build(deps): move better-auth to 1.6.29 - #156
Merged
Merged
Conversation
Dependabot offered the passkey plugin alone (PR #152), which npm refuses: the plugin's peer on @better-auth/core pulls a newer core than the pinned better-auth accepts, so the three packages only move together. better-auth and the SSO plugin keep their exact pins rather than gaining a caret. They sit on the authentication path and their minor releases have already changed plugin internals this project reads (see the notes on the SSO plugin's dist behaviours); a caret would let that happen without a pull request. Verified on the whole auth surface rather than by version number: 234 unit, 86 integration and 14 e2e including the real sign-in paths, TOTP, email OTP, the passkey round trip against a virtual authenticator, and the OIDC callback against the stub identity provider. Type-check, lint, build and audit clean.
This was referenced Aug 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes Dependabot PR #152, which offered
@better-auth/passkeyalone and cannot resolve: the plugin's peer on@better-auth/corepulls a newer core than the pinnedbetter-authaccepts. The three packages move together.better-authand@better-auth/ssokeep their exact pins; only the passkey plugin keeps a caret, as before.Verified across the auth surface: 234 unit, 86 integration, 14 e2e (password sign-in, TOTP, email OTP, passkey round trip, OIDC callback against the stub IdP), plus tsc, lint, build and
npm auditclean.