chore(deps): bump the production group across 1 directory with 3 updates

[dependabot]

Bumps the production group with 3 updates in the / directory: better-auth, hono and jose.

Updates better-auth from 1.6.25 to 1.6.26

Release notes

Sourced from better-auth's releases.

v1.6.26

better-auth

Bug Fixes

• Fixed session cleanup on user deletion to also remove sessions from secondary storage (#10520)
• Fixed findSessions to skip invalid secondary-storage session entries without discarding other valid sessions (#10580)
• Fixed email OTP sign-up to pass the verification type to custom OTP generators (#10608)
• Fixed email OTP password reset to allow retrying after entering an invalid password (#10552)
• Fixed email OTP verification to no longer reveal whether an email is registered before the OTP is verified (#10605)
• Fixed jwtClient() collapsing createAuthClient type inference when combined with other client plugins (#10513)
• Fixed JWT key minting inside database transactions to use the transaction-scoped adapter, preventing deadlocks on SQLite and ensuring keys commit with their surrounding transaction on Postgres and MySQL (#10623)
• Fixed oAuthProxy to preserve Apple user data from form_post callbacks (#10599)
• Fixed oneTapClient() collapsing createAuthClient type inference when combined with other client plugins (#10635)
• Fixed database rate-limit cleanup to complete when no background task handler is configured (#10619)
• Improved nextCookies performance in instrumented Next.js applications by reusing the next/headers import promise (#10467)

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added a utility for creating stable, namespaced placeholder emails on the reserved placeholder.invalid domain (#10576)

For detailed changes, see CHANGELOG

@better-auth/redis-storage

Bug Fixes

• Fixed listKeys() and clear() to use SCAN instead of KEYS so large keyspaces no longer block the Redis server (#10507)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​bytaesu, @​Emmaccen, @​gustavovalverde, @​jashkarangiya, @​jeroenvandermerwe, @​jlucaso1, @​krish-vachhani, @​mrosberghaus, @​XXMOHAMED012

Full changelog: v1.6.25...v1.6.26

Changelog

Sourced from better-auth's changelog.

1.6.26

Patch Changes

• #10619 9ede805 Thanks @​jeroenvandermerwe! - Ensure database rate-limit cleanup completes when no background task handler is configured.

• #10608 5a811f1 Thanks @​bytaesu! - Pass the email verification type to custom OTP generators after email sign-up.

• #10605 d8327f1 Thanks @​XXMOHAMED012! - The email OTP verification check no longer reveals whether an email is registered before the OTP itself is verified.

• #10513 e2c73fb Thanks @​mrosberghaus! - Fix jwtClient() collapsing createAuthClient type inference when combined with other client plugins such as inferAdditionalFields. Additional user fields (for example on updateUser) are preserved again.

• #10635 af50c45 Thanks @​krish-vachhani! - Fix oneTapClient() collapsing createAuthClient type inference when combined with other client plugins. The oneTap action is available on the client again.

• #10633 701cd43 Thanks @​gustavovalverde! - Minting or reading a JWKS signing key inside an active database transaction now uses the transaction-scoped adapter instead of the root connection. On a single-connection SQLite database with native transactions enabled, this no longer deadlocks, and on Postgres and MySQL the key commits with the surrounding transaction instead of independently of it.

• #10599 e7b0eba Thanks @​bytaesu! - Preserve Apple user data from form_post callbacks when using oAuthProxy.

• #10552 2b4a14f Thanks @​bytaesu! - Allow users to retry email OTP password resets after entering an invalid password.

• #10467 7552a3b Thanks @​jlucaso1! - Improve nextCookies performance in instrumented Next.js applications.

• #10580 ea38fca Thanks @​Emmaccen! - Skip invalid secondary-storage session entries without discarding other valid sessions.

• #10520 a03e4c1 Thanks @​bytaesu! - Ensure deleting a user also removes their sessions from secondary storage.

• Updated dependencies [a30e274]:

  • @​better-auth/core@​1.6.26
  • @​better-auth/drizzle-adapter@​1.6.26
  • @​better-auth/kysely-adapter@​1.6.26
  • @​better-auth/memory-adapter@​1.6.26
  • @​better-auth/mongo-adapter@​1.6.26
  • @​better-auth/prisma-adapter@​1.6.26
  • @​better-auth/telemetry@​1.6.26

Commits

• a16b30e chore: release v1.6.26 (#10521)
• 9ede805 fix(rate-limit): await database cleanup by default (#10619)
• af50c45 fix(one-tap): preserve client plugin inference with oneTapClient (#10635)
• 222facf fix(jwt): resolve the transaction-scoped adapter when signing (#10623)
• d8327f1 fix(email-otp): verify OTP before revealing whether the email exists (#10605)
• e7b0eba fix(oauth-proxy): preserve Apple user data (#10599)
• 5a811f1 fix(email-otp): pass verification type on sign-up (#10608)
• e18606b chore(deps): upgrade OpenTelemetry to v2 (#10601)
• ea38fca fix(db): skip null-parsed session token in findSessions instead of returning ...
• 7552a3b perf(next-js): reuse the next/headers import promise in production (#10467)
• Additional commits viewable in compare view

Updates hono from 4.12.32 to 4.13.0

Release notes

Sourced from hono's releases.

v4.13.0

Hono v4.13.0 is now available!

The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more.

Performance improvements

This release includes a series of small optimizations: skipping unnecessary Headers allocations, replacing regex tests with indexOf, allocating internal state lazily, and more.

Here is benchmarks/fetch comparing v4.12 and v4.13 (ROUNDS=5 ./compare.sh, Bun 1.4.0, Apple Silicon — each measurement runs in a fresh process, and the variant order is reversed every round to avoid warm-up bias):

Benchmark	v4.12	v4.13	Speedup
ping — GET /	165.83 ns	163.99 ns	1.01x
query — GET /id/1?name=bun	674.40 ns	616.99 ns	1.09x
json — GET /user	528.99 ns	422.44 ns	1.25x
body — POST /json	1.16 µs	1.00 µs	1.15x

The individual changes:

• perf(context): iterate the header record with for..in honojs/hono#5118
• perf(url): replace regex tests with indexOf honojs/hono#5121
• perf(context): skip Headers creation when there are no headers to merge honojs/hono#5122
• perf(urls): refactor tryDecodeURIComponent honojs/hono#5158
• perf(request): allocate #validatedData lazily honojs/hono#5175
• perf(request): probe the body cache without allocating honojs/hono#5176

In addition, the RegExpRouter rewrite described below makes route registration plus the first match roughly 20% faster.

Thanks @​kibertoad for the contributions!

First-class QUERY method support

The QUERY method — a safe, idempotent method that carries a request body — is now a first-class citizen in Hono. You can define QUERY handlers with app.query():

const app = new Hono()
app.query('/search', async (c) => {
const conditions = await c.req.json()
return c.json(await search(conditions))
})

Thanks @​shellhaki!

QUERY support across built-in middleware

The built-in middleware has been updated to handle QUERY requests properly:

... (truncated)

Commits

• 192768f 4.13.0
• b0c2d90 Merge pull request #5154 from honojs/next
• 8f07028 fix(compress): set Vary: Accept-Encoding on negotiated responses (#5137)
• 8a0b18f feat(reg-exp-router): throw UnsupportedPathError during route registration (#...
• 3feb355 fix(jsx): allow a function component to return an array (#5179)
• 5d911d2 feat(utils/headers): add HTTP fields newly registered with IANA (#5153)
• 30277ae feat(jwt,jwk): add a configurable WWW-Authenticate realm (#5141)
• 1f707c5 feat(middleware): add method-not-allowed middleware (#5132)
• 2df0b47 feat(jsx): add React-compatible overloads to useRef (#5063)
• 3bc96ba feat(cache): add first-class support for QUERY requests (#5119)
• Additional commits viewable in compare view

Updates jose from 6.2.4 to 6.2.8

Release notes

Sourced from jose's releases.

v6.2.8

Fixes

• enforce a single recipient when decrypting dir and ECDH-ES (505c383)
• reject a non-string "alg" in EmbeddedJWK (714f870)

Refactor

• index the JWS and JWE registries without a wrapper (925f3bb)
• name the "alg" source in unsupported algorithm failures (1500459)

v6.2.7

Fixes

• require own JOSE properties for presence checks (90ab09c)

Refactor

• reduce bundle size (767d7f1)

v6.2.6

Fixes

• types: accept host CryptoKey declarations (b48a15b)

v6.2.5

Fixes

• compare claim values for falsy validation options (eb86956)
• forward key management parameters for a single JWE recipient (2d4f801)
• handle a zero-length JWE additional authenticated data (16ca398)
• reject a generateKeyPair crv option the algorithm does not imply (76364e9)
• reject an unencoded payload in the JWS Compact Serialization (01d053f)
• reject characters outside the Base64URL alphabet (0ebb971), references #879
• reject duplicate "crit" values when producing (31d60e1)
• reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
• reject truncated ASN.1 key data (7a16c66)
• surface non-ASCII token segments as JOSE errors (194fe11)
• types: correct JWK and CryptoKey types (62a196d)
• types: correct key resolver and JWT header types (e95f8c4)
• validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

• correct subpaths and API documentation (2daec38)
• document consumer-supplied type parameters (9e9f66c)
• stop claiming the JWK "use" parameter is used during import (47a07b2)
• update CHANGELOG.md (fc51bf5)

Refactor

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.8 (2026-08-03)

Fixes

• enforce a single recipient when decrypting dir and ECDH-ES (505c383)
• reject a non-string "alg" in EmbeddedJWK (714f870)

Refactor

• index the JWS and JWE registries without a wrapper (925f3bb)
• name the "alg" source in unsupported algorithm failures (1500459)

6.2.7 (2026-08-01)

Fixes

• require own JOSE properties for presence checks (90ab09c)

Refactor

• reduce bundle size (767d7f1)

6.2.6 (2026-07-31)

Fixes

• types: accept host CryptoKey declarations (b48a15b)

6.2.5 (2026-07-29)

Fixes

• compare claim values for falsy validation options (eb86956)
• forward key management parameters for a single JWE recipient (2d4f801)
• handle a zero-length JWE additional authenticated data (16ca398)
• reject a generateKeyPair crv option the algorithm does not imply (76364e9)
• reject an unencoded payload in the JWS Compact Serialization (01d053f)
• reject characters outside the Base64URL alphabet (0ebb971), references #879
• reject duplicate "crit" values when producing (31d60e1)
• reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
• reject truncated ASN.1 key data (7a16c66)
• surface non-ASCII token segments as JOSE errors (194fe11)
• types: correct JWK and CryptoKey types (62a196d)
• types: correct key resolver and JWT header types (e95f8c4)
• validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

• correct subpaths and API documentation (2daec38)
• document consumer-supplied type parameters (9e9f66c)

... (truncated)

Commits

• 8b768eb chore(release): 6.2.8
• 1500459 refactor: name the "alg" source in unsupported algorithm failures
• 714f870 fix: reject a non-string "alg" in EmbeddedJWK
• 925f3bb refactor: index the JWS and JWE registries without a wrapper
• 505c383 fix: enforce a single recipient when decrypting dir and ECDH-ES
• 514831d chore(deps): bump the actions group with 3 updates
• 45965db chore: cleanup after release
• 60b941f chore(release): 6.2.7
• 90ab09c fix: require own JOSE properties for presence checks
• 767d7f1 refactor: reduce bundle size
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 15, 2026, 4:59 AM ET / 08:59 UTC.

ClawSweeper review

What this changes

Updates the API worker’s Better Auth, Hono, and JOSE production dependencies and synchronizes their pnpm lockfile resolutions.

Merge readiness

⚠️ Ready for maintainer review - 3 items remain

Keep open: current main and release v0.5.0 still pin the older dependency versions, while this is a narrow, clean update of direct API-worker runtime dependencies. No patch defect was found; it needs normal maintainer validation of the affected auth, JWT, and routing paths before merge.

Priority: P3
Reviewed head: b92b6f7e8dc6ecd7ef9bb2e32dc22f331df2fc33

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, mechanically consistent dependency update with no source-level correctness finding.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot dependency-update PR is bot-authored, so the external-contributor real-behavior-proof gate does not apply; normal maintainer validation remains appropriate.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This Dependabot dependency-update PR is bot-authored, so the external-contributor real-behavior-proof gate does not apply; normal maintainer validation remains appropriate.
Evidence reviewed	5 items	Narrow dependency diff: The branch changes only the API package manifest and lockfile, updating three direct production dependencies without source or workflow changes. Runtime dependency boundary: Current main dispatches /api/auth requests to Better Auth through the Hono worker router. JWT dependency boundary: Current main imports JOSE to verify Cloudflare Access JWTs used by the admin authentication flow.
Findings	None	None.
Security	None	None.

How this fits together

The Cloudflare API worker accepts public flag-evaluation and admin requests. Hono routes those requests, Better Auth manages sessions, and JOSE verifies Cloudflare Access JWTs for administrative access.

flowchart LR
  Client[Client requests] --> Worker[API worker]
  Worker --> Guard[Host and path policy]
  Guard --> Router[HTTP routing]
  Router --> Auth[Session and OAuth handling]
  Router --> JWT[Access JWT verification]
  Router --> Responses[Evaluation and admin responses]

Loading

Before merge

• Resolve merge risk (P1) - Hono 4.13.0 is used by the public and protected API router, so a compatibility regression could affect route dispatch.
• Resolve merge risk (P1) - Better Auth and JOSE participate in session and JWT verification flows; their updated runtime behavior should be checked on the exact PR head before landing.
• Complete next step (P2) - No discrete repair is indicated; the remaining action is normal maintainer validation of the runtime dependency upgrade.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Dependency update scope	3 direct production dependencies; 2 files affected	The patch is limited to exact runtime dependency pins and their resolved lockfile entries.

Merge-risk options

Maintainer options:

1. Validate the API-worker upgrade path (recommended)
   Run the API worker’s focused auth, route, and type validation against this exact dependency resolution before merging.
2. Accept the routine dependency risk
   Merge the pinned upstream updates based on their narrow manifest-and-lockfile scope and monitor the next API-worker deployment.

Technical review

Best possible solution:

Merge the exact manifest and lockfile update after a maintainer validates the API worker’s public routing, session, and JWT paths on the PR head.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a version-only dependency update, not a reported product failure. Current source identifies the runtime paths affected, but the read-only review did not execute the worker on the PR resolution.

Is this the best way to solve the issue?

Yes. Updating the exact direct pins and generated lockfile is the narrow maintainable approach; focused API-worker validation is the remaining compatibility check.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against 0cc3d3ef7f4a.

Labels

Label changes:

• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• remove rating: 🦞 diamond lobster: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.

Label justifications:

• P3: This is a routine, narrowly scoped dependency-maintenance update without a reported active regression.
• merge-risk: 🚨 compatibility: The Hono minor update changes the direct router dependency that serves the API worker’s public and protected routes.
• merge-risk: 🚨 auth-provider: Better Auth and JOSE are direct runtime dependencies in the session and Cloudflare Access JWT paths.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot dependency-update PR is bot-authored, so the external-contributor real-behavior-proof gate does not apply; normal maintainer validation remains appropriate.

Evidence

What I checked:

• Narrow dependency diff: The branch changes only the API package manifest and lockfile, updating three direct production dependencies without source or workflow changes. (apps/api/package.json:22, b92b6f7e8dc6)
• Runtime dependency boundary: Current main dispatches /api/auth requests to Better Auth through the Hono worker router. (apps/api/src/index.ts:105, 0cc3d3ef7f4a)
• JWT dependency boundary: Current main imports JOSE to verify Cloudflare Access JWTs used by the admin authentication flow. (apps/api/src/auth/cloudflareAccess.ts:3, 0cc3d3ef7f4a)
• Current-main and release provenance: The current API package and its direct dependency pins date to the v0.5.0 release commit; the PR head is not contained in a local branch or tag. (apps/api/package.json:22, 0cc3d3ef7f4a)
• Structured review limitation: The repository’s structured autoreview helper could not start because no usable temporary directory was available; direct source, diff, lockfile, and history inspection completed normally. (b92b6f7e8dc6)

Likely related people:

• Vincent Koc: The available history attributes the current API package, router, and authentication files to the v0.5.0 release commit. (role: introduced the current API-worker dependency and authentication wiring; confidence: high; commits: 0cc3d3ef7f4a; files: apps/api/package.json, apps/api/src/index.ts, apps/api/src/auth/auth.ts)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Validate API-worker auth, JWT verification, and route handling on the exact PR head before merge.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (52 earlier review cycles; latest 8 shown)

• reviewed 2026-08-13T04:30:13.548Z sha b92b6f7 :: needs maintainer review before merge. :: none
• reviewed 2026-08-13T19:32:30.303Z sha b92b6f7 :: needs maintainer review before merge. :: none
• reviewed 2026-08-14T03:36:00.779Z sha b92b6f7 :: needs maintainer review before merge. :: none
• reviewed 2026-08-14T05:47:02.209Z sha b92b6f7 :: needs maintainer review before merge. :: none
• reviewed 2026-08-14T12:04:29.322Z sha b92b6f7 :: needs maintainer review before merge. :: none
• reviewed 2026-08-14T18:40:31.012Z sha b92b6f7 :: needs maintainer review before merge. :: none
• reviewed 2026-08-14T18:56:50.387Z sha b92b6f7 :: needs maintainer review before merge. :: none
• reviewed 2026-08-14T21:43:52.182Z sha b92b6f7 :: needs maintainer review before merge. :: none