chore(deps): bump the npm-deps group across 1 directory with 2 updates

[dependabot]

Bumps the npm-deps group with 2 updates in the / directory: better-auth and tap.

Updates better-auth from 1.5.6 to 1.6.2

Release notes

Sourced from better-auth's releases.

v1.6.2

better-auth

❗ Breaking Changes

• Prevented unverified TOTP enrollment from blocking sign-in (#8711)

Migration: Schema migration required.

Add the verified column to the twoFactor table, then regenerate/apply your ORM migration.

• Prisma: run npx auth@latest generate, then npx prisma migrate dev (or npx prisma db push) and npx prisma generate.
• Drizzle: run npx auth@latest generate, then npx drizzle-kit generate and npx drizzle-kit migrate.

Existing rows do not need a backfill because the column defaults to true.

Features

• Included enabled 2FA methods in sign-in redirect response (#8772)

Bug Fixes

• Fixed OAuth state verification against cookie-stored nonce to prevent CSRF (#8949)
• Fixed infinite router refresh loops in nextCookies() by replacing cookie probe with header-based RSC detection (#9059)
• Fixed cross-provider account collision in link-social callback (#8983)
• Included RelayState in signed SAML AuthnRequests (#9058)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed multi-valued query params collapsing through prompt redirects (#9060)
• Rejected skip_consent at schema level in dynamic client registration (#8998)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed SAMLResponse decoding failures caused by line-wrapped base64 (#8968)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​aarmful, @​cyphercodes, @​dvanmali, @​gustavovalverde, @​jaydeep-pipaliya, @​ping-maxwell

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.6.2

Patch Changes

• #8949 9deb793 Thanks @​ping-maxwell! - security: verify OAuth state parameter against cookie-stored nonce to prevent CSRF on cookie-backed flows

• #8983 2cbcb9b Thanks @​jaydeep-pipaliya! - fix(oauth2): prevent cross-provider account collision in link-social callback

  The link-social callback used findAccount(accountId) which matched by account ID across all providers. When two providers return the same numeric ID (e.g. both Google and GitHub assign 99999), the lookup could match the wrong provider's account, causing a spurious account_already_linked_to_different_user error or silently updating the wrong account's tokens.

  Replaced with findAccountByProviderId(accountId, providerId) to scope the lookup to the correct provider, matching the pattern already used in the generic OAuth plugin.

• #9059 b20fa42 Thanks @​gustavovalverde! - fix(next-js): replace cookie probe with header-based RSC detection in nextCookies() to prevent infinite router refresh loops and eliminate leaked __better-auth-cookie-store cookie. Also fix two-factor enrollment flows to set the new session cookie before deleting the old session.

• #9058 608d8c3 Thanks @​gustavovalverde! - fix(sso): include RelayState in signed SAML AuthnRequests per SAML 2.0 Bindings §3.4.4.1

  • RelayState is now passed to samlify's ServiceProvider constructor so it is included in the redirect binding signature. Previously it was appended after the signature, causing spec-compliant IdPs to reject signed AuthnRequests.
  • authnRequestsSigned: true without a private key now throws instead of silently sending unsigned requests.

• #8772 8409843 Thanks @​aarmful! - feat(two-factor): include enabled 2fa methods in sign-in redirect response

  The 2FA sign-in redirect now returns twoFactorMethods (e.g. ["totp", "otp"]) so frontends can render the correct verification UI without guessing. The onTwoFactorRedirect client callback receives twoFactorMethods as a context parameter.

  • TOTP is included only when the user has a verified TOTP secret and TOTP is not disabled in config.
  • OTP is included when otpOptions.sendOTP is configured.
  • Unverified TOTP enrollments are excluded from the methods list.

• #8711 e78a7b1 Thanks @​aarmful! - fix(two-factor): prevent unverified TOTP enrollment from gating sign-in

  Adds a verified boolean column to the twoFactor table that tracks whether a TOTP secret has been confirmed by the user.

  • First-time enrollment: enableTwoFactor creates the row with verified: false. The row is promoted to verified: true only after verifyTOTP succeeds with a valid code.
  • Re-enrollment (calling enableTwoFactor when TOTP is already verified): the new row preserves verified: true, so the user is never locked out of sign-in while rotating their TOTP secret.
  • Sign-in: verifyTOTP rejects rows where verified === false, preventing abandoned enrollments from blocking authentication. Backup codes and OTP are unaffected and work as fallbacks during unfinished enrollment.

  Migration: The new column defaults to true, so existing twoFactor rows are treated as verified. No data migration is required. skipVerificationOnEnable: true is also unaffected — the row is created as verified: true in that mode.

• Updated dependencies []:

  • @​better-auth/core@​1.6.2
  • @​better-auth/drizzle-adapter@​1.6.2
  • @​better-auth/kysely-adapter@​1.6.2
  • @​better-auth/memory-adapter@​1.6.2
  • @​better-auth/mongo-adapter@​1.6.2
  • @​better-auth/prisma-adapter@​1.6.2
  • @​better-auth/telemetry@​1.6.2

1.6.1

Patch Changes

• #9023 2e537df Thanks @​jonathansamines! - Update endpoint instrumentation to always use endpoint routes

• #8902 f61ad1c Thanks @​ping-maxwell! - use INVALID_PASSWORD for all checkPassword failures

... (truncated)

Commits

• 700d298 chore: version packages (#9052)
• b20fa42 fix(next-js): replace cookie probe with header-based RSC detection in nextCoo...
• 2cbcb9b fix(oauth2): prevent cross-provider account collision in link-social callback...
• 9deb793 fix: cookie store strategy should verify oauth state (#8949)
• 8409843 feat(two-factor): include enabled 2fa methods in sign-in redirect response (#...
• e78a7b1 fix(two-factor): prevent unverified TOTP enrollment from gating sign-in (#8711)
• 85bb710 chore: version packages (#9018)
• 7495830 fix(api): restore getSession accessibility in generic Auth<O> context (#9017)
• 2e537df fix: endpoint instrumentation to always use route template (#9023)
• f61ad1c fix: use INVALID_PASSWORD for all checkPassword failures (#8902)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for better-auth since your current version.

Updates tap from 21.6.2 to 21.6.3

Commits

• a14b24c update versions
• e6798fe update tshy, normalize package.json better
• 9286b74 mock: just make the service key a global
• See full diff in compare view

[mroderick]

Dependency Upgrade Review: better-auth & tap

PR Scope

Dependency-only - Only modifies package.json and package-lock.json

Dependencies Updated

Package	From	To	Risk
better-auth	1.5.6	1.6.2	Low-Med
tap	21.6.2	21.6.3	Low

Changes in better-auth (1.5.6 → 1.6.2)

Security fixes affecting this codebase:

• OAuth state verification (#8949): Better Auth now verifies the OAuth state parameter against cookie-stored nonce to prevent CSRF attacks on cookie-backed flows. This codebase uses GitHub OAuth - this is a beneficial security improvement.

• Cross-provider account collision fix (#8983): Fixed a bug where findAccount(accountId) matched across all providers, causing issues when different providers return the same numeric ID. Now uses findAccountByProviderId(accountId, providerId). This affects GitHub social auth used here.

Breaking change (NOT applicable):

• TOTP enrollment requires a verified column migration. This codebase doesn't use two-factor/TOTP - the breaking change doesn't apply.

Usage in Repository

better-auth is used in:

• src/auth.js: Core auth configuration with GitHub OAuth, magic links, admin plugin
• test/helpers/test-instance.js: Test utilities using the same plugins

tap is used for:

• All test files in test/ directory (38 passing feature tests)

Compatibility Assessment

better-auth: Likely Compatible

• Security fixes for OAuth are beneficial improvements
• Cross-provider fix resolves a potential bug with GitHub auth
• No TOTP usage means the breaking change doesn't apply
• All existing plugins (magicLink, admin) and social providers (github) remain supported

tap: Compatible

• Minor patch update (21.6.2 → 21.6.3)
• No API changes expected

Test Results

✅ All 28 tests pass

• test/features/admin.test.js: 3 passing
• test/features/authentication.test.js: 5 passing
• test/features/home.test.js: 4 passing
• test/features/magic-links.test.js: 8 passing
• test/features/profile.test.js: 8 passing

Coverage: 70.28% statements, 77.41% branches, 82.35% functions, 70.28% lines

Confidence Rating

High - All tests pass. The security fixes are beneficial improvements, and the breaking change (TOTP schema) doesn't affect this codebase.

---

Recommendation: Safe to merge ✅