unchanged.

From 1.3.0, one migration runs on start.
20261001090000_drop_account_issuer_requirement makes Account.issuer
nullable and moves the account lookup index back to (providerId, accountId).
The column and its backfilled values stay, so rolling back to 1.3.0 still signs
existing users in. Nothing to do by hand: migrations run on start as before.

Security

A critical remote code execution advisory in next/og is closed, along with
three high fast-uri advisories. next now sits at 16.3.8, which also closes
CVE-2026-94483 (high).

sharp moves to 0.35.5 and source-map-js to 1.2.2, closing the two high
advisories that had a fix.

Image

The Debian base carried its advisories in packages the app never uses. The
runner also shipped /opt/prisma and .next twice, because of a trailing
chown -R. sharp is excluded since next/image is unused, and Prisma Studio
with the embedded Postgres behind prisma dev leave the CLI tree: the runner
only calls migrate deploy, which opens neither.

The runner stage is now rebuilt on every publish, so the package upgrade cannot
be replayed from an old cache layer.

Better Auth 1.7.5

Better Auth 1.7.5 reverts the issuer-keyed account lookup that 1.7.0
introduced, and no longer writes Account.issuer. Left NOT NULL, that column
would have turned every sign-up into a failure, hence the migration above.
Invitations, seeds and test fixtures stop setting it.

CI

braces has a high advisory with no patched release, reachable only through
tailwindcss and the Next ESLint plugin, so the full-tree audit failed every
pull request with nothing to act on. The blocking npm audit now covers
production dependencies, and the full tree is still audited and printed without
blocking.

Development

The seed scripts work again. dotenv 18 ships its own binary, which shadowed
the one from dotenv-cli. Scripts now load .env.local through Node's
--env-file-if-exists, and prisma.config.ts through process.loadEnvFile.
Shell variables still win, and a missing file is still not an error.

eslint-config-next moves to 16 with native flat configs, middleware.ts
becomes proxy.ts as Next 16 expects, and effects no longer call setState
synchronously, as eslint-plugin-react-hooks 7 requires. The unused @dnd-kit
packages are gone.