fix(deps): next-auth beta.32 — the advisory targets next-auth itself #23

Merged

sharang merged 1 commits from fix/next-auth-beta32 into main 2026-08-31 08:40:16 +00:00

Conversation 0 Commits 1 Files Changed 2

+7 -7

sharang commented 2026-08-31 08:40:10 +00:00

Owner

Copy Link

Copy Source

Follow-up to #22: trivy flags the next-auth package directly (CVE-2026-73420 CRITICAL + CVE-2026-73421), both fixed in 5.0.0-beta.32 — the @auth/core override alone left the shared gate red. All gates green (80 tests, 100% coverage, tsc, lint, build).

🤖 Generated with Claude Code

Follow-up to #22: trivy flags the next-auth package directly (CVE-2026-73420 CRITICAL + CVE-2026-73421), both fixed in 5.0.0-beta.32 — the @auth/core override alone left the shared gate red. All gates green (80 tests, 100% coverage, tsc, lint, build). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

sharang added 1 commit 2026-08-31 08:40:11 +00:00

fix(deps): next-auth beta.30 -> beta.32 — the advisory targets next-auth itself ... 1886936463

The #22 bump patched @auth/core to 0.41.3 but trivy also flags the
next-auth package directly (CVE-2026-73420 CRITICAL + CVE-2026-73421,
existence-based auth bypass on configuration errors), both fixed in
5.0.0-beta.32. Tests 80/80 at 100% coverage; typecheck, lint, build
clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

sharang merged commit 63fde7993c into main 2026-08-31 08:40:16 +00:00

sharang referenced this issue from a commit 2026-08-31 08:43:39 +00:00

fix(deps): next-auth beta.30 -> beta.32 (advisory targets next-auth itself)

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

Benjamin_Boenisch sharang (Sharang Parnerkar)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: platform/portal#23