Bump the minor-and-patch group with 9 updates by dependabot[bot] · Pull Request #14 · WireCore/WireTerm-Server

dependabot · 2026-11-08T19:14:34Z

Bumps the minor-and-patch group with 9 updates:

Package	From	To
@better-auth/api-key	`1.7.17`	`1.7.18`
@fastify/cors	`11.4.0`	`11.4.1`
@opentelemetry/exporter-logs-otlp-grpc	`0.223.0`	`0.301.0`
@opentelemetry/exporter-trace-otlp-grpc	`0.223.0`	`0.301.0`
@opentelemetry/instrumentation-http	`0.223.0`	`0.301.0`
@opentelemetry/instrumentation-pino	`0.69.0`	`0.70.0`
@opentelemetry/sdk-node	`0.223.0`	`0.301.0`
@scalar/fastify-api-reference	`1.76.4`	`1.77.0`
better-auth	`1.7.17`	`1.7.18`

Updates @better-auth/api-key from 1.7.17 to 1.7.18

Release notes

Sourced from @better-auth/api-key's releases.

v1.7.18

[!IMPORTANT] Action required

If you use getTestInstance with testWith: "mysql", run a MySQL server at 127.0.0.1:3306 with the root password set to root_password. (#12244)

better-auth

Bug Fixes

Fixed "revoke all sessions" with secondaryStorage and storeSessionInDatabase to also revoke sessions created while the revocation is running, except sessions created by a session.delete.after hook, which stay active (#12259)

Fixed getTestInstance from better-auth/test to close its own Postgres connection pool and SQLite database when the test file finishes, while with Vitest's default sequence.hooks: "stack" your afterAll hooks still run first and can keep using the instance (#12250)

Fixed getTestInstance with testWith: "mysql" hanging, and added a separate database per instance so several instances can run in one test file (#12244)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

fix(core): accept introspected tokens when verifyOptions.typ is set (#12249)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@gustavovalverde

Full changelog: v1.7.17...v1.7.18

Changelog

Sourced from @better-auth/api-key's changelog.

1.7.18

Commits

38f43e3 chore: release v1.7.18 (#12252)
See full diff in compare view

Updates @fastify/cors from 11.4.0 to 11.4.1

Release notes

Sourced from @fastify/cors's releases.

v11.4.1

What's Changed

fix: preserve header tokens with whitespace preceding commas in vary parser by @TalhaHunter101 in fastify/fastify-cors#423

New Contributors

@TalhaHunter101 made their first contribution in fastify/fastify-cors#423

Full Changelog: fastify/fastify-cors@v11.4.0...v11.4.1

Commits

33424f5 Bumped v11.4.1
115ff7c fix: preserve header tokens with whitespace preceding commas in vary parser (...
See full diff in compare view

Updates @opentelemetry/exporter-logs-otlp-grpc from 0.223.0 to 0.301.0

Release notes

Sourced from @opentelemetry/exporter-logs-otlp-grpc's releases.

experimental/v0.301.0

0.301.0

💥 Breaking Changes

feat(sdk-node)!: The experimental startNodeSdk() code path for environment-based config (i.e. when not using a config file), has full option coverage. #6999 @trentm

startNodeSdk() should now be a viable replacement for new NodeSDK(), supporting similar (but not exactly the same) options for configuring most SDK components.

startNodeSDK() has been deprecated, use startNodeSdk() (slight capitalization change).

Two resource detectors have been added to the default set for new NodeSDK() users: os and serviceinstance. This means that when not specifying OTEL_NODE_RESOURCE_DETECTORS, the SDK Resource will include os.* and service.instance.id attributes.

refactor(configuration)!: The responsibility of the configuration package has been reduced to just the parsing, validation, and TypeScript types for declarative config files. #6999 @trentm

Breaking: The configuration package no longer supports creating a synthetic ConfigurationModel from environment variables.

Breaking: The configuration package API has changed: createConfigFactory() has been replaced with `parseConfigFile().

🐛 Bug Fixes

fix(instrumentation-http): don't require('forwarded-parse') in ESM builds (#7261) @avens19

fix(otlp-grpc-exporter-base): avoid an incomplete mTLS warning for root-CA-only TLS configuration (#7235) @LarryHu0217

fix(sdk-node): warn and skip, instead of erroring, on an unknown resource detector name in declarative config #7252 @trentm

fix(sdk-node): use OTEL_EVENT_ATTRIBUTE_COUNT_LIMIT and OTEL_LINK_ATTRIBUTE_COUNT_LIMIT environment variables for span limits #6999 @trentm

Before this change, different environment variable names (see next point), that are not in the OTel spec were used. They will still be supported as a fallback for the spec names for a period of approximately six months.

The OTEL_SPAN_ATTRIBUTE_PER_EVENT_COUNT_LIMIT and OTEL_SPAN_ATTRIBUTE_PER_LINK_COUNT_LIMIT environment variables are deprecated. Support for them will be removed sometime after six months, to allow transition to the correct environment variables in the spec.

fix(otlp-exporter-base): pick the browser fetch mode from the document origin, so exports from an opaque-origin document (e.g. a sandboxed iframe) no longer fail with mode: 'same-origin' #7211 @MO2k4

fix: raise the minimum @opentelemetry/api peer dependency version to 1.10.0 for packages that depend on @opentelemetry/core, @opentelemetry/otlp-transformer or @opentelemetry/instrumentation, as these use API 1.10 features. (#7258) @volodymyrshk @pichlermarc

Combining these packages with @opentelemetry/api 1.9.x never worked: they failed at runtime. The peer dependency now makes npm report this at install time instead.

If you see a peer dependency error after upgrading, update @opentelemetry/api to 1.10.0 or later.

📚 Documentation

docs(exporters): update dead semantic conventions resource specification links in OTLP exporters #7254 @helmipradita

experimental/v0.300.0

0.300.0

Summary

The minimum supported Node.js has been raised to >=22.15.0. This means that support for Node.js 18 and 20 has been dropped.

The public interface has changed

for notes on migrating to 3.x / 0.300.x see the upgrade guide

Only stable versions 3.0.0 are compatible with this release

💥 Breaking Changes

chore(shim-opencensus)!: remove the @opentelemetry/shim-opencensus package

In the OpenTelemetry Specification v1.58.0 the OpenCensus compatibility requirements were deprecated. The JavaScript OpenCensus shim package will not receive any more releases after the current 0.222.0 release (source code for last release).

feat(instrumentation-http)!: remove deprecated serverName field from HttpInstrumentationConfig #7081

The serverName option had no effect; stable HTTP semantic conventions do not include http.server_name. Remove it from any setConfig() or constructor call.

feat(sdk-node)!: remove deprecated NodeSDKConfiguration fields logRecordProcessor, metricReader, spanProcessor and deprecated namespace re-exports node, tracing

NodeSDKConfiguration.logRecordProcessor — use logRecordProcessors instead.

NodeSDKConfiguration.metricReader — use metricReaders instead.

... (truncated)

Commits

9985264 chore: prepare next release (#7272)
7983f1c fix: raise @opentelemetry/api peer floor to 1.10.0 where needed (#7259)
0a5c4ed chore(deps): update dependency lerna to v10.1.1 (#7270)
4eda691 fix(propagator-b3): reject invalid trace id lengths (#7262)
5ca48a7 fix(context-zone): declare the @opentelemetry/api peer dependency (#7268)
babaf15 docs(migration): note that API 1.10.0 needs SDK 3.x (#7253)
daae704 fix(instrumentation-http): don't require('forwarded-parse') in ESM builds (...
cc2a315 fix(otlp-grpc-exporter-base): avoid false mTLS configuration warnings (#7241)
29eec06 fix(sdk-node): warn and skip, instead of erroring, on an unknown resource det...
4667c0a docs: update dead semantic conventions resource specification links (#7254)
Additional commits viewable in compare view

Updates @opentelemetry/exporter-trace-otlp-grpc from 0.223.0 to 0.301.0

Release notes

Sourced from @opentelemetry/exporter-trace-otlp-grpc's releases.

experimental/v0.301.0

0.301.0

💥 Breaking Changes

feat(sdk-node)!: The experimental startNodeSdk() code path for environment-based config (i.e. when not using a config file), has full option coverage. #6999 @trentm

startNodeSdk() should now be a viable replacement for new NodeSDK(), supporting similar (but not exactly the same) options for configuring most SDK components.

startNodeSDK() has been deprecated, use startNodeSdk() (slight capitalization change).

Two resource detectors have been added to the default set for new NodeSDK() users: os and serviceinstance. This means that when not specifying OTEL_NODE_RESOURCE_DETECTORS, the SDK Resource will include os.* and service.instance.id attributes.

refactor(configuration)!: The responsibility of the configuration package has been reduced to just the parsing, validation, and TypeScript types for declarative config files. #6999 @trentm

Breaking: The configuration package no longer supports creating a synthetic ConfigurationModel from environment variables.

Breaking: The configuration package API has changed: createConfigFactory() has been replaced with `parseConfigFile().

🐛 Bug Fixes

fix(instrumentation-http): don't require('forwarded-parse') in ESM builds (#7261) @avens19

fix(otlp-grpc-exporter-base): avoid an incomplete mTLS warning for root-CA-only TLS configuration (#7235) @LarryHu0217

fix(sdk-node): warn and skip, instead of erroring, on an unknown resource detector name in declarative config #7252 @trentm

fix(sdk-node): use OTEL_EVENT_ATTRIBUTE_COUNT_LIMIT and OTEL_LINK_ATTRIBUTE_COUNT_LIMIT environment variables for span limits #6999 @trentm

Before this change, different environment variable names (see next point), that are not in the OTel spec were used. They will still be supported as a fallback for the spec names for a period of approximately six months.

The OTEL_SPAN_ATTRIBUTE_PER_EVENT_COUNT_LIMIT and OTEL_SPAN_ATTRIBUTE_PER_LINK_COUNT_LIMIT environment variables are deprecated. Support for them will be removed sometime after six months, to allow transition to the correct environment variables in the spec.

fix(otlp-exporter-base): pick the browser fetch mode from the document origin, so exports from an opaque-origin document (e.g. a sandboxed iframe) no longer fail with mode: 'same-origin' #7211 @MO2k4

fix: raise the minimum @opentelemetry/api peer dependency version to 1.10.0 for packages that depend on @opentelemetry/core, @opentelemetry/otlp-transformer or @opentelemetry/instrumentation, as these use API 1.10 features. (#7258) @volodymyrshk @pichlermarc

Combining these packages with @opentelemetry/api 1.9.x never worked: they failed at runtime. The peer dependency now makes npm report this at install time instead.

If you see a peer dependency error after upgrading, update @opentelemetry/api to 1.10.0 or later.

📚 Documentation

docs(exporters): update dead semantic conventions resource specification links in OTLP exporters #7254 @helmipradita

experimental/v0.300.0

0.300.0

Summary

The minimum supported Node.js has been raised to >=22.15.0. This means that support for Node.js 18 and 20 has been dropped.

The public interface has changed

for notes on migrating to 3.x / 0.300.x see the upgrade guide

Only stable versions 3.0.0 are compatible with this release

💥 Breaking Changes

chore(shim-opencensus)!: remove the @opentelemetry/shim-opencensus package

In the OpenTelemetry Specification v1.58.0 the OpenCensus compatibility requirements were deprecated. The JavaScript OpenCensus shim package will not receive any more releases after the current 0.222.0 release (source code for last release).

feat(instrumentation-http)!: remove deprecated serverName field from HttpInstrumentationConfig #7081

The serverName option had no effect; stable HTTP semantic conventions do not include http.server_name. Remove it from any setConfig() or constructor call.

feat(sdk-node)!: remove deprecated NodeSDKConfiguration fields logRecordProcessor, metricReader, spanProcessor and deprecated namespace re-exports node, tracing

NodeSDKConfiguration.logRecordProcessor — use logRecordProcessors instead.

NodeSDKConfiguration.metricReader — use metricReaders instead.

... (truncated)

Commits

9985264 chore: prepare next release (#7272)
7983f1c fix: raise @opentelemetry/api peer floor to 1.10.0 where needed (#7259)
0a5c4ed chore(deps): update dependency lerna to v10.1.1 (#7270)
4eda691 fix(propagator-b3): reject invalid trace id lengths (#7262)
5ca48a7 fix(context-zone): declare the @opentelemetry/api peer dependency (#7268)
babaf15 docs(migration): note that API 1.10.0 needs SDK 3.x (#7253)
daae704 fix(instrumentation-http): don't require('forwarded-parse') in ESM builds (...
cc2a315 fix(otlp-grpc-exporter-base): avoid false mTLS configuration warnings (#7241)
29eec06 fix(sdk-node): warn and skip, instead of erroring, on an unknown resource det...
4667c0a docs: update dead semantic conventions resource specification links (#7254)
Additional commits viewable in compare view

Updates @opentelemetry/instrumentation-http from 0.223.0 to 0.301.0

Release notes

Sourced from @opentelemetry/instrumentation-http's releases.

experimental/v0.301.0

0.301.0

💥 Breaking Changes

feat(sdk-node)!: The experimental startNodeSdk() code path for environment-based config (i.e. when not using a config file), has full option coverage. #6999 @trentm

startNodeSdk() should now be a viable replacement for new NodeSDK(), supporting similar (but not exactly the same) options for configuring most SDK components.

startNodeSDK() has been deprecated, use startNodeSdk() (slight capitalization change).

Two resource detectors have been added to the default set for new NodeSDK() users: os and serviceinstance. This means that when not specifying OTEL_NODE_RESOURCE_DETECTORS, the SDK Resource will include os.* and service.instance.id attributes.

refactor(configuration)!: The responsibility of the configuration package has been reduced to just the parsing, validation, and TypeScript types for declarative config files. #6999 @trentm

Breaking: The configuration package no longer supports creating a synthetic ConfigurationModel from environment variables.

Breaking: The configuration package API has changed: createConfigFactory() has been replaced with `parseConfigFile().

🐛 Bug Fixes

fix(instrumentation-http): don't require('forwarded-parse') in ESM builds (#7261) @avens19

fix(otlp-grpc-exporter-base): avoid an incomplete mTLS warning for root-CA-only TLS configuration (#7235) @LarryHu0217

fix(sdk-node): warn and skip, instead of erroring, on an unknown resource detector name in declarative config #7252 @trentm

fix(sdk-node): use OTEL_EVENT_ATTRIBUTE_COUNT_LIMIT and OTEL_LINK_ATTRIBUTE_COUNT_LIMIT environment variables for span limits #6999 @trentm

Before this change, different environment variable names (see next point), that are not in the OTel spec were used. They will still be supported as a fallback for the spec names for a period of approximately six months.

The OTEL_SPAN_ATTRIBUTE_PER_EVENT_COUNT_LIMIT and OTEL_SPAN_ATTRIBUTE_PER_LINK_COUNT_LIMIT environment variables are deprecated. Support for them will be removed sometime after six months, to allow transition to the correct environment variables in the spec.

fix(otlp-exporter-base): pick the browser fetch mode from the document origin, so exports from an opaque-origin document (e.g. a sandboxed iframe) no longer fail with mode: 'same-origin' #7211 @MO2k4

fix: raise the minimum @opentelemetry/api peer dependency version to 1.10.0 for packages that depend on @opentelemetry/core, @opentelemetry/otlp-transformer or @opentelemetry/instrumentation, as these use API 1.10 features. (#7258) @volodymyrshk @pichlermarc

Combining these packages with @opentelemetry/api 1.9.x never worked: they failed at runtime. The peer dependency now makes npm report this at install time instead.

If you see a peer dependency error after upgrading, update @opentelemetry/api to 1.10.0 or later.

📚 Documentation

docs(exporters): update dead semantic conventions resource specification links in OTLP exporters #7254 @helmipradita

experimental/v0.300.0

0.300.0

Summary

The minimum supported Node.js has been raised to >=22.15.0. This means that support for Node.js 18 and 20 has been dropped.

The public interface has changed

for notes on migrating to 3.x / 0.300.x see the upgrade guide

Only stable versions 3.0.0 are compatible with this release

💥 Breaking Changes

chore(shim-opencensus)!: remove the @opentelemetry/shim-opencensus package

In the OpenTelemetry Specification v1.58.0 the OpenCensus compatibility requirements were deprecated. The JavaScript OpenCensus shim package will not receive any more releases after the current 0.222.0 release (source code for last release).

feat(instrumentation-http)!: remove deprecated serverName field from HttpInstrumentationConfig #7081

The serverName option had no effect; stable HTTP semantic conventions do not include http.server_name. Remove it from any setConfig() or constructor call.

feat(sdk-node)!: remove deprecated NodeSDKConfiguration fields logRecordProcessor, metricReader, spanProcessor and deprecated namespace re-exports node, tracing

NodeSDKConfiguration.logRecordProcessor — use logRecordProcessors instead.

NodeSDKConfiguration.metricReader — use metricReaders instead.

... (truncated)

Commits

9985264 chore: prepare next release (#7272)
7983f1c fix: raise @opentelemetry/api peer floor to 1.10.0 where needed (#7259)
0a5c4ed chore(deps): update dependency lerna to v10.1.1 (#7270)
4eda691 fix(propagator-b3): reject invalid trace id lengths (#7262)
5ca48a7 fix(context-zone): declare the @opentelemetry/api peer dependency (#7268)
babaf15 docs(migration): note that API 1.10.0 needs SDK 3.x (#7253)
daae704 fix(instrumentation-http): don't require('forwarded-parse') in ESM builds (...
cc2a315 fix(otlp-grpc-exporter-base): avoid false mTLS configuration warnings (#7241)
29eec06 fix(sdk-node): warn and skip, instead of erroring, on an unknown resource det...
4667c0a docs: update dead semantic conventions resource specification links (#7254)
Additional commits viewable in compare view

Updates @opentelemetry/instrumentation-pino from 0.69.0 to 0.70.0

Changelog

Sourced from @opentelemetry/instrumentation-pino's changelog.

0.70.0 (2026-10-20)

⚠ BREAKING CHANGES

bump versions to SDK 3.0/API 1.10.0 (#3839)

raise minimum supported Node.js to 22.15.0, dropping 18 and 20 support (#3847)

Miscellaneous Chores

bump versions to SDK 3.0/API 1.10.0 (#3839) (cfdbfcc)

raise minimum supported Node.js to 22.15.0, dropping 18 and 20 support (#3847) (79dc211)

Dependencies

The following workspace dependencies were updated

devDependencies

@opentelemetry/contrib-test-utils bumped from ^0.70.0 to ^0.71.0

Commits

cc263ac chore: release main (#3719)
36fcb9c feat(deps): update deps matching '@opentelemetry/*' (#3804)
2729b78 chore: revert "chore!: raise minimum supported Node.js to 22.15.0, dropping 1...
36dffd2 chore!: raise minimum supported Node.js to 22.15.0, dropping 18 and 20 suppor...
932fc96 chore: release main (#3638)
015582a feat(deps): update deps matching '@opentelemetry/*' (#3716)
b26d7f2 docs: fix sdk-node README links (#3676)
27e172a chore: release main (#3596)
466d5de feat(deps): update deps matching '@opentelemetry/*' (#3629)
b7efd7b chore(*): migrate to sdk-trace (#3599)
Additional commits viewable in compare view

Updates @opentelemetry/sdk-node from 0.223.0 to 0.301.0

Release notes

Sourced from @opentelemetry/sdk-node's releases.

experimental/v0.301.0

0.301.0

💥 Breaking Changes

feat(sdk-node)!: The experimental startNodeSdk() code path for environment-based config (i.e. when not using a config file), has full option coverage. #6999 @trentm

startNodeSdk() should now be a viable replacement for new NodeSDK(), supporting similar (but not exactly the same) options for configuring most SDK components.

startNodeSDK() has been deprecated, use startNodeSdk() (slight capitalization change).

Two resource detectors have been added to the default set for new NodeSDK() users: os and serviceinstance. This means that when not specifying OTEL_NODE_RESOURCE_DETECTORS, the SDK Resource will include os.* and service.instance.id attributes.

refactor(configuration)!: The responsibility of the configuration package has been reduced to just the parsing, validation, and TypeScript types for declarative config files. #6999 @trentm

Breaking: The configuration package no longer supports creating a synthetic ConfigurationModel from environment variables.

Breaking: The configuration package API has changed: createConfigFactory() has been replaced with `parseConfigFile().

🐛 Bug Fixes

fix(instrumentation-http): don't require('forwarded-parse') in ESM builds (#7261) @avens19

fix(otlp-grpc-exporter-base): avoid an incomplete mTLS warning for root-CA-only TLS configuration (#7235) @LarryHu0217

fix(sdk-node): warn and skip, instead of erroring, on an unknown resource detector name in declarative config #7252 @trentm

fix(sdk-node): use OTEL_EVENT_ATTRIBUTE_COUNT_LIMIT and OTEL_LINK_ATTRIBUTE_COUNT_LIMIT environment variables for span limits #6999 @trentm

Before this change, different environment variable names (see next point), that are not in the OTel spec were used. They will still be supported as a fallback for the spec names for a period of approximately six months.

The OTEL_SPAN_ATTRIBUTE_PER_EVENT_COUNT_LIMIT and OTEL_SPAN_ATTRIBUTE_PER_LINK_COUNT_LIMIT environment variables are deprecated. Support for them will be removed sometime after six months, to allow transition to the correct environment variables in the spec.

fix(otlp-exporter-base): pick the browser fetch mode from the document origin, so exports from an opaque-origin document (e.g. a sandboxed iframe) no longer fail with mode: 'same-origin' #7211 @MO2k4

fix: raise the minimum @opentelemetry/api peer dependency version to 1.10.0 for packages that depend on @opentelemetry/core, @opentelemetry/otlp-transformer or @opentelemetry/instrumentation, as these use API 1.10 features. (#7258) @volodymyrshk @pichlermarc

Combining these packages with @opentelemetry/api 1.9.x never worked: they failed at runtime. The peer dependency now makes npm report this at install time instead.

If you see a peer dependency error after upgrading, update @opentelemetry/api to 1.10.0 or later.

📚 Documentation

docs(exporters): update dead semantic conventions resource specification links in OTLP exporters #7254 @helmipradita

experimental/v0.300.0

0.300.0

Summary

The minimum supported Node.js has been raised to >=22.15.0. This means that support for Node.js 18 and 20 has been dropped.

The public interface has changed

for notes on migrating to 3.x / 0.300.x see the upgrade guide

Only stable versions 3.0.0 are compatible with this release

💥 Breaking Changes

chore(shim-opencensus)!: remove the @opentelemetry/shim-opencensus package

In the OpenTelemetry Specification v1.58.0 the OpenCensus compatibility requirements were deprecated. The JavaScript OpenCensus shim package will not receive any more releases after the current 0.222.0 release (source code for last release).

feat(instrumentation-http)!: remove deprecated serverName field from HttpInstrumentationConfig #7081

The serverName option had no effect; stable HTTP semantic conventions do not include http.server_name. Remove it from any setConfig() or constructor call.

feat(sdk-node)!: remove deprecated NodeSDKConfiguration fields logRecordProcessor, metricReader, spanProcessor and deprecated namespace re-exports node, tracing

NodeSDKConfiguration.logRecordProcessor — use logRecordProcessors instead.

NodeSDKConfiguration.metricReader — use metricReaders instead.

... (truncated)

Commits

9985264 chore: prepare next release (#7272)
7983f1c fix: raise @opentelemetry/api peer floor to 1.10.0 where needed (#7259)
0a5c4ed chore(deps): update dependency lerna to v10.1.1 (#7270)
4eda691 fix(propagator-b3): reject invalid trace id lengths (#7262)
5ca48a7 fix(context-zone): declare the @opentelemetry/api peer dependency (#7268)
babaf15 docs(migration): note that API 1.10.0 needs SDK 3.x (#7253)
daae704 fix(instrumentation-http): don't require('forwarded-parse') in ESM builds (...
cc2a315 fix(otlp-grpc-exporter-base): avoid false mTLS configuration warnings (#7241)
29eec06 fix(sdk-node): warn and skip, instead of erroring, on an unknown resource det...
4667c0a docs: update dead semantic conventions resource specification links (#7254)
Additional commits viewable in compare view

Updates @scalar/fastify-api-reference from 1.76.4 to 1.77.0

Changelog

Sourced from @scalar/fastify-api-reference's changelog.

1.77.0

Commits

See full diff in compare view

Updates better-auth from 1.7.17 to 1.7.18

Release notes

Sourced from better-auth's releases.

v1.7.18

[!IMPORTANT] Action required

If you use getTestInstance with testWith: "mysql", run a MySQL server at 127.0.0.1:3306 with the root password set to root_password. (#12244)

better-auth

Bug Fixes

Fixed "revoke all sessions" with secondaryStorage and storeSessionInDatabase to also revoke sessions created while the revocation is running, except sessions created by a session.delete.after hook, which stay active (#12259)

Fixed getTestInstance from better-auth/test to close its own Postgres connection pool and SQLite database when the test file finishes, while with Vitest's default sequence.hooks: "stack" your afterAll hooks still run first and can keep using the instance (#12250)

Fixed getTestInstance with testWith: "mysql" hanging, and added a separate database per instance so several instances can run in one test file (#12244)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

fix(core): accept introspected tokens when verifyOptions.typ is set (#12249)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@gustavovalverde

Full changelog: v1.7.17...v1.7.18

Changelog

Sourced from better-auth's changelog.

1.7.18

Patch Changes

#12259 9e2a0ec Thanks @gustavovalverde! - Fixed "revoke all sessions" with secondaryStorage and storeSessionInDatabase so that sessions created while the revocation runs are revoked too. Sessions created by a session.delete.after hook still stay active.

#12244 85f4342 Thanks @gustavovalverde! - getTestInstance with testWith: "mysql" no longer hangs. It expects a MySQL server at 127.0.0.1:3306 whose root password is root_password, and it creates and drops a separate database for each instance, so several instances can run in one test file.

#12250 278bb28 Thanks @gustavovalverde! - getTestInstance from better-auth/test now closes the Postgres connection pool and the SQLite database it created when the test file finishes. Previously both stayed open until the test worker exited. With Vitest's default sequence.hooks: "stack", afterAll hooks in your test files still run before this cleanup and can keep using the instance.

Updated dependencies [9342a73]:

@better-auth/core@1.7.18

@better-auth/drizzle-adapter@1.7.18

@better-auth/kysely-adapter@1.7.18

@better-auth/memory-adapter@1.7.18

@better-auth/mongo-adapter@1.7.18

@better-auth/prisma-adapter@1.7.18

@better-auth/telemetry@1.7.18

Commits

38f43e3 chore: release v1.7.18 (#12252)
9e2a0ec fix(session): revoke sessions created while bulk revocation runs (#12259)
278bb28 fix(test-utils): close the instance's own Postgres and SQLite handles (#12250)
85f4342 fix(test-utils): make testWith mysql work and run it in CI (#12244)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the minor-and-patch group with 9 updates: | Package | From | To | | --- | --- | --- | | [@better-auth/api-key](https://github.com/better-auth/better-auth/tree/HEAD/packages/api-key) | `1.7.17` | `1.7.18` | | [@fastify/cors](https://github.com/fastify/fastify-cors) | `11.4.0` | `11.4.1` | | [@opentelemetry/exporter-logs-otlp-grpc](https://github.com/open-telemetry/opentelemetry-js) | `0.223.0` | `0.301.0` | | [@opentelemetry/exporter-trace-otlp-grpc](https://github.com/open-telemetry/opentelemetry-js) | `0.223.0` | `0.301.0` | | [@opentelemetry/instrumentation-http](https://github.com/open-telemetry/opentelemetry-js) | `0.223.0` | `0.301.0` | | [@opentelemetry/instrumentation-pino](https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/instrumentation-pino) | `0.69.0` | `0.70.0` | | [@opentelemetry/sdk-node](https://github.com/open-telemetry/opentelemetry-js) | `0.223.0` | `0.301.0` | | [@scalar/fastify-api-reference](https://github.com/scalar/scalar/tree/HEAD/integrations/fastify) | `1.76.4` | `1.77.0` | | [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.17` | `1.7.18` | Updates `@better-auth/api-key` from 1.7.17 to 1.7.18 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/api-key/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.18/packages/api-key) Updates `@fastify/cors` from 11.4.0 to 11.4.1 - [Release notes](https://github.com/fastify/fastify-cors/releases) - [Commits](fastify/fastify-cors@v11.4.0...v11.4.1) Updates `@opentelemetry/exporter-logs-otlp-grpc` from 0.223.0 to 0.301.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.223.0...experimental/v0.301.0) Updates `@opentelemetry/exporter-trace-otlp-grpc` from 0.223.0 to 0.301.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.223.0...experimental/v0.301.0) Updates `@opentelemetry/instrumentation-http` from 0.223.0 to 0.301.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.223.0...experimental/v0.301.0) Updates `@opentelemetry/instrumentation-pino` from 0.69.0 to 0.70.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js-contrib/blob/main/packages/instrumentation-pino/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-js-contrib/commits/contrib-test-utils-v0.70.0/packages/instrumentation-pino) Updates `@opentelemetry/sdk-node` from 0.223.0 to 0.301.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.223.0...experimental/v0.301.0) Updates `@scalar/fastify-api-reference` from 1.76.4 to 1.77.0 - [Release notes](https://github.com/scalar/scalar/releases) - [Changelog](https://github.com/scalar/scalar/blob/main/integrations/fastify/CHANGELOG.md) - [Commits](https://github.com/scalar/scalar/commits/HEAD/integrations/fastify) Updates `better-auth` from 1.7.17 to 1.7.18 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.18/packages/better-auth) --- updated-dependencies: - dependency-name: "@better-auth/api-key" dependency-version: 1.7.18 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@fastify/cors" dependency-version: 11.4.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@opentelemetry/exporter-logs-otlp-grpc" dependency-version: 0.301.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/exporter-trace-otlp-grpc" dependency-version: 0.301.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/instrumentation-http" dependency-version: 0.301.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/instrumentation-pino" dependency-version: 0.70.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/sdk-node" dependency-version: 0.301.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@scalar/fastify-api-reference" dependency-version: 1.77.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: better-auth dependency-version: 1.7.18 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 8, 2026

Navigation Menu

Repository navigation

Bump the minor-and-patch group with 9 updates - #14

Bump the minor-and-patch group with 9 updates#14
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-77c640a962

dependabot Bot commented on behalf of github Nov 8, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 8, 2026

v1.7.18

better-auth

Bug Fixes

@better-auth/core

Bug Fixes

Contributors

1.7.18

v11.4.1

What's Changed

New Contributors

experimental/v0.301.0

0.301.0

💥 Breaking Changes

🐛 Bug Fixes

📚 Documentation

experimental/v0.300.0

0.300.0

Summary

💥 Breaking Changes

experimental/v0.301.0

0.301.0

💥 Breaking Changes

🐛 Bug Fixes

📚 Documentation

experimental/v0.300.0

0.300.0

Summary

💥 Breaking Changes

experimental/v0.301.0

0.301.0

💥 Breaking Changes

🐛 Bug Fixes

📚 Documentation

experimental/v0.300.0

0.300.0

Summary

💥 Breaking Changes

0.70.0 (2026-10-20)

⚠ BREAKING CHANGES

Miscellaneous Chores

Dependencies

experimental/v0.301.0

0.301.0

💥 Breaking Changes

🐛 Bug Fixes

📚 Documentation

experimental/v0.300.0

0.300.0

Summary

💥 Breaking Changes

1.77.0

v1.7.18

better-auth

Bug Fixes

@better-auth/core

Bug Fixes

Contributors

1.7.18

Patch Changes

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`better-auth`

`@better-auth/core`

`better-auth`

`@better-auth/core`