From 226c3c7eb372139c14af08cd694fd52e95eeaf16 Mon Sep 17 00:00:00 2001 From: tknkaa Date: Mon, 9 Nov 2026 15:48:58 +0900 Subject: [PATCH] fix: update vulnerable auth and Excel dependencies --- app/lib/server/auth.server.test.ts | 1 - .../drop-unused-personal-data.server.test.ts | 3 +- package-lock.json | 155 +++++++++--------- package.json | 5 +- .../migration.sql | 4 + prisma/schema.prisma | 6 +- 6 files changed, 86 insertions(+), 88 deletions(-) create mode 100644 prisma/migrations/20261109090000_better_auth_account_identity/migration.sql diff --git a/app/lib/server/auth.server.test.ts b/app/lib/server/auth.server.test.ts index 62f4e4c..30aa8f2 100644 --- a/app/lib/server/auth.server.test.ts +++ b/app/lib/server/auth.server.test.ts @@ -36,7 +36,6 @@ describe("使わない個人情報を DB に保存しない", () => { userId: user.id, providerId: "google", accountId: "1234567890", - issuer: "https://accounts.google.com", ...tokens, }); await ctx.internalAdapter.updateAccount(account.id, tokens); diff --git a/app/lib/server/drop-unused-personal-data.server.test.ts b/app/lib/server/drop-unused-personal-data.server.test.ts index 7b177c1..4253027 100644 --- a/app/lib/server/drop-unused-personal-data.server.test.ts +++ b/app/lib/server/drop-unused-personal-data.server.test.ts @@ -9,7 +9,7 @@ beforeAll(async () => { // 本番に保存済みのトークン・IP アドレス・本物のメールと画像を、デプロイ時に消すマイグレーション it("保存済みの使わない個人情報を消し、ログインに要る Google のユーザー ID とパスワードは残す", async () => { - const google = { providerId: "google", issuer: "https://accounts.google.com" }; + const google = { providerId: "google" }; const tokens = { accessToken: "ya29.xxx", idToken: "eyJ.xxx", accessTokenExpiresAt: new Date() }; // Google で新規登録したユーザー await prisma.user.create({ @@ -42,7 +42,6 @@ it("保存済みの使わない個人情報を消し、ログインに要る Goo id: "pc", accountId: "p", providerId: "credential", - issuer: "local:credential", password: "hashed", }, { id: "pg", accountId: "222", ...google, ...tokens }, diff --git a/package-lock.json b/package-lock.json index 312bf17..a4efdf7 100644 --- a/package-lock.json +++ b/package-lock.json @@ -15,7 +15,7 @@ "@react-router/serve": "^8.4.0", "@resvg/resvg-js": "^2.6.2", "@types/mdx": "^2.0.14", - "better-auth": "^1.7.2", + "better-auth": "^1.7.7", "exceljs": "^4.4.0", "isbot": "^5.2.2", "pinyin": "^4.0.0", @@ -307,19 +307,18 @@ } }, "node_modules/@better-auth/core": { - "version": "1.7.2", - "resolved": "https://registry.npmjs.org/@better-auth/core/-/core-1.7.2.tgz", - "integrity": "sha512-j0nM4ygsWbF/fcYRoKtDn8gn8uLXkmC+075HqSqsJEAV828cJR9bvYBCUQ1zmxNyRBk6Iz/qXsA0Zm2oksiOTg==", + "version": "1.7.7", + "resolved": "https://registry.npmjs.org/@better-auth/core/-/core-1.7.7.tgz", + "integrity": "sha512-srgFzHEjB2WWlokFz1i4BfG41sNhsA105Pukgqu6RrEh5A+LSkzf1mCHydVipkjt9l5qswtBMi7IL6ouHbZL4Q==", "license": "MIT", "dependencies": { "@opentelemetry/semantic-conventions": "^1.41.1", "@standard-schema/spec": "^1.1.0", - "zod": "^4.3.6" + "zod": "^4.5.4" }, "peerDependencies": { "@better-auth/utils": "0.4.2", - "@better-fetch/fetch": "1.3.1", - "@cloudflare/workers-types": ">=4", + "@better-fetch/fetch": "1.3.2", "@opentelemetry/api": "^1.9.0", "better-call": "1.4.0", "jose": "^6.1.0", @@ -327,21 +326,18 @@ "nanostores": "^1.0.1" }, "peerDependenciesMeta": { - "@cloudflare/workers-types": { - "optional": true - }, "@opentelemetry/api": { "optional": true } } }, "node_modules/@better-auth/drizzle-adapter": { - "version": "1.7.2", - "resolved": "https://registry.npmjs.org/@better-auth/drizzle-adapter/-/drizzle-adapter-1.7.2.tgz", - "integrity": "sha512-A5wE10PIv3aS5LGePecEHntQylKy6OOF17B4dqlE0DwJeqU/IOBSd7/LZhMop9cNJ3WFjKMpazVSf91yYM/NFg==", + "version": "1.7.7", + "resolved": "https://registry.npmjs.org/@better-auth/drizzle-adapter/-/drizzle-adapter-1.7.7.tgz", + "integrity": "sha512-qon0U94PR5FQysuyGoAlGVQpIIiNg5dtDpwjE63sN/HjoRWZadZzHPcS9mn7JsJyQZK6iTNhd7LD0AaXt2f78w==", "license": "MIT", "peerDependencies": { - "@better-auth/core": "^1.7.2", + "@better-auth/core": "^1.7.7", "@better-auth/utils": "0.4.2", "drizzle-orm": "^0.45.2 || >=1.0.0-rc.1 <2.0.0" }, @@ -352,12 +348,12 @@ } }, "node_modules/@better-auth/kysely-adapter": { - "version": "1.7.2", - "resolved": "https://registry.npmjs.org/@better-auth/kysely-adapter/-/kysely-adapter-1.7.2.tgz", - "integrity": "sha512-LYdSRLOvZiF+6S0UThu+wE/Qxsq9P2jQs7ZKkY6BIBJqUjYyxVDmi8HFcantBvWWW1/BeQCSsD7YVDG4gICMIQ==", + "version": "1.7.7", + "resolved": "https://registry.npmjs.org/@better-auth/kysely-adapter/-/kysely-adapter-1.7.7.tgz", + "integrity": "sha512-9FONOCgOcrQI9wJ5v1oDGIg9sT7pa9RjZZQ4fsCTudo8R87SrIGNUvUxDFTJhZvUblvFfGaIBR9Vb8LA+8bqLQ==", "license": "MIT", "peerDependencies": { - "@better-auth/core": "^1.7.2", + "@better-auth/core": "^1.7.7", "@better-auth/utils": "0.4.2", "kysely": "^0.28.17 || ^0.29.0" }, @@ -368,22 +364,22 @@ } }, "node_modules/@better-auth/memory-adapter": { - "version": "1.7.2", - "resolved": "https://registry.npmjs.org/@better-auth/memory-adapter/-/memory-adapter-1.7.2.tgz", - "integrity": "sha512-0q1SXMzm5esH9L0xVuM6IxCk59E4G+3HySX4My9gvEwqtmUobykn+iuc/si3Y4xwUO7JODqQ5o+/pPcLDDMIrA==", + "version": "1.7.7", + "resolved": "https://registry.npmjs.org/@better-auth/memory-adapter/-/memory-adapter-1.7.7.tgz", + "integrity": "sha512-FqKFEe+b5tXXV0gRbyirca+qXgMpLOeJ8Wk19yykb/scQKy0WJ4k22WzEV3TTPctQV9DZhwCXPlDtQhnlOv5Gg==", "license": "MIT", "peerDependencies": { - "@better-auth/core": "^1.7.2", + "@better-auth/core": "^1.7.7", "@better-auth/utils": "0.4.2" } }, "node_modules/@better-auth/mongo-adapter": { - "version": "1.7.2", - "resolved": "https://registry.npmjs.org/@better-auth/mongo-adapter/-/mongo-adapter-1.7.2.tgz", - "integrity": "sha512-4879SmUWHUs0OYlvHoCFbycZ7i1bqytkcgAUdt9RLQMvZ5H3LRMTgax2YVlGZEXgwNjY/X7xAoXOecWLhlQWeA==", + "version": "1.7.7", + "resolved": "https://registry.npmjs.org/@better-auth/mongo-adapter/-/mongo-adapter-1.7.7.tgz", + "integrity": "sha512-ZnVDuRrXqbf0oHphrEN27oTImNH5NTO26dtWatq5cXyYAsH7goof9QIoTOmxTbBxUQahKBw9T6+9h6n+RtOE+g==", "license": "MIT", "peerDependencies": { - "@better-auth/core": "^1.7.2", + "@better-auth/core": "^1.7.7", "@better-auth/utils": "0.4.2", "mongodb": "^6.0.0 || ^7.0.0" }, @@ -394,12 +390,12 @@ } }, "node_modules/@better-auth/prisma-adapter": { - "version": "1.7.2", - "resolved": "https://registry.npmjs.org/@better-auth/prisma-adapter/-/prisma-adapter-1.7.2.tgz", - "integrity": "sha512-mXTr/83WrNWLrvzIjtgDgdu9iXhOcSG1+qBQOAKlbGSFiOB+z4IMRneQ2wmMOiB8mKY9qGkClVUjKRFXqtHnFQ==", + "version": "1.7.7", + "resolved": "https://registry.npmjs.org/@better-auth/prisma-adapter/-/prisma-adapter-1.7.7.tgz", + "integrity": "sha512-4YcnrcVdvWiAZw0sZl63tWUClPXg5r3QsLn7C2sG7kKEBY06zOng0ibecyxRBixKq1zE1ceHuEUqez5Rhi+nQA==", "license": "MIT", "peerDependencies": { - "@better-auth/core": "^1.7.2", + "@better-auth/core": "^1.7.7", "@better-auth/utils": "0.4.2", "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0", "prisma": "^5.0.0 || ^6.0.0 || ^7.0.0" @@ -414,14 +410,14 @@ } }, "node_modules/@better-auth/telemetry": { - "version": "1.7.2", - "resolved": "https://registry.npmjs.org/@better-auth/telemetry/-/telemetry-1.7.2.tgz", - "integrity": "sha512-LcWu+O0zrxYDQj8E36vfkJwGPW4k9ZDA/rCo0zST6ihzL+juR7pBowoZIM9E6tK0Vit52mf6412bGT4XM4eTjQ==", + "version": "1.7.7", + "resolved": "https://registry.npmjs.org/@better-auth/telemetry/-/telemetry-1.7.7.tgz", + "integrity": "sha512-PaRA6i+kAioVYmza2gHPcdrxP0hAotph4KV9hft2GeNJq+AZXDiBu3FuLM9HxvcmiZeUT74Vufqd9ypmB8veTA==", "license": "MIT", "peerDependencies": { - "@better-auth/core": "^1.7.2", + "@better-auth/core": "^1.7.7", "@better-auth/utils": "0.4.2", - "@better-fetch/fetch": "1.3.1" + "@better-fetch/fetch": "1.3.2" } }, "node_modules/@better-auth/utils": { @@ -434,9 +430,9 @@ } }, "node_modules/@better-fetch/fetch": { - "version": "1.3.1", - "resolved": "https://registry.npmjs.org/@better-fetch/fetch/-/fetch-1.3.1.tgz", - "integrity": "sha512-ABkD1WhyfPZprKRQI3bhATjeiFuNWC9PXhfGWqL+sg/gKrM977oFrYkdb4msM3hgUGonr7KlOsOFT5TU2rht9g==", + "version": "1.3.2", + "resolved": "https://registry.npmjs.org/@better-fetch/fetch/-/fetch-1.3.2.tgz", + "integrity": "sha512-Gs7n99b5tqUC6cQAPbV0uED3IraHB6xQbHLQ/C3l7ZFafHScOx9pQ+DYmP5blbLFShVWLqxNUlI9wi4xU/X+ow==", "license": "MIT" }, "node_modules/@blazediff/core": { @@ -892,9 +888,9 @@ } }, "node_modules/@opentelemetry/semantic-conventions": { - "version": "1.43.0", - "resolved": "https://registry.npmjs.org/@opentelemetry/semantic-conventions/-/semantic-conventions-1.43.0.tgz", - "integrity": "sha512-eSYWTm620tTk45EKSedaUL8MFYI8hW164hIXsgIHyxu3VobUB3fFCu5t0hQby6OoWRPsG1KkKUG2M5UadiLiVg==", + "version": "1.45.0", + "resolved": "https://registry.npmjs.org/@opentelemetry/semantic-conventions/-/semantic-conventions-1.45.0.tgz", + "integrity": "sha512-aOP45mbcOKbQVvFWfQmgoOPT8R2iwbbbgl83k4CujGV9BrJhFr3qG55MFpwFs4YLabpuW3HhzUY9eQxPlDqaZw==", "license": "Apache-2.0", "engines": { "node": ">=14" @@ -4726,20 +4722,20 @@ } }, "node_modules/better-auth": { - "version": "1.7.2", - "resolved": "https://registry.npmjs.org/better-auth/-/better-auth-1.7.2.tgz", - "integrity": "sha512-gKapKBEvYIGcMxi74RjQ7EbFLiqyQt58vdoJmL1qAlWSkY1Bc2Vqshl524/3u1NxauiOU03M/Ebh762Brmac9A==", - "license": "MIT", - "dependencies": { - "@better-auth/core": "1.7.2", - "@better-auth/drizzle-adapter": "1.7.2", - "@better-auth/kysely-adapter": "1.7.2", - "@better-auth/memory-adapter": "1.7.2", - "@better-auth/mongo-adapter": "1.7.2", - "@better-auth/prisma-adapter": "1.7.2", - "@better-auth/telemetry": "1.7.2", + "version": "1.7.7", + "resolved": "https://registry.npmjs.org/better-auth/-/better-auth-1.7.7.tgz", + "integrity": "sha512-Zhgxi/c5ylmfB/sX+nwnBbsFf/j6k0L8DvL6CJXZSrXgxc5pPMC/e7j812zNd4L4B4ELmdURCPw3X8nAOUdcjw==", + "license": "MIT", + "dependencies": { + "@better-auth/core": "1.7.7", + "@better-auth/drizzle-adapter": "1.7.7", + "@better-auth/kysely-adapter": "1.7.7", + "@better-auth/memory-adapter": "1.7.7", + "@better-auth/mongo-adapter": "1.7.7", + "@better-auth/prisma-adapter": "1.7.7", + "@better-auth/telemetry": "1.7.7", "@better-auth/utils": "0.4.2", - "@better-fetch/fetch": "1.3.1", + "@better-fetch/fetch": "1.3.2", "@noble/ciphers": "^2.2.0", "@noble/hashes": "^2.2.0", "better-call": "1.4.0", @@ -4747,7 +4743,7 @@ "jose": "^6.2.3", "kysely": "^0.28.17 || ^0.29.0", "nanostores": "^1.3.0", - "zod": "^4.3.6" + "zod": "^4.5.4" }, "peerDependencies": { "@lynx-js/react": "*", @@ -4755,7 +4751,6 @@ "@sveltejs/kit": "^2.0.0", "@tanstack/react-start": "^1.0.0", "@tanstack/solid-start": "^1.0.0", - "better-sqlite3": "^12.0.0", "drizzle-kit": ">=0.31.4 || >=1.0.0-beta.1", "drizzle-orm": "^0.45.2 || >=1.0.0-rc.1 <2.0.0", "mongodb": "^6.0.0 || ^7.0.0", @@ -4767,7 +4762,7 @@ "react-dom": "^18.0.0 || ^19.0.0", "solid-js": "^1.0.0", "svelte": "^4.0.0 || ^5.0.0", - "vitest": "^2.0.0 || ^3.0.0 || ^4.0.0", + "vitest": "^2.0.0 || ^3.0.0 || ^4.0.0 || ^5.0.0", "vue": "^3.0.0" }, "peerDependenciesMeta": { @@ -4786,9 +4781,6 @@ "@tanstack/solid-start": { "optional": true }, - "better-sqlite3": { - "optional": true - }, "drizzle-kit": { "optional": true }, @@ -4851,9 +4843,9 @@ } }, "node_modules/better-call/node_modules/@better-auth/utils": { - "version": "0.5.0", - "resolved": "https://registry.npmjs.org/@better-auth/utils/-/utils-0.5.0.tgz", - "integrity": "sha512-BL8W4EfIZFwlu0r54m3v1ztjDhu6dDe/amLTm0xybmbZaNgYUqhD3SjpAsnq0q8YD6/ki4iwIgxJNLP/N3TxiA==", + "version": "0.5.1", + "resolved": "https://registry.npmjs.org/@better-auth/utils/-/utils-0.5.1.tgz", + "integrity": "sha512-WETqw5vQ52uQ/xwWR4E8rTgT6fDEr/wnS+otDNkBCa/69281FCF32OKDdQUcahMCnjsvqXBNiEvAQHFB0EVRRg==", "license": "MIT", "dependencies": { "@noble/hashes": "^2.0.1" @@ -6904,9 +6896,9 @@ } }, "node_modules/jose": { - "version": "6.2.10", - "resolved": "https://registry.npmjs.org/jose/-/jose-6.2.10.tgz", - "integrity": "sha512-iiW7J9qRFlGxvCOIBDBDxFePQSn7ZMAnrYGhrrOo6siO/MIqwfyilLR27pkfDgUk+raLuzADS8A3S/KLBisc0g==", + "version": "6.2.16", + "resolved": "https://registry.npmjs.org/jose/-/jose-6.2.16.tgz", + "integrity": "sha512-4LSJpbuBuPdGrONCdZUy0xnxtLf8eEz+EY0SMXdHQEBU7bgUHDVblU/JAjryv3wID9/LK7/YuwFwq+AQNfMscQ==", "license": "MIT", "funding": { "url": "https://github.com/sponsors/panva" @@ -6991,9 +6983,9 @@ "license": "MIT" }, "node_modules/kysely": { - "version": "0.29.5", - "resolved": "https://registry.npmjs.org/kysely/-/kysely-0.29.5.tgz", - "integrity": "sha512-ooa+eSbBNPTo3MycPEuW5jdrxQdQwdtB3LC3h43FiXQbIry5tR0C5lDG7eealK0E4D7XjrnOP5DIUg/LyjRMYQ==", + "version": "0.29.8", + "resolved": "https://registry.npmjs.org/kysely/-/kysely-0.29.8.tgz", + "integrity": "sha512-ixHU1H4R+LeC5Y0nAhYgiGRFpFRHm2DXKEmJSs/vbes9sKXyssyzxzE/NYiOJX5fY0BL28biCre3GqlCqUwyXQ==", "license": "MIT", "engines": { "node": ">=22.0.0" @@ -8777,9 +8769,9 @@ } }, "node_modules/nanostores": { - "version": "1.5.2", - "resolved": "https://registry.npmjs.org/nanostores/-/nanostores-1.5.2.tgz", - "integrity": "sha512-B0UbxzK1s0CN8Xht6r+7iT5+xV8PTaRERR1nATeplRv1Rw5YLWfVAid0hkqY3EceqpG4RjTk8GAwIxQY39Rnwg==", + "version": "1.5.5", + "resolved": "https://registry.npmjs.org/nanostores/-/nanostores-1.5.5.tgz", + "integrity": "sha512-FixtE239Gl6Gz0ZGCK0WzvNwObNCIwVT+L7zQcf1QgcA6AzBxblzqe9OT88qiucNkhsjSOqiogSaF5jVbJiqSA==", "funding": [ { "type": "github", @@ -10005,9 +9997,9 @@ } }, "node_modules/set-cookie-parser": { - "version": "3.1.2", - "resolved": "https://registry.npmjs.org/set-cookie-parser/-/set-cookie-parser-3.1.2.tgz", - "integrity": "sha512-5/r/lTwbJ3zQ+qwdUFZYeRNqda7P5HD8zQKqlSjdGt1/S0cjLAphHusj4Y58ahDtWn/g32xrIS58/ikOvwl0Lw==", + "version": "3.2.2", + "resolved": "https://registry.npmjs.org/set-cookie-parser/-/set-cookie-parser-3.2.2.tgz", + "integrity": "sha512-df017qMeYuXo4emL09nlyMpi2i2MtEIKS/6jtXH3vmjFgIRsOi852/5RmhJ4EkvN3ZF8jXadM/EkTPXgc8yPIw==", "license": "MIT" }, "node_modules/setimmediate": { @@ -10717,13 +10709,16 @@ "license": "MIT" }, "node_modules/uuid": { - "version": "8.3.2", - "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz", - "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==", - "deprecated": "uuid@10 and below is no longer supported. For ESM codebases, update to uuid@latest. For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).", + "version": "11.1.1", + "resolved": "https://registry.npmjs.org/uuid/-/uuid-11.1.1.tgz", + "integrity": "sha512-vIYxrBCC/N/K+Js3qSN88go7kIfNPssr/hHCesKCQNAjmgvYS2oqr69kIufEG+O4+PfezOH4EbIeHCfFov8ZgQ==", + "funding": [ + "https://github.com/sponsors/broofa", + "https://github.com/sponsors/ctavan" + ], "license": "MIT", "bin": { - "uuid": "dist/bin/uuid" + "uuid": "dist/esm/bin/uuid" } }, "node_modules/valibot": { diff --git a/package.json b/package.json index ac0f05c..3e76cdb 100644 --- a/package.json +++ b/package.json @@ -22,7 +22,7 @@ "@react-router/serve": "^8.4.0", "@resvg/resvg-js": "^2.6.2", "@types/mdx": "^2.0.14", - "better-auth": "^1.7.2", + "better-auth": "^1.7.7", "exceljs": "^4.4.0", "isbot": "^5.2.2", "pinyin": "^4.0.0", @@ -53,6 +53,9 @@ "vitest": "5.0.5" }, "overrides": { + "exceljs": { + "uuid": "^11.1.1" + }, "vite": "npm:@voidzero-dev/vite-plus-core@1.4.0", "vitest": "5.0.5" } diff --git a/prisma/migrations/20261109090000_better_auth_account_identity/migration.sql b/prisma/migrations/20261109090000_better_auth_account_identity/migration.sql new file mode 100644 index 0000000..31f09d5 --- /dev/null +++ b/prisma/migrations/20261109090000_better_auth_account_identity/migration.sql @@ -0,0 +1,4 @@ +-- Better Auth 1.7.3 以降はアカウント識別に issuer を使わないため、不要な列と一意制約を取り除く。 +DROP INDEX "accounts_issuer_accountId_key"; +ALTER TABLE "accounts" DROP COLUMN "issuer"; +CREATE UNIQUE INDEX "accounts_providerId_accountId_key" ON "accounts"("providerId", "accountId"); diff --git a/prisma/schema.prisma b/prisma/schema.prisma index 4b15676..a387756 100644 --- a/prisma/schema.prisma +++ b/prisma/schema.prisma @@ -250,9 +250,7 @@ model Session { model Account { id String @id - // ログイン方法の種類（email/password なら "local:credential"）。 - // better-auth 1.7 以降、同一providerId内でaccountIdの一意性を保証するために追加されたフィールド - issuer String + // ログイン方法の種類（email/password なら "credential"、Google なら "google"） accountId String providerId String userId String @@ -267,7 +265,7 @@ model Account { createdAt DateTime @default(now()) updatedAt DateTime @updatedAt - @@unique([issuer, accountId]) + @@unique([providerId, accountId]) @@index([userId]) @@map("accounts") }