From 18869364639aea53b0e9874db844aab99a308348 Mon Sep 17 00:00:00 2001 From: Sharang Parnerkar <30073382+mighty840@users.noreply.github.com> Date: Mon, 31 Aug 2026 10:40:09 +0200 Subject: [PATCH] =?UTF-8?q?fix(deps):=20next-auth=20beta.30=20->=20beta.32?= =?UTF-8?q?=20=E2=80=94=20the=20advisory=20targets=20next-auth=20itself?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The #22 bump patched @auth/core to 0.41.3 but trivy also flags the next-auth package directly (CVE-2026-73420 CRITICAL + CVE-2026-73421, existence-based auth bypass on configuration errors), both fixed in 5.0.0-beta.32. Tests 80/80 at 100% coverage; typecheck, lint, build clean. Co-Authored-By: Claude Fable 5 --- package.json | 2 +- pnpm-lock.yaml | 12 ++++++------ 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/package.json b/package.json index 95c9341..1eedbbd 100644 --- a/package.json +++ b/package.json @@ -24,7 +24,7 @@ "geist": "^1.7.2", "lucide-react": "^1.17.0", "next": "16.2.11", - "next-auth": "5.0.0-beta.30", + "next-auth": "5.0.0-beta.32", "react": "19.0.0", "react-dom": "19.0.0", "tailwind-merge": "^3.6.0" diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 2e6795e..6e409a4 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -29,8 +29,8 @@ importers: specifier: 16.2.11 version: 16.2.11(@babel/core@7.29.0)(@playwright/test@1.60.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0) next-auth: - specifier: 5.0.0-beta.30 - version: 5.0.0-beta.30(next@16.2.11(@babel/core@7.29.0)(@playwright/test@1.60.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))(react@19.0.0) + specifier: 5.0.0-beta.32 + version: 5.0.0-beta.32(next@16.2.11(@babel/core@7.29.0)(@playwright/test@1.60.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))(react@19.0.0) react: specifier: 19.0.0 version: 19.0.0 @@ -2145,13 +2145,13 @@ packages: natural-compare@1.4.0: resolution: {integrity: sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==} - next-auth@5.0.0-beta.30: - resolution: {integrity: sha512-+c51gquM3F6nMVmoAusRJ7RIoY0K4Ts9HCCwyy/BRoe4mp3msZpOzYMyb5LAYc1wSo74PMQkGDcaghIO7W6Xjg==} + next-auth@5.0.0-beta.32: + resolution: {integrity: sha512-CGlChIEWZ6LltNVxrE5yiySMID+Idpmry47JYA5lLwgD8Sx02a8M65VL0TWVz9nbnOioS/tCW/rP/0+mE7Qp4Q==} peerDependencies: '@simplewebauthn/browser': ^9.0.1 '@simplewebauthn/server': ^9.0.2 next: ^14.0.0-0 || ^15.0.0 || ^16.0.0 - nodemailer: ^7.0.7 + nodemailer: ^7.0.7 || ^8.0.5 react: ^18.2.0 || ^19.0.0 peerDependenciesMeta: '@simplewebauthn/browser': @@ -4873,7 +4873,7 @@ snapshots: natural-compare@1.4.0: {} - next-auth@5.0.0-beta.30(next@16.2.11(@babel/core@7.29.0)(@playwright/test@1.60.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))(react@19.0.0): + next-auth@5.0.0-beta.32(next@16.2.11(@babel/core@7.29.0)(@playwright/test@1.60.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))(react@19.0.0): dependencies: '@auth/core': 0.41.3 next: 16.2.11(@babel/core@7.29.0)(@playwright/test@1.60.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0)