fix(deps): update dependency next-auth (5.0.0-beta.31 → 5.0.0-beta.32)

[its-miso]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
next-auth (source)	5.0.0-beta.31 → 5.0.0-beta.32

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

nextauthjs/next-auth (next-auth)

v5.0.0-beta.32

Compare Source

Beta release for the v5 line.

Picks up the @​auth/core@​0.41.3 security fixes (malformed Bearer token handling in getToken, provider-bound OAuth check cookies, and NFKC email normalization).

Fixes auth checks failing open on provider configuration errors: a non-OK session response now yields no session instead of an error object, so checks like !!auth fail closed.

---

Configuration

📅 Schedule: (in timezone America/Edmonton)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: self-hosted@https://litellm.jory.dev/v1 (openai) — primary route

Recommendation

Approve. This is a lockfile-only update of next-auth from 5.0.0-beta.31 to 5.0.0-beta.32, which pulls in @auth/core 0.41.2 → 0.41.3. The upstream release is a security-and-correctness patch with no breaking API changes. All CI checks pass.

Change-by-Change Findings

package-lock.json (lockfile only)

• next-auth resolved from 5.0.0-beta.31 to 5.0.0-beta.32.
• Transitive @auth/core resolved from 0.41.2 to 0.41.3 (integrity hash updated).
• nodemailer peer dep range widened from ^7.0.7 to ^7.0.7 || ^8.0.5 — additive, not breaking.
• No source files changed; no runtime behavior impact beyond what the upstream release notes describe.

Upstream release summary (next-auth 5.0.0-beta.32)

The release picks up three @auth/core@0.41.3 fixes:

1. Malformed Bearer token handling in getToken() — previously, a request with a malformed percent-encoded token (e.g. Authorization: Bearer %) threw an uncaught URIError. The fix wraps decodeURIComponent so malformed encodings are treated as an invalid token and return null, matching how undecodable tokens were already handled.
2. NFKC email normalization — the default email normalizer now applies String.prototype.normalize("NFKC") before validation, preventing homoglyph-of-@ characters (e.g. U+FF20) from bypassing the single-@ check and enabling recipient splitting (CWE-180: validate before canonicalize).
3. Auth checks fail closed on provider config errors — when getSession() receives a non-OK response from the upstream auth server, it now returns no session instead of an error object, so guards like !!auth correctly evaluate to false.

All three are security/correctness improvements; none alter public API signatures or require caller changes.

Must-Check Items

• Breaking API changes in updated dependencies: Verified against the upstream release notes and the 16-commit compare diff. No breaking changes — only security fixes and a fail-closed behavior improvement. The nodemailer peer range widening is additive. Pass.
• Full test suite after upgrade: CI reports all checks green — Tests, Typecheck, Lint, Build, Docker Build, and review all succeeded on commit b34708f. Pass.

Standards Compliance

• No source code changes; no deviation from repository conventions.
• Lockfile-only Renovate PR follows the established pattern (branch renovate/next-auth-5.x-lockfile, single-file diff).
• The package.json semver range ^5.0.0-beta.31 correctly allows 5.0.0-beta.32 under pre-release ordering within the same major.minor.

Sources

• Upstream release: next-auth@5.0.0-beta.32
• Compare diff: [next-auth@5.0.0-beta.31...5.0.0-beta.32](upstream nextauthjs/next-auth compare next-auth@5.0.0-beta.31...next-auth@5.0.0-beta.32)
• CI status for b34708f: all checks success