 Tomas DvorakandDevin
|
a083c30d76
|
fix(auth): bump better-auth to 1.6.33, node to 22
- CVE-2026-53514 (HIGH): better-auth <1.6.11 vulnerable to
unverified-email invitation acceptance; pinned 1.6.33 (1.7.x breaks
the migration introspection + schema check on this setup)
- qs override to >=6.16.0 clears moderate DoS via express
- kysely audit fix pulled 0.29.x requiring node>=22; node:20 is EOL
anyway - both Dockerfiles now on node:22-alpine, matching CI
- npm audit: 0 vulnerabilities; e2e verified (migrations run,
sign-up returns session)
Authored By: TDvorak <[email protected]>
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
|
2026-09-21 14:15:21 +02:00 |
|