Repository navigation
chore(deps): pin better-auth to 1.6.15 - #421
Merged
Merged
Conversation
1.6.16 added stricter Origin/Referer validation on cookieless email sign-in (better-auth#9973), which can silently reject first-login requests on deploys whose trusted-origin config doesn't match exactly -- manifesting as a login page that loops on /api/auth/get-session. Pin one patch behind the breaking change rather than reverting to the pre-bump pins (^1.0.0 in core, ^1.6.2 in wiki), which resolved to different versions across workspaces.
createRedisConnection() sets maxRetriesPerRequest: null (required for BullMQ's blocking commands), so isRedisLive()'s probe.ping() retries forever instead of rejecting when Redis isn't reachable -- hanging past the 10s hook timeout in CI jobs that don't run a Redis service container (typecheck-test). Race the ping against a 2s timeout so the probe still resolves to false promptly, same as the existing try/catch fallback intends.
phase2-uat.integration.test.ts is an integration suite that exercises the real rate-limiter against a live Redis (UAT 3/4), not a mock. typecheck-test had no Redis service, so any of its tests that don't explicitly gate on the redisLive probe (e.g. UAT 2's POST /auth/recover) hung against the unreachable default connection until the per-test timeout. core-boot-health already provisions Redis this same way; mirror it here instead of teaching every test to degrade gracefully without it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
better-authto exact1.6.15incore/package.jsonandwiki/package.json(was^1.6.11, resolving to1.6.16via the lockfile).1.6.16added stricter Origin/Referer validation on cookieless email sign-in (better-auth#9973) — first-login requests now get checked againsttrustedOriginseven with no cookies present, where prior versions skipped that check entirely. On a deploy whose trusted-origin config doesn't match exactly, this can silently reject sign-in, manifesting as a login page that loops on/api/auth/get-session.^1.0.0in core,^1.6.2in wiki), which resolved to two different actual versions across workspaces — the thing the original bump (9415489) was fixing.honostays at its current bumped version; its recent security fixes (JWTNumericDate, some MODERATEs) are unrelated to this issue.Test plan
coretypecheck cleanwikitypecheck cleancoretest suite green (501 passed)better-authresolves to1.6.15in both workspaces afterpnpm install