[dependabot]

Bumps the npm-deps group with 9 updates in the / directory:

Package	From	To
@better-auth/oauth-provider	1.7.7	1.7.12
@hono/node-server	2.1.4	2.1.5
better-auth	1.7.7	1.7.12
@commitlint/cli	21.2.3	21.2.4
@commitlint/config-conventional	21.2.3	21.2.4
@playwright/test	1.64.0	1.64.1
eslint	10.12.0	10.13.0
fallow	3.32.0	3.34.1
prettier	3.9.9	3.9.10

Updates @better-auth/oauth-provider from 1.7.7 to 1.7.12

Release notes

Sourced from @​better-auth/oauth-provider's releases.

v1.7.12

[!IMPORTANT] Action required

• If you use ID token sign-in with a provider that has no clientId, set clientId to every client ID your apps sign in with. (#11931)

better-auth

Bug Fixes

• Fixed the JWT plugin to verify JWTs and session cookie-cache JWTs with the stored key's algorithm instead of the token header's, and to warn when signing or verifying a JWT without an issuer or audience (#11925)
• Fixed OAuth callbacks completed through the OAuth proxy to run the same checks as the standard OAuth callback, including issuer and ID token nonce validation (#11930)
• Fixed auth.api.getSession() to keep the original database error as error.cause when the session lookup fails (#11924)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed mapProfileToUser failing to typecheck under exactOptionalPropertyTypes when it returns undefined for name, email, or image (#11918)
• Fixed ID token sign-in to reject tokens when the provider has no client ID, since their audience cannot be checked (#11931)
• Fixed a custom Facebook getUserInfo to no longer receive client-submitted access tokens issued to another Facebook app, and ID tokens missing exp or iat are now rejected (#11919)
• Restored the Twitch and Paybin ID token handling from before 1.7.11, which made account info fail once the ID token stored at sign-in expired (#11920)
• Added a cause option as a third argument to APIError.from() to keep the underlying error for server-side callers without exposing it in the response (#11924)

For detailed changes, see CHANGELOG

@better-auth/mcp

Bug Fixes

• Fixed requireMcpAuth to accept only OAuth access tokens and reject session JWTs from the JWT plugin, even when they share the issuer and audience (#11934)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed OIDC SSO sign-in to reject ID tokens missing exp or iat and providers with an empty client ID, matching social sign-in (#11935)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​alpcanaydin, @​bytaesu

... (truncated)

Changelog

Sourced from @​better-auth/oauth-provider's changelog.

1.7.12

1.7.11

Patch Changes

• #11830 a1f6f0b Thanks @​gustavovalverde! - Apps using the CIMD plugin no longer lose an administrator's change to a discovered client when a metadata refresh is running at the same time. Before, disabling the client, setting skipConsent or enableEndSession, or assigning client_credentials scopes while its document was being fetched could be undone by the refresh. No action is needed.

• #10881 37debaa Thanks @​sahiljagtap08! - Corrected the OpenAPI response schemas for /oauth2/consent and /oauth2/continue to describe { redirect: true, url: string }, so generated clients no longer expect a nonexistent redirect_uri field. Runtime responses are unchanged.

1.7.10

Patch Changes

• #11786 cdd491b Thanks @​gustavovalverde! - DPoP proofs are accepted again for two setups that broke in v1.7.9:

  • Plugin endpoints with route params, such as /extension/:tenant/token, that issue tokens with a DPoP proof. A valid proof for /extension/acme/token was rejected with invalid_dpop_proof, because the expected htu contained the literal :tenant.
  • Token and UserInfo requests to a URL with a trailing slash, such as /api/auth/oauth2/token/, when advanced.skipTrailingSlashes is on. The proof was rejected because the expected htu dropped the slash.

  The expected htu still takes its origin and base path from baseURL, so keep baseURL set to the public URL clients call. Other setups are unaffected.

• #11815 44f14bb Thanks @​gustavovalverde! - Device-code clients that request offline_access and poll the token endpoint for only some of the RFC 8707 resources the user approved can now refresh for any approved resource. Previously, a refresh for an approved resource left out of the poll failed with invalid_target. Device codes polled without resource, or for every approved resource, are unaffected.

• #11695 fe550a9 Thanks @​gustavovalverde! - Confidential private_key_jwt clients that register inline jwks can now replace their own signing keys without a user session. Until now those keys were fixed at registration. The feature is off by default; set allowClientKeyRotation: true to enable it. No database migration is needed, but the provider refuses to start with it enabled on the memory adapter or with advanced.database.generateId: "serial", because neither enforces single-use client assertions.

  The client calls POST /oauth2/client/rotate-keys with its complete new jwks and a client assertion signed by one of its current keys, whose aud includes the rotation endpoint's URL. An assertion addressed only to the token endpoint or the issuer is rejected. Keys left out of the new set stop working at once, so roll a key in two steps: send the old and new keys together, then drop the old key once every instance signs with the new one.

• #11801 99cdfe7 Thanks @​gustavovalverde! - If postLogin.consentReferenceId returns no reference for some authorizations (for example, it returns an organization ID only for organization scopes), consent is now kept separate per reference. Approving consent without a reference no longer overwrites the consent stored for an organization, and an authorization without a reference no longer skips the consent prompt because the user consented under an organization. Previously, approving read write without a reference could replace an organization's stored read consent, so later authorizations for that organization were granted write without asking. For new authorizations, an empty string is treated the same as no reference, including the referenceId passed to token claim callbacks.

  Users may see the consent prompt once for authorizations that were previously approved through another reference's consent. Until they do, silent (prompt=none) authorizations in these setups return consent_required. Consent overwritten before this release is not repaired; users can review or revoke it through the consent management endpoints. Setups that never configured consentReferenceId, or that always return a reference, are unaffected.

• #11797 906c32f Thanks @​gustavovalverde! - If you enable dynamic client registration, Claude's MCP connector can now register. It requests urn:ietf:params:oauth:grant-type:jwt-bearer along with authorization_code and refresh_token, and Better Auth rejected the whole registration with invalid_client_metadata because one grant was unsupported. Dynamic registration now keeps the requested grants the server supports and lists them in the registration response. A request that shares no grant with the server is still rejected. Clients created with createOAuthClient or adminCreateOAuthClient still reject unsupported grants.

• #11798 2fa7e2f Thanks @​gustavovalverde! - With clientRegistrationDefaultApplicationType: "infer", clients that register an http callback on localhost, 127.0.0.1, or [::1] without application_type now register as native. This includes older Claude Code releases, which register http://127.0.0.1:<port>/callback. Current Claude Code releases send application_type: "native" and were not affected. Before, "infer" chose native only for callbacks whose scheme is not http or https, so these registrations were treated as web and rejected with invalid_redirect_uri. The "web" default and the "native" setting are unchanged, and an application_type the client sends is never overridden.

• #11176 8f3da46 Thanks @​Bekacru! - The token endpoint now returns invalid_client instead of invalid_grant when a request names a client_id that is not registered, for the authorization_code, refresh_token, and device code grants. MCP clients whose registration was deleted, for example by a database reset or an upgrade that dropped OAuth tables, now register again and prompt the user to sign in. Before, they kept the deleted client_id and stayed signed out until the user cleared their saved credentials by hand. A registered client that sends wrong credentials also gets invalid_client now, even when its code or refresh token is also invalid.

• #11596 963b7f9 Thanks @​mahoor! - /oauth2/userinfo, /oauth2/introspect and /oauth2/revoke now answer a JWT that fails verification the way they answer any unknown token. Before, they returned an empty 500. This covers an alg: none token, a tampered signature, an unknown kid and a wrong issuer: userinfo returns 401 invalid_token with a WWW-Authenticate challenge, introspection returns { "active": false }, and revocation returns its unknown-token error. Valid JWT and opaque access tokens are unaffected, including JWT-shaped tokens issued by generateOpaqueAccessToken.

  If you set disableJwtPlugin: true, a JWT-shaped token that is not a stored access token, such as an ID token, now gets the same unknown-token response instead of a 500.

  A key set the server cannot use, such as one where two keys share a kid, still returns 500.

• #11781 e34b828 Thanks @​gustavovalverde! - If you configure cachedTrustedClients, attempts to update, delete, or rotate the secret of one of those clients through the client management endpoints now fail with HTTP 400 instead of 500. The response body is unchanged (error: "invalid_client"), so only code that branches on the status code is affected. A 500 previously made a deliberate refusal look like a server failure.

• #11799 f42c0c2 Thanks @​gustavovalverde! - Requests that name a client_id the server does not know now fail with error_description set to client not found. Before, /oauth2/authorize said client_id is required, which read as a missing parameter, /oauth2/token, /oauth2/revoke, and /oauth2/introspect said missing client, and requests that authenticate with a private_key_jwt client assertion said unknown client. You would see this, for example, when an MCP client kept a registration the server had deleted. The invalid_client error code is unchanged.

• #11724 4d7da0b Thanks @​drewsephski! - Clients exchanging an authorization code with PKCE now get the token errors RFC 7636 and RFC 6749 specify. A code_verifier that does not match the authorization request's code_challenge returns HTTP 400 invalid_grant; it previously returned HTTP 401 invalid_request. For clients where PKCE is optional, a missing or unexpected code_verifier still returns invalid_request, now with HTTP 400 instead of 401. No request that failed before now succeeds.

1.7.9

... (truncated)

Commits

• f4260a9 chore: release v1.7.12 (#11922)
• 52ab801 chore: release v1.7.11 (#11827)
• a1f6f0b fix(oauth-provider): keep admin changes made during a CIMD refresh (#11830)
• 37debaa fix(oauth-provider): correct consent and continue OpenAPI response schemas (#...
• b734a41 chore: release v1.7.10 (#11795)
• 61c913d fix(oauth-provider): report an unknown client in a client assertion as not fo...
• 4d7da0b fix(oauth-provider): return 400 invalid_grant on PKCE verifier mismatch (#11724)
• 8f3da46 fix(oauth-provider): return invalid_client for an unknown client at the token...
• 44f14bb fix(oauth-provider): keep approved resources refreshable after a narrowed dev...
• fedd055 fix(oauth2): report an unreachable JWKS as an error, not an invalid token (#1...
• Additional commits viewable in compare view

Updates @hono/node-server from 2.1.4 to 2.1.5

Release notes

Sourced from @​hono/node-server's releases.

v2.1.5

What's Changed

• fix(listener): abort the request signal when an HTTP/2 client resets the stream by @​affanmomin in honojs/node-server#404
• fix(serve-static): only serve GET and HEAD requests by @​usualoma in honojs/node-server#405

New Contributors

• @​affanmomin made their first contribution in honojs/node-server#404

Full Changelog: honojs/node-server@v2.1.4...v2.1.5

Commits

• 4b47a0d 2.1.5
• e77824a fix(serve-static): only serve GET and HEAD requests (#405)
• 1b6e6bf fix(listener): abort the request signal when an HTTP/2 client resets the stre...
• See full diff in compare view

Updates better-auth from 1.7.7 to 1.7.12

Release notes

Sourced from better-auth's releases.

v1.7.12

[!IMPORTANT] Action required

• If you use ID token sign-in with a provider that has no clientId, set clientId to every client ID your apps sign in with. (#11931)

better-auth

Bug Fixes

• Fixed the JWT plugin to verify JWTs and session cookie-cache JWTs with the stored key's algorithm instead of the token header's, and to warn when signing or verifying a JWT without an issuer or audience (#11925)
• Fixed OAuth callbacks completed through the OAuth proxy to run the same checks as the standard OAuth callback, including issuer and ID token nonce validation (#11930)
• Fixed auth.api.getSession() to keep the original database error as error.cause when the session lookup fails (#11924)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed mapProfileToUser failing to typecheck under exactOptionalPropertyTypes when it returns undefined for name, email, or image (#11918)
• Fixed ID token sign-in to reject tokens when the provider has no client ID, since their audience cannot be checked (#11931)
• Fixed a custom Facebook getUserInfo to no longer receive client-submitted access tokens issued to another Facebook app, and ID tokens missing exp or iat are now rejected (#11919)
• Restored the Twitch and Paybin ID token handling from before 1.7.11, which made account info fail once the ID token stored at sign-in expired (#11920)
• Added a cause option as a third argument to APIError.from() to keep the underlying error for server-side callers without exposing it in the response (#11924)

For detailed changes, see CHANGELOG

@better-auth/mcp

Bug Fixes

• Fixed requireMcpAuth to accept only OAuth access tokens and reject session JWTs from the JWT plugin, even when they share the issuer and audience (#11934)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed OIDC SSO sign-in to reject ID tokens missing exp or iat and providers with an empty client ID, matching social sign-in (#11935)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​alpcanaydin, @​bytaesu

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.12

Patch Changes

• #11925 fb48619 Thanks @​bytaesu! - The JWT plugin now verifies JWTs and session cookie-cache JWTs with the algorithm of the stored key instead of the one named in the token header, and logs a warning when it signs or verifies a JWT without an issuer or audience.

• #11924 681aa5c Thanks @​bytaesu! - auth.api.getSession() now keeps the original database error as error.cause when the session lookup fails, so server code can tell a transient failure from a bug.

• #11930 b18e3b8 Thanks @​bytaesu! - OAuth callbacks completed through the OAuth proxy now run the same checks as the standard OAuth callback, including issuer and ID token nonce validation.

• Updated dependencies [681aa5c, 4bc78ba, 876608d, 083a743, 492134a]:

  • @​better-auth/core@​1.7.12
  • @​better-auth/drizzle-adapter@​1.7.12
  • @​better-auth/kysely-adapter@​1.7.12
  • @​better-auth/memory-adapter@​1.7.12
  • @​better-auth/mongo-adapter@​1.7.12
  • @​better-auth/prisma-adapter@​1.7.12
  • @​better-auth/telemetry@​1.7.12

1.7.11

Patch Changes

• #10719 bd65db0 Thanks @​rendermani! - Recognize PostgreSQL int8 as a valid number type in migration diffs. Kysely's introspector reports pg_type.typname, so Better Auth's own bigint columns (such as the database-backed rate limiter's lastRequest) came back as int8 and were reported as a type mismatch on every run.

• #11521 37a75c9 Thanks @​aryan1306! - Fix database-backed rate limiting returning an excessively large X-Retry-After header instead of the remaining seconds in the rate-limit window.

• Updated dependencies [ce96569, 2f6ca3f, dfd8dd2]:

  • @​better-auth/core@​1.7.11
  • @​better-auth/drizzle-adapter@​1.7.11
  • @​better-auth/kysely-adapter@​1.7.11
  • @​better-auth/memory-adapter@​1.7.11
  • @​better-auth/mongo-adapter@​1.7.11
  • @​better-auth/prisma-adapter@​1.7.11
  • @​better-auth/telemetry@​1.7.11

1.7.10

Patch Changes

• #11393 eebd47a Thanks @​breken-ai! - If you use the lastLoginMethod plugin with oneTap, signing in through Google One Tap now records "google", the same value as signing in with the Google button. Before, a One Tap sign-in recorded nothing: the better-auth.last_used_login_method cookie kept its previous value or stayed unset, and so did user.lastLoginMethod with storeInDatabase.

  If your customResolveMethod includes a /one-tap/callback → "google" workaround, remove that mapping; keep the resolver if it handles other routes.

• #11821 09d07e6 Thanks @​gustavovalverde! - The Google One Tap prompt (authClient.oneTap() without button) no longer calls getSkippedReason(), which Google's FedCM migration guide says to remove. Before, it called it under any promptOptions.fedCM setting.

  A skipped prompt now ends the flow and calls onPromptNotification right away instead of retrying. Google doesn't report why a prompt was skipped, and a prompt the user closed stays hidden for Google's cooldown period, so the retries could not bring it back. Dismissed prompts still retry as before.

  Google Identity Services still logs its FedCM migration warning, because it does so whenever prompt() receives a listener. The plugin needs the listener to track dismissals and skips, so the warning is expected and safe to ignore.

... (truncated)

Commits

• f4260a9 chore: release v1.7.12 (#11922)
• b18e3b8 fix(oauth-proxy): run the standard callback checks on proxied callbacks (#11930)
• fb48619 fix(jwt): verify tokens with the stored key's algorithm (#11925)
• 681aa5c fix(session): keep the cause of session lookup failures (#11924)
• 52ab801 chore: release v1.7.11 (#11827)
• 37a75c9 fix(rate-limit): convert a string lastRequest before computing X-Retry-After ...
• bd65db0 fix(db): recognize postgres int8 as a number type in migration diffs (#10719)
• b734a41 chore: release v1.7.10 (#11795)
• eebd47a fix(last-login-method): record Google One Tap sign-ins (#11393)
• eaecb72 fix(one-tap): apply the Google provider's mapProfileToUser and getUserInfo (#...
• Additional commits viewable in compare view

Updates @commitlint/cli from 21.2.3 to 21.2.4

Release notes

Sourced from @​commitlint/cli's releases.

v21.2.4

21.2.4 (2026-10-18)

Bug Fixes

• fix(load): replace config file arrays with seed arrays by @​escapedcat in conventional-changelog/commitlint#5056
• fix: update dependency jsonc to v3 by @​renovate[bot] in conventional-changelog/commitlint#5020

Performance Improvements

• perf(load): load typescript configs with jiti directly by @​escapedcat in conventional-changelog/commitlint#5052

Docs, etc

• docs: add AGENTS.md with commit type guidance by @​escapedcat in conventional-changelog/commitlint#5053
• test(ensure): pin case conversion of digits, punctuation and accents by @​escapedcat in conventional-changelog/commitlint#5055

Full Changelog: conventional-changelog/commitlint@v21.2.3...v21.2.4

Changelog

Sourced from @​commitlint/cli's changelog.

21.2.4 (2026-10-18)

Note: Version bump only for package @​commitlint/cli

Commits

• d8e3656 v21.2.4
• See full diff in compare view

Updates @commitlint/config-conventional from 21.2.3 to 21.2.4

Release notes

Sourced from @​commitlint/config-conventional's releases.

v21.2.4

21.2.4 (2026-10-18)

Bug Fixes

• fix(load): replace config file arrays with seed arrays by @​escapedcat in conventional-changelog/commitlint#5056
• fix: update dependency jsonc to v3 by @​renovate[bot] in conventional-changelog/commitlint#5020

Performance Improvements

• perf(load): load typescript configs with jiti directly by @​escapedcat in conventional-changelog/commitlint#5052

Docs, etc

• docs: add AGENTS.md with commit type guidance by @​escapedcat in conventional-changelog/commitlint#5053
• test(ensure): pin case conversion of digits, punctuation and accents by @​escapedcat in conventional-changelog/commitlint#5055

Full Changelog: conventional-changelog/commitlint@v21.2.3...v21.2.4

Changelog

Sourced from @​commitlint/config-conventional's changelog.

21.2.4 (2026-10-18)

Note: Version bump only for package @​commitlint/config-conventional

Commits

• d8e3656 v21.2.4
• See full diff in compare view

Updates @playwright/test from 1.64.0 to 1.64.1

Release notes

Sourced from @​playwright/test's releases.

v1.64.1

Bug Fixes

• #43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
• #43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

Commits

• cfe490d cherry-pick(#43353): docs: release notes for v1.64 Python
• 866cbb8 chore: mark v1.64.1 (#43354)
• 1b29247 cherry-pick(#43250): fix(electron): do not drop windows that have not navigat...
• 632d976 cherry-pick(#43249): fix(chromium): disable AvoidCorsURLLoaderRestartOnRedirect
• 824d0c5 cherry-pick(#43217): chore(dotnet): fix async suffix of optional-arg overload...
• See full diff in compare view

Updates eslint from 10.12.0 to 10.13.0

Release notes

Sourced from eslint's releases.

v10.13.0

Features

• 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238) (Irfan fandi)
• a39d9fb feat: add globalThis to no-obj-calls (#21382) (synthex-byte)
• 66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#21399) (xbinaryx)

Bug Fixes

• 87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#21389) (Daniel Pinto)

Documentation

• 4783a68 docs: Update README (GitHub Actions Bot)
• 43f0ac9 docs: clarify parameter description in getText (#21287) (lumir)

Chores

• b59d889 chore: update github/codeql-action action to v4.38.3 (#21412) (renovate[bot])
• 95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410) (Francesco Trotta)
• 317fcb3 chore: update ecosystem plugins (#21409) (ESLint Bot)
• b92decf perf: skip no-redeclare scan for single-declaration variables (#21365) (James Ross)
• 47b7063 chore: update dependency @​eslint/json to ^2.1.1 (#21398) (renovate[bot])
• e5aea41 chore: update ecosystem plugins (#21390) (ESLint Bot)

Commits

• 4637f98 10.13.0
• 96df05c Build: changelog update for 10.13.0
• 4783a68 docs: Update README
• b59d889 chore: update github/codeql-action action to v4.38.3 (#21412)
• 95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410)
• 317fcb3 chore: update ecosystem plugins (#21409)
• 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238)
• 43f0ac9 docs: clarify parameter description in getText (#21287)
• a39d9fb feat: add globalThis to no-obj-calls (#21382)
• b92decf perf: skip no-redeclare scan for single-declaration variables (#21365)
• Additional commits viewable in compare view

Updates fallow from 3.32.0 to 3.34.1

Release notes

Sourced from fallow's releases.

v3.34.1: Oxlint config names, coverage maps, Vue templates and workspace globs

Bug fixes

• The Oxlint plugin reads .oxlintrc.jsonc and oxlint.config.mts. Oxlint finds these config files on its own, but fallow did not read them. Packages in their jsPlugins lists, at the top level and in overrides, showed as unused dependencies, and oxlint.config.mts showed as an unused file. Fallow now reads every config file name that Oxlint finds. Comments and trailing commas in .oxlintrc.jsonc parse correctly. Thanks @​gwynnnplaine for the report and the analysis. (#3525)
• A coverage map with a negative hit count loads. Vitest coverage-v8 can write a negative branch count, for example [5, -1], for the implicit else of an if. Fallow rejected the whole map. When --coverage or FALLOW_COVERAGE named the map, fallow health and fallow audit stopped with exit 2. Fallow now reads a negative count in s, f, b or b_T as 0, which is a miss. An auto-detected map that fails to load now gives a note that says fallow ignored it. Before, the note said that fallow used it. Thanks @​norvalbv for the report and the reproduction. (#3564)
• A < inside a nested Vue <template> keeps the references of the template. In \<template v-if="W">{{ 1 < 2 }}</template>, fallow read the < as the start of a tag and lost each name that the template used. Fallow then reported a named import that only the template used as an unused export. Fallow now skips {{ }} interpolations when it looks for the closing </template>. When no letter, /, ! or ? follows a <, fallow reads it as text, as in HTML. The cache versions change, so a warm cache does not keep the old result. Thanks @​BrocksiNet for the report and the minimal reproduction. (#3543)
• fallow health --type-aware --type-coupling passes --type-aware-require complete on large projects. The command failed --type-aware-require complete on projects with more than 40 coupling edges. The coupling report is one report for the whole project, and it now holds up to 10,000 evidence items. Fallow now reports a complete analysis as complete. Symbol, impact, and API-surface results keep the limit of 40 items. Above 10,000 items, the report stays partial with the evidence-limit reason. Thanks @​samaluk for the report and the experiment. (#3563)

Security

• Workspace globs no longer read directories outside the project root. An absolute entry, or an entry such as ../*, in package.json workspaces, pnpm-workspace.yaml packages, deno.json workspace, or the workspaces.patterns config listed directories outside the root. Fallow added no package from them. But a directory without a package.json got a glob-matched-no-package-json diagnostic with its outside path. Fallow now skips such an entry before it reads the disk. A new workspace-glob-outside-root diagnostic names the entry and the file that declares it. The run does not exit with an error, because npm, pnpm, and yarn accept a ../ workspace entry. A .. that stays inside the root, as in packages/../libs/*, still works. The findings do not change. (#3574)

Full Changelog: fallow-rs/fallow@v3.34.0...v3.34.1

v3.34.0: fallow mutation, segment-safe config globs, audit sub-analysis selection

Changed

• A single * in a config path glob now stays within one path segment. Only ** crosses directories. Before, src/plugins/*/index.js in entry also matched src/plugins/alpha/components/button/index.js. Each nested match became an entry point, so fallow did not report it as an unused file. The rule first applied to entry and dynamicallyLoaded (#3513, closes #3490). It now applies to every config path glob (#3541):

  • ignorePatterns, ignoreFindings, overrides[].files, ignoreExports[].file and ignoreCatalogReferences[].consumer,
  • duplicates.ignore, similarCode.ignore, health.ignore and health.thresholdOverrides[].files,
  • the boundaries zone and coverage globs, and the rule-pack file globs,
  • the framework[] fields usedExports[].pattern, manifestEntries[].manifests and detection.pattern.

  To keep the old match, change the single * to **. For example, change src/generated/* to src/generated/**, and *.test.ts to **/*.test.ts. For each pattern that now matches fewer files, fallow prints a warning on stderr. The warning names the config field, the pattern, the count of files that only the old rule matched, and the rewrite. --quiet hides the warning, and the JSON output does not change. A narrower glob can show new findings. Fallow matches a glob against each file path, not against each directory. Thus a line that you copy from .gitignore can match fewer files in ignorePatterns. Globs that match package names or import specifiers, such as ignoreDependencies and ignoreUnresolvedImports, do not change. Thanks @​jleifeld for the report.

• An existing prop-drilling: "error" setting now enforces CI. To report chains without an error, change the rule to warn. Archived JSON reports with effective_severity: "error" also render as errors. A config change does not rewrite those reports.

• Storybook, Vitest, Rstest, Jasmine and Playwright globs now accept every extglob group. One shared rewrite reads @(..), ?(..), +(..), *(..) and !(..) for these plugins and for import.meta.glob.

  • Storybook: before, only @(..) matched. Now ../src/**/!(*.dev).stories.@(js|ts) matches, and !(*.dev) excludes the files that match *.dev.
  • Playwright: before, a testMatch glob with a group made every script below testDir an entry point. Now only the matched files are entry points.
  • Vitest: before, a test.include glob with any group made no file an entry point. So fallow reported every test file as unused. A plain (a|b) group still matches one alternative.
  • Vitest, Rstest and Jasmine: !(..) and *(..) now match.
  • A +(..) group in an include glob now matches one or more repetitions. Before, Vitest, Rstest and Jasmine matched the group once only. The rewrite can also make a few more files entry points, for example a.test.jsx and a.test.tsx for *.test.+(ts|js). An exclude glob still matches the group once only.

• Complexity findings name more callback bodies. A function that got <anonymous> or <arrow> now takes a name from the code around it. Effect.fn("Users.create")(function* ...) gives Users.create, and it("renders", () => ...) gives it("renders"). A generator that a named function returns gives that name, for example load for const load = () => Effect.gen(function* ...). Scores and existing names do not change. A renamed finding gets a new CodeClimate fingerprint one time. An identity baseline gives the allowance of an <anonymous> or <arrow> bucket to the new names in the same file. A file move no longer moves an <arrow> bucket.

• Runs are faster in five places.

  • Plugin detection no longer walks node_modules for a Vitest, Jest or Rstest project glob. Since 3.33.1, a test.projects glob such as apps/**/vitest.config.ts read the full dependency store of a pnpm monorepo once per workspace. Plugin detection then took minutes. The walk now skips node_modules, .git, gitignored paths and symlinks that point out of the project root. Thanks @​wouterkroes for the report (closes #3532).
  • Import resolution is fast again in monorepos whose packages extend a root tsconfig that references them. Since 3.20.0, each source file checked about 760 configs in place of about 30. On a monorepo with 28 references and 4,200 modules, resolve imports takes 0.5 s in place of 10.1 s, with the same findings. Thanks @​thymikee for the report and for the patch in #3504 (closes #3503).
  • A run with a restored CI cache no longer rewrites every cache entry. An entry whose content did not change gets only its new timestamps. On a large monorepo, such a run is about a fifth faster. The dead-code run also frees its parsed modules on a helper thread.
  • An import through a barrel that does export * of many packages is now checked only against the packages that export its name. Findings do not change.
  • Each glob compile is about three times cheaper. A dead-code run takes about 5 to 7 percent fewer instructions on a mid-size project, and the binary is smaller.

• The build uses one oxc version. oxc_coverage_instrument moves to 0.14, which uses oxc 0.152 like the rest of fallow. cargo deny now fails when two versions of the core oxc crates enter the dependency graph.

• The MCP audit tool has a fallow://tools/audit guide. The guide names the five diff-risk rules and holds the styling, coverage, baseline,...

  Description has been truncated

[mroderick]

Dependency Upgrade Review

Verdict: Compatible (head fc3ba8c06ab7ca6296c205bdd596697e86007a51) · Confidence: High

Patch and minor-level bumps across nine packages (better-auth ecosystem to 1.7.12, plus dev tooling), lockfile-only change with coherent resolution and all peer dependencies satisfied; verified suites and the round-trip probe pass, so the upgrade is safe. No breaking API change touches any traced usage site.

Checks

Check	Result
planner suite	pass
auth suite	pass
round-trip probe	pass

Contracts

Contract	Status	Basis
OAuth provider round-trip (authorize → token → id-token claims) behavior unchanged	Verified	Round-trip probe passed; oauth-provider.test.js and oauth-flow.test.js green in the suites
JWT payload contract (issuer, audience=planner, 15m) unchanged	Verified	jwt-payload.test.js green in planner-suite
better-auth database migration API surface unchanged	Verified	getMigrations used by test helpers; auth-suite run with pg containers passed
@better-auth/oauth-provider 1.7.12 peer dependencies satisfied	Verified	Lockfile inspection confirms peerDependencies of @better-auth/oauth-provider resolved
Dev-tooling gates (eslint, prettier, fallow, commitlint) still pass	Unverified	Lint/format/fallow not among the verified checks; CI would catch on merge

Compatibility analysis — 9 packages

• better-auth 1.7.7 → 1.7.12: Patch bumps; betterAuth API, plugins, and getMigrations entrypoint unchanged here; peer ecosystem aligned at 1.7.12 in the lockfile
• @better-auth/oauth-provider 1.7.7 → 1.7.12: Patch bumps; oauthProvider options used (loginPage, scopes, validAudiences, customIdTokenClaims) unchanged; all peerDependencies satisfied
• @hono/node-server 2.1.4 → 2.1.5: Patch bump; serve/serveStatic/getConnInfo entrypoints as used here are intact; suites and probe exercise them
• @commitlint/cli 21.2.3 → 21.2.4: Patch bump affecting CI commit-lint gate only
• @commitlint/config-conventional 21.2.3 → 21.2.4: No version range change in package.json (^21.0.2); lockfile aligned transitively with @commitlint/cli
• @playwright/test 1.64.0 → 1.64.1: Patch bump; e2e suite exists but was not among the verified checks; risk is low at patch level
• eslint 10.12.0 → 10.13.0: Minor bump of the lint runner; npm run lint in CI covers it, but lint was not in the verified suites
• fallow 3.32.0 → 3.34.1 (pinned): Minor bump of a pinned binary with platform subpackages refreshed in the lockfile; npm run fallow runs in CI
• prettier 3.9.9 → 3.9.10: Patch bump of the formatter; prettier:check runs in CI only

Usage of 9 dependencies

• better-auth: src/auth.js betterAuth() with admin/magicLink/jwt plugins; test/helpers/test-instance.js betterAuth + plugins + getMigrations via better-auth/db/migration
• @better-auth/oauth-provider: src/auth.js oauthProvider() (scopes, validAudiences, accessTokenExpiresIn, customIdTokenClaims); test/helpers/test-instance.js same shape
• @hono/node-server: src/index.js serve(); src/app/app.js serveStatic; src/app/routes/test-magic-links.js getConnInfo
• @playwright/test: npm run e2e via npx playwright test in .github/workflows/ci.yml
• eslint: npm run lint in CI; lint-staged eslint --fix
• fallow: npm run fallow in CI
• prettier: prettier:check/write scripts; lint-staged
• @commitlint/cli: commitlint jobs in .github/workflows/ci.yml
• @commitlint/config-conventional: commitlint config loading in the same CI job

Test coverage

• Strong: better-auth and oauth-provider runtime behavior covered by planner-suite, auth-suite (tap with pg containers, oauth-provider and oauth-flow tests), and the passed round-trip probe
• Thin: dev-tooling bumps (eslint, prettier, fallow, commitlint) are not covered by any listed verification result; only CI lint/format jobs would exercise them
• Gap: playwright e2e (npm run e2e) not among verified suites, mitigated by the 1.64.0 → 1.64.1 patch scope

Calibration and confidence

Confidence: High — Patch-only bumps in one major family, full lockfile coherence confirmed, all usage sites traced, and three independent green checks including a runtime round-trip probe; only dev-tooling gates are under-covered.

1. Weakest claim: Lockfile shuffles (cosmiconfig-typescript-loader removal, adapter hoisting) were confirmed against peer ranges but only the given suites verify behavior; I did not independently run the tests.
2. Relied on but unverified: Dev-tooling gates: eslint, prettier, fallow, and commitlint bumps were not exercised by the listed verification results; neither was the Playwright e2e suite.
3. Falsifier: Run npm ci and npx playwright test (plus npm run lint / prettier:check / fallow) on this head; a Playwright crash or format/lint failure would falsify the unaffected-tooling assumption.