@auth/core@0.41.3

Bugfixes

• core: getToken() now returns null instead of throwing when the Authorization header contains a malformed Bearer value
• core: OAuth state, nonce, and PKCE check cookies are now bound to the provider that created them and are rejected when a different provider handles the callback
• core: email addresses are Unicode-normalized (NFKC) before validation in the default email normalizer, closing a homoglyph @ bypass

Other

• deps: resolve Dependabot alerts via cross-major dependency upgrades (#13449)
• deps: resolve Dependabot security advisories via pnpm overrides (#13441)
• deps: allow nodemailer 8 in peer dependency ranges (#13434)
• CI formatting and proxy deploy repairs (#13444)