[dependabot]

Bumps the npm-deps group with 6 updates:

Package	From	To
@better-auth/oauth-provider	1.7.7	1.7.9
@hono/node-server	2.1.4	2.1.5
better-auth	1.7.7	1.7.9
@playwright/test	1.64.0	1.64.1
fallow	3.32.0	3.33.1
prettier	3.9.9	3.9.10

Updates @better-auth/oauth-provider from 1.7.7 to 1.7.9

Release notes

Sourced from @​better-auth/oauth-provider's releases.

v1.7.9

better-auth

Bug Fixes

• Fixed onAPIError.onError handlers to finish before responses are sent and log failures without interrupting requests (#11766)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Added isContinuation to postLogin.shouldRedirect so users can complete authorization after selecting an organization (#11185)
• Fixed DPoP validation for token and UserInfo requests behind proxies that rewrite request URLs (#10799)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​bytaesu, @​johanneskares

Full changelog: v1.7.8...v1.7.9

v1.7.8

better-auth

Bug Fixes

• Aligned cookie security attributes with RFC 6265bis (#11540)
• Added SvelteKit 3 to the supported peer dependency range (#11488)
• Fixed stale cookies persisting after customSession sessions expire or are revoked (#10591)
• Fixed customSession treating session lookup errors as signed-out users (#11391)
• Fixed sign-in failures, replay checks, and SIWE email handling with generateId: "uuid" (#11625)
• Removed non-returned custom fields from inferred output schema types (#11565)
• Fixed Kysely migration foreign keys when custom table names match another model key (#11505)
• Reduced organization plugin server bundles by excluding unused Zod locales (#10866)
• Aligned @better-auth/utils and better-call dependency versions across official packages (#11512)
• Fixed generic OAuth providers remaining unavailable after discovery fails at startup by retrying on subsequent requests (#11750)
• Fixed lastLoginMethod sign-in failures when cookieName or maxAge is explicitly undefined (#11549)
• Fixed magic link verification changing percent-encoded characters in callback URLs (#11174)
• Fixed type errors when using oauthProvider() or mcp() with exactOptionalPropertyTypes (#10266)
• Fixed organization plugin type errors in projects with skipLibCheck: false (#11637)
• Fixed failed password resets consuming reset links or OTPs before the new password is saved (#11646)
• Fixed password resets and changes retaining the new password when database session revocation fails (#11626)
• Fixed phone number password resets to use a configured verifyOTP callback (#10698)
• Fixed secondary-storage session failures leaving sign-ups, passkey registrations, or SSO sign-ins in an inconsistent state (#11643)
• Fixed missing device sessions and failed automatic session switching after cache eviction (#11718)

... (truncated)

Changelog

Sourced from @​better-auth/oauth-provider's changelog.

1.7.9

Patch Changes

• #10799 54a0994 Thanks @​bytaesu! - DPoP token and UserInfo requests now succeed when the server sees a different request URL than the one the client called. This affects deployments behind a proxy that rewrites the host or path, and the Next.js dev server, which reports every request as localhost. Before, a client that built the proof's htu from the public endpoint URL got invalid_dpop_proof for every grant that accepts DPoP.

  The expected htu is now the public endpoint URL built from baseURL, such as https://auth.example.com/api/auth/oauth2/token, or the URL of a plugin endpoint that issues tokens. Behind a proxy, set baseURL to the public URL clients call, not the internal one. A client that sends proofs to a host other than baseURL must build htu from the public URL instead. Deployments where the request URL already matches baseURL are unaffected.

• #11185 0a1a87e Thanks @​johanneskares! - If you use postLogin with the documented organization selector, users who belong to more than one organization can now finish authorization. Since v1.6.16, selecting an organization and calling oauth2.continue({ postLogin: true }) sent these users back to the selection page every time.

  postLogin.shouldRedirect now receives isContinuation, which is true when the user returns from your post login page. To stop the loop, update your callback to match the Post Login Screen example: on a new authorization, ask users with several organizations to choose; on continuation, return false once the session's active organization is one the user belongs to. Callbacks that do not read isContinuation behave as before.

1.7.8

Patch Changes

• #11512 4175b34 Thanks @​bytaesu! - Align the installed @better-auth/utils version with better-call while accepting ^0.4.2 || ^0.5.0 across official package peers.

• #11625 369176e Thanks @​gustavovalverde! - Fixed single-use checks for apps that set advanced.database.generateId: "uuid". Default id generation is unaffected, and no migration is needed.

  • On SQLite and MySQL, SAML sign-in, DPoP-bound requests checked against the database replay store, private_key_jwt client authentication, and magic link or email OTP sign-ins that adopt an unverified account failed with a NOT NULL error on the id column. They now work. SIWE sign-in ignored the email field and used the wallet-derived address; it now uses the supplied email when no other account has it.
  • On Postgres and MongoDB, a reused SAML assertion, DPoP proof, or client assertion was accepted. Each one is now accepted only once.

  With generateId: "serial", behavior is unchanged: these checks need string ids, and Better Auth now logs a warning the first time one of these flows runs.

• #10956 6214610 Thanks @​disbell! - Native OAuth clients and Client ID Metadata Documents can now use custom-scheme redirect URIs with a host and a path, such as Cursor's cursor://anysphere.cursor-mcp/oauth/callback. Previously, only the authority-free reverse-domain form, such as com.example.app:/callback, was accepted, and these registrations failed with invalid_redirect_uri.

  Cursor also omits application_type when it registers, so the web default still rejects it. To accept Cursor, set the new clientRegistrationDefaultApplicationType option to "infer". A dynamic registration that omits application_type then becomes native when any of its redirect URIs uses a custom scheme, and every redirect URI must pass the native rules. Setting "native" treats every registration that omits the field as native. The default remains "web", and an application_type the client sends is never overridden.

  Pairwise clients (subject_type: "pairwise") cannot use these host-bearing custom-scheme redirect URIs. Web clients are unaffected: they still accept only https redirect URIs on non-loopback hosts.

• #11658 847acd0 Thanks @​gustavovalverde! - If you configure clientPrivileges, the callback now receives clientId when a user reads, updates, deletes, rotates the secret of, or configures scopes on an existing client. You can use it to allow or deny actions per client among users who share a clientReference. Before, the callback could not tell which client the request targeted. clientId is absent for creating and listing clients, and the callback still cannot grant access to a client owned by someone else, apart from the existing scope-only updates through adminUpdateOAuthClient. Existing callbacks keep working unchanged.

• #10266 c68b2cd Thanks @​shiminshen! - Projects that enable exactOptionalPropertyTypes can use the oauthProvider() and mcp() plugins again. Since 1.7.0, adding either plugin to betterAuth() failed to type-check with a TS2322 error.

• #11654 1a9be41 Thanks @​gustavovalverde! - Authorized client owners can pause and resume an OAuth client by updating its disabled field through adminUpdateOAuthClient. A disabled client cannot obtain new tokens, and token introspection reports its existing tokens as inactive.

• #11655 38f3bb3 Thanks @​gustavovalverde! - If you register OAuth clients from your server with adminCreateOAuthClient, you can now pass resources to link the new client to protected resources in the same call. Previously you created the client first and then called adminLinkClientResource for each resource. When resourcePrivileges is configured, it is called with the link action for each requested resource, and a missing or disabled resource rejects the registration with invalid_target. Dynamic client registration and adminLinkClientResource are unchanged.

• #11655 38f3bb3 Thanks @​gustavovalverde! - Resource identifiers created with adminCreateOAuthResource or listed in the resources option now follow the same rules as the resource parameter in token and registration requests. An identifier with an empty fragment (https://api.example.com/#) or a javascript:, data:, or vbscript: scheme is rejected, and startup seeding skips it with a warning. Token requests already rejected these identifiers, so no working resource is affected. Setups with a custom identifierValidator are unaffected.

• #11726 aaf0d7d Thanks @​gustavovalverde! - Apps that configure protected resources, through resources in oauthProvider() or resource in mcp(), keep working when the resource table cannot be written at startup. Since 1.7.0, a database that was briefly unreachable, a table that was not migrated yet, or two instances starting at the same time made every auth route fail until the process restarted, and auth generate failed for Drizzle projects. The auth instance now starts, logs the error through your configured logger, and writes the resources on the first request that needs one.

  With Prisma on PostgreSQL, CockroachDB, or MongoDB, a resource without allowedScopes, including the one mcp() adds, still cannot be stored. The app now starts, but requests that use any configured resource fail until you declare allowedScopes for that resource.

Commits

• d2a5f83 chore: release v1.7.9 (#11761)
• c03ced5 chore: bump @biomejs/biome (#11760)
• 0a1a87e fix(oauth-provider): distinguish post-login continuation from initial selecti...
• 54a0994 fix(oauth-provider): validate DPoP against public URL (#10799)
• 5f4cc5c chore: release v1.7.8 (#11513)
• aaf0d7d fix(oauth-provider): keep auth working when startup resource seeding fails (#...
• 847acd0 feat(oauth-provider): pass client ID to privilege checks (#11658)
• 38f3bb3 feat(oauth-provider): link resources during managed client registration (#11655)
• 1a9be41 feat(oauth-provider): allow client disable through admin update (#11654)
• 6214610 fix(oauth-provider): accept host-bearing custom-scheme native redirects (#10956)
• Additional commits viewable in compare view

Updates @hono/node-server from 2.1.4 to 2.1.5

Release notes

Sourced from @​hono/node-server's releases.

v2.1.5

What's Changed

• fix(listener): abort the request signal when an HTTP/2 client resets the stream by @​affanmomin in honojs/node-server#404
• fix(serve-static): only serve GET and HEAD requests by @​usualoma in honojs/node-server#405

New Contributors

• @​affanmomin made their first contribution in honojs/node-server#404

Full Changelog: honojs/node-server@v2.1.4...v2.1.5

Commits

• 4b47a0d 2.1.5
• e77824a fix(serve-static): only serve GET and HEAD requests (#405)
• 1b6e6bf fix(listener): abort the request signal when an HTTP/2 client resets the stre...
• See full diff in compare view

Updates better-auth from 1.7.7 to 1.7.9

Release notes

Sourced from better-auth's releases.

v1.7.9

better-auth

Bug Fixes

• Fixed onAPIError.onError handlers to finish before responses are sent and log failures without interrupting requests (#11766)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Added isContinuation to postLogin.shouldRedirect so users can complete authorization after selecting an organization (#11185)
• Fixed DPoP validation for token and UserInfo requests behind proxies that rewrite request URLs (#10799)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​bytaesu, @​johanneskares

Full changelog: v1.7.8...v1.7.9

v1.7.8

better-auth

Bug Fixes

• Aligned cookie security attributes with RFC 6265bis (#11540)
• Added SvelteKit 3 to the supported peer dependency range (#11488)
• Fixed stale cookies persisting after customSession sessions expire or are revoked (#10591)
• Fixed customSession treating session lookup errors as signed-out users (#11391)
• Fixed sign-in failures, replay checks, and SIWE email handling with generateId: "uuid" (#11625)
• Removed non-returned custom fields from inferred output schema types (#11565)
• Fixed Kysely migration foreign keys when custom table names match another model key (#11505)
• Reduced organization plugin server bundles by excluding unused Zod locales (#10866)
• Aligned @better-auth/utils and better-call dependency versions across official packages (#11512)
• Fixed generic OAuth providers remaining unavailable after discovery fails at startup by retrying on subsequent requests (#11750)
• Fixed lastLoginMethod sign-in failures when cookieName or maxAge is explicitly undefined (#11549)
• Fixed magic link verification changing percent-encoded characters in callback URLs (#11174)
• Fixed type errors when using oauthProvider() or mcp() with exactOptionalPropertyTypes (#10266)
• Fixed organization plugin type errors in projects with skipLibCheck: false (#11637)
• Fixed failed password resets consuming reset links or OTPs before the new password is saved (#11646)
• Fixed password resets and changes retaining the new password when database session revocation fails (#11626)
• Fixed phone number password resets to use a configured verifyOTP callback (#10698)
• Fixed secondary-storage session failures leaving sign-ups, passkey registrations, or SSO sign-ins in an inconsistent state (#11643)
• Fixed missing device sessions and failed automatic session switching after cache eviction (#11718)

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.9

Patch Changes

• #11766 6edaa61 Thanks @​bytaesu! - An onAPIError.onError handler that throws or rejects no longer fails the request or causes an unhandled promise rejection. The error is logged and the original error response is returned. Async handlers now finish before the response is sent.

• Updated dependencies []:

  • @​better-auth/core@​1.7.9
  • @​better-auth/drizzle-adapter@​1.7.9
  • @​better-auth/kysely-adapter@​1.7.9
  • @​better-auth/memory-adapter@​1.7.9
  • @​better-auth/mongo-adapter@​1.7.9
  • @​better-auth/prisma-adapter@​1.7.9
  • @​better-auth/telemetry@​1.7.9

1.7.8

Patch Changes

• #11512 4175b34 Thanks @​bytaesu! - Align the installed @better-auth/utils version with better-call while accepting ^0.4.2 || ^0.5.0 across official package peers.

• #11565 b1cfc1e Thanks @​bytaesu! - Omit non-returned custom fields from inferred output schema types.

• #11540 678c555 Thanks @​bytaesu! - Align cookie security attributes with RFC 6265bis.

• #10591 193efff Thanks @​kdelay! - Expired or revoked sessions now clear stale cookies when using customSession.

• #11625 369176e Thanks @​gustavovalverde! - Fixed single-use checks for apps that set advanced.database.generateId: "uuid". Default id generation is unaffected, and no migration is needed.

  • On SQLite and MySQL, SAML sign-in, DPoP-bound requests checked against the database replay store, private_key_jwt client authentication, and magic link or email OTP sign-ins that adopt an unverified account failed with a NOT NULL error on the id column. They now work. SIWE sign-in ignored the email field and used the wallet-derived address; it now uses the supplied email when no other account has it.
  • On Postgres and MongoDB, a reused SAML assertion, DPoP proof, or client assertion was accepted. Each one is now accepted only once.

  With generateId: "serial", behavior is unchanged: these checks need string ids, and Better Auth now logs a warning the first time one of these flows runs.

• #11391 352d04c Thanks @​breken-ai! - Fix customSession treating session lookup failures as signed-out users. Server-side getSession now throws an API error, and HTTP clients receive an error response.

• #11750 e9d9921 Thanks @​gustavovalverde! - Generic OAuth providers configured with discoveryUrl now recover without a restart when discovery fails at startup. Since 1.7.3, a provider whose discovery request failed at boot (for example, because the identity provider was still starting) was skipped, and every sign-in returned PROVIDER_NOT_FOUND until the app restarted. Better Auth now retries discovery on the next sign-in, callback, or account-linking request for that provider, and the provider works as soon as discovery succeeds. While discovery keeps failing, sign-in and account linking still return PROVIDER_NOT_FOUND and callbacks redirect with error=oauth_provider_not_found, and each request may wait up to 10 seconds for the retry.

• #11549 1bd5c37 Thanks @​bytaesu! - Fix lastLoginMethod failing sign-in when cookieName or maxAge is explicitly undefined.

• #11174 766cfb3 Thanks @​Bekacru! - Stop double-decoding callbackURL, newUserCallbackURL and errorCallbackURL on magic link verify so percent-encoded characters in callback query params are preserved.

• #11505 c46992f Thanks @​bytaesu! - Preserve the referenced model and field keys when generating Kysely migrations, so custom table names that match another model key produce the intended foreign keys.

• #11718 1d95ebf Thanks @​bytaesu! - Fix missing device sessions and failed automatic session switching after cache eviction when storeSessionInDatabase is enabled and preserveSessionInDatabase is disabled. Automatic switching now follows the order of held sessions, and large lists or sessions whose users no longer exist no longer cause valid sessions to disappear.

• #10266 c68b2cd Thanks @​shiminshen! - Projects that enable exactOptionalPropertyTypes can use the oauthProvider() and mcp() plugins again. Since 1.7.0, adding either plugin to betterAuth() failed to type-check with a TS2322 error.

• #11637 2627237 Thanks @​gustavovalverde! - Projects using the organization plugin with skipLibCheck: false no longer get TS2536: Type '"role"' cannot be used to index type ... from crud-members.d.mts. The role returned by getActiveMemberRole is now typed as the organization's role names directly. Projects with skipLibCheck: true (the default in most templates) were unaffected.

• #10866 3d1f008 Thanks @​heliohm! - The organization plugin no longer pulls every zod locale into server bundles.

... (truncated)

Commits

• d2a5f83 chore: release v1.7.9 (#11761)
• dbca311 test: fix test names in bearer and organization (#11768)
• c03ced5 chore: bump @biomejs/biome (#11760)
• 6edaa61 fix(api): await onAPIError.onError and log hook failures (#11766)
• 5f4cc5c chore: release v1.7.8 (#11513)
• e9d9921 fix(generic-oauth): retry discovery for providers skipped at startup (#11750)
• f0ce580 fix(phone-number): use custom verifyOTP when resetting the password (#10698)
• 1d95ebf fix(session): fall back to database for bulk session lookups (#11718)
• 876ee03 test(organization): create shared fixtures in beforeAll (#11709)
• 766cfb3 fix(magic-link): stop double-decoding callback URLs on verify (#11174)
• Additional commits viewable in compare view

Updates @playwright/test from 1.64.0 to 1.64.1

Release notes

Sourced from @​playwright/test's releases.

v1.64.1

Bug Fixes

• #43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
• #43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

Commits

• cfe490d cherry-pick(#43353): docs: release notes for v1.64 Python
• 866cbb8 chore: mark v1.64.1 (#43354)
• 1b29247 cherry-pick(#43250): fix(electron): do not drop windows that have not navigat...
• 632d976 cherry-pick(#43249): fix(chromium): disable AvoidCorsURLLoaderRestartOnRedirect
• 824d0c5 cherry-pick(#43217): chore(dotnet): fix async suffix of optional-arg overload...
• See full diff in compare view

Updates fallow from 3.32.0 to 3.33.1

Release notes

Sourced from fallow's releases.

v3.33.1: health and duplication baselines in CI, Vitest fixes

Bug fixes

• The GitHub Action and the GitLab template can baseline health and duplication on the default run. A project with existing complexity can now gate the default fallow run with a baseline. Set the health-baseline and dupes-baseline inputs of the action, or FALLOW_HEALTH_BASELINE and FALLOW_DUPES_BASELINE in the GitLab template. Create the files with fallow health --save-baseline and fallow dupes --save-baseline. Other commands ignore these inputs. Both integrations report a stale health or duplication baseline, or one that another command saved. fail-on-stale-baseline (FALLOW_FAIL_ON_STALE_BASELINE) judges these baselines too. It also judges a --health-baseline or --dupes-baseline flag that you pass through args (FALLOW_ARGS). (#3316)
• The action and the GitLab template no longer count health findings that a baseline accepts. With a health baseline, the CLI passed, but the action and the GitLab template failed the job with fail-on-issues. A fallow health run also failed the job. The count now uses the findings that remain after the baseline. (#3316)
• The job summary counts health findings after the baseline. With a loaded health baseline, fallow report --format github-summary shows the new findings and gives the accepted ones as context, for example "2 new functions exceed thresholds (74 in the baseline)". Without a baseline, the summary does not change. (#3316)
• fallow --help names the baseline flags of the bare run. On bare fallow, --baseline and --save-baseline hold the dead-code baseline only. When a bare run gets a fallow health or fallow dupes baseline through --baseline, fallow now prints a note that tells you to use --health-baseline or --dupes-baseline. (#3316)
• The Vitest JSX import source follows the Vitest project model. On Vitest 5, an inline test.projects entry inherits the JSX import source of its config unless it sets extends: false. On Vitest 4, it inherits only with extends: true. Fallow reads the Vitest version from node_modules/vitest, else from the declared range. Project and base include globs add up. Fallow also reads a config that extends names. It reads project configs with a custom name, such as vitest.e2e.config.ts, also when a glob entry names them. Fallow no longer reports these files as unused. (#3318)
• Fallow reads test.exclude for the Vitest JSX import source. When test.exclude or a negated test.include entry removes a test file, Fallow no longer applies the JSX runtime of its project to that file. Without test.exclude, the Vitest default exclude applies. The globs are relative to test.dir, test.root or the Vite root when the config sets one. (#3318)
• react is no longer an unused dependency when Vitest test files use JSX with the default runtime. When a Vitest config sets no JSX import source, Vite imports the react JSX runtime. Fallow now credits react when a test file of that config has JSX and no @jsxImportSource pragma. A TypeScript test file gives no credit when its tsconfig sets jsxImportSource, or a jsx mode without the automatic runtime. The credit applies only to the workspace of the test file. A vite.config.* next to a vitest.config.* gives no credit, because Vitest does not load it. (#3318)
• The source-map warning of fallow coverage upload-source-maps tries the same paths as Fallow Cloud. The CLI dropped the first segments of a source such as webpack:///@scope/app/./src/x.ts, and the cloud did not. The warning could then check a path that the cloud never uses. A shared fixture of path cases now keeps the two implementations equal. (#3320)

Full Changelog: fallow-rs/fallow@v3.33.0...v3.33.1

v3.33.0: fallow architecture, baseline pruning, faster musl binaries

Features

• fallow architecture reports import cycles, boundary violations and rule-pack policy violations in one command. Use --cycles, --boundaries or --policy to select one kind. The command takes the same scope and output flags as fallow dead-code. Run fallow guard <files> before an edit and fallow architecture after it. Bare fallow shows these findings in an "Architecture" category after the other dead-code categories. It also shows the category with --quiet, --group-by and --summary. With --group-by, fallow architecture shows one "Architecture" heading per group.
• fallow architecture --format json writes kind: "architecture" with its own schema_version (1). With --group-by, the kind is architecture-grouped. The arrays, finding ids, actions, exit codes, gate outcomes and severities are the same as on fallow dead-code. next_steps names fallow architecture. With --explain, _meta.docs points to the architecture page, and _meta.rules lists only the architecture rules. --save-baseline writes a dead-code baseline (kind: "dead-code"), so the two commands read each other's baselines. The JSON schema and the generated TypeScript types have the ArchitectureOutput and ArchitectureGroupedOutput types.
• fallow report, MCP, the Node bindings and CI accept the architecture report.
  • fallow report --from renders a saved architecture or architecture-grouped file in every format, the same as the direct run. PR comments and reviews of fallow architecture have the title "Fallow architecture report".
  • The MCP server has a check_architecture tool, and Code Mode exposes it as checkArchitecture. The Node bindings have detectArchitecture, and fallow_api has run_architecture. Each returns the architecture output. detectCircularDependencies, detectBoundaryViolations and the MCP analyze tool keep the dead-code output.
  • Bare fallow accepts architecture in --only and --skip. --only architecture runs the dead-code analysis and reports only the architecture findings, and its Failed: line names architecture. --skip architecture removes these findings from the dead-code section. The health score and the --save-baseline file do not change.
  • The GitHub Action accepts command: architecture, and the GitLab template accepts FALLOW_COMMAND: architecture. For this command, issue-types and FALLOW_ISSUE_TYPES take cycles, boundaries and policy. Another value stops the job with exit code 2 and an error that names the valid values.
  • Telemetry records fallow architecture runs as the architecture workflow.
• fallow baselines prune removes the baseline entries of fixed findings. The command reads the files that audit.deadCodeBaseline, audit.healthBaseline and audit.dupesBaseline name. It runs one whole-project analysis and removes each entry that --baseline no longer matches. It never adds an entry, so a new finding stays visible to the gates. After a prune, --fail-on-stale-baseline passes, and the baseline hides the same findings as before. --check writes nothing and exits 1 when an entry can be pruned. --dead-code-baseline, --health-baseline and --dupes-baseline override the config paths. --coverage gives the coverage input for CRAP scores. The command skips a file with an older key form or with fields from a newer version. It prints the command that saves that file again. The stale-baseline warning and the gate message now name the prune command. Thanks @​BenMcGit for the request (#3281).
• fallow hooks install --target git --prune-baselines prunes the baselines in the pre-commit hook. The hook runs fallow baselines prune before the audit and stages the baseline files that the prune wrote. The prune reads the working tree, but the commit uses the index. So the hook skips the prune when the working tree has unstaged or untracked changes. It also skips the prune for a commit with paths (git commit <path>). A failed prune never blocks the commit. The hints for Lefthook and for an existing hook include the same step.
• fallow trace --dependency <package> reports how the code uses each imported name of a package. The report gives file and call counts, and sites with line and column. It follows one hop through project wrappers such as useSelector.withTypes(), and it counts each use that it cannot resolve. --sites, --specifier, --limit and --cursor page the sites. --callers --depth N adds the files that import the users. The MCP tool trace_dependency accepts the same options.
• A JSX import source in a Vitest config now adds a module graph edge. With the automatic JSX runtime, oxc.jsx.importSource (or the older esbuild.jsxImportSource) makes each test file with JSX import <source>/jsx-dev-runtime. Fallow now adds this edge when the source is a path and the test file has JSX and no @jsxImportSource pragma. A package source only marks the package as used. A local JSX runtime no longer shows as unused, and --impact-closure on a runtime file now includes these test files.
  • The edge applies to the files that test.include matches. Fallow uses the root config when it has no test.projects, else each inline project config.
  • A project inherits the root source only with extends: true. The classic runtime adds no edge.
  • A relative source resolves from the test file first, then from the config directory. A source that does not resolve adds no edge and no unresolved import.

Changed

• The Linux musl binaries are about 4 times faster. The malloc of musl is slow when many threads allocate, and fallow analyzes files in parallel. The musl binaries now use mimalloc. This applies to the linux-x64-musl and linux-arm64-musl npm packages and the musl release assets. On a 10-core aarch64 Alpine container, check, dupes and health took 77% less time over 15 fixture cases, with identical output. Peak memory is about a third higher. The Node addon keeps the default allocator. Glibc, macOS and Windows builds do not change.
• Fallow hides the findings in an unused file by default. Fallow no longer lists an unused export, type, class member or enum member in a file that it reports as unused. Deleting the file removes these findings too. The JSON output has the count in cascade_hidden, and SARIF and markdown (grouped or not) show the count too. To list the findings, pass --show-cascade, set showCascade in the config, or use the show_cascade parameter of the MCP tools. The health vital signs still count them. When an issue-type filter leaves out unused-files, nothing is hidden.
• fallow viz shows where to start and says what is wrong.
  • The Overview panel opens with the health grade and one card per lens. Each card shows the number of files, the number of high findings, and the worst file with its reason. The Overview map colors files that have findings in any lens. Folder labels show how many of their files have findings.
  • Each lens list opens with a short summary and a severity split. The list groups rows into high, medium and low. The full file name comes first, then a plain reason. For example, "File path built from input" replaces path-traversal, and "High complexity, no test coverage" replaces a CRAP score. Security lists each file once with all of its candidates.
  • Folders with no imports to or from other folders now show when the active lens has findings in them, for example unused files. Health colors only files above the review threshold, so high-risk files stand out. Folders without findings fade.
  • The Overview tab of the file panel opens with a list of the lenses that have findings in the file, each with its reason. The Health tab shows maintainability, change risk and importers. Then it lists each function to fix with its branches, lines, test coverage and next step. The treemap rings and names the selected file.
  • Folder and import-group labels have two lines (the name, then the size and findings). The labels stay over their cluster and keep clear of the controls and the legend. Import groups that span folders read as site/src + 5 more instead of (mixed). The status line shows the grouping or the path of the file in focus. The map hides disabled controls.
  • A click on a line between two folders lists the target files in use. Then it lists every import, with forbidden and cyclic imports first.
  • Hover tooltips use the same plain reasons as the panel. During a search, the legend explains the match and importer rings.
  • Below 700 px, the panel docks under the map as a sheet, so the map stays visible at full width. The legend becomes one line, crowded labels drop, and the file focus view fits both columns.
  • The map now follows the design of fallow.tools and fallow.cloud: paper and ink, Barlow type, hairline rules, square panels and flat controls. Day paper is the default. The night theme follows the system or the stored choice. The report embeds the fonts, so it looks the same offline.
  • On the graph, folders are octagons, the imports between them run at 0, 45 and 90 degrees, and flagged files have a ring. When you hover over an import line, the map picks the line under the pointer, gives it a pale blue halo and fades the others. Lines that are hidden at the current zoom no longer react. A hover over a file draws its imports the same way, in ink.
  • With a file open, the panel shows its place in the active lens ("3 of 61 in Security") with previous and next buttons. The j and k keys do the same.
  • High findings, sparse medium findings, and the copies of an open duplicated block get a halo on the graph.

... (truncated)

Commits

• fccff88 chore: release v3.33.1
• 9909983 fix(coverage): match the cloud source-map path candidates (#3320)
• c3c4c57 fix(vitest): use forward slashes in the project glob prefix on Windows (#3319)
• 503b8cd chore(release): set RELEASED_TAG to v3.33.0
• 29df8f5 chore(docker): pin FALLOW_VERSION 3.33.0 with refreshed checksums
• 576dc2b chore(napi): sync package.json / package-lock / index.js to v3.33.0
• 1cc5402 fix(vitest): follow the Vitest project model for the JSX import source (#3318)
• f4121c2 fix(action): baseline health and duplication on the default run (#3316)
• 278dbc6 chore: release v3.33.0
• 7615ef9 feat(vitest): add a graph edge for the Vitest JSX import source (#3315)
• Additional commits viewable in compare view

Updates prettier from 3.9.9 to 3.9.10

Release notes

Sourced from prettier's releases.

3.9.10

• Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.10

diff

Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

See micromark/micromark-extension-gfm-table@4f43ead for details.

Commits

• 1172b82 Release 3.9.10
• d014227 Update micromark-extension-gfm-table to fix the table parse issue on perfor...
• 953b908 Bump Prettier dependency to 3.9.9
• ad8a6bf Clean changelog_unreleased
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

[...

Description has been truncated

[mroderick]

Dependency Upgrade Review

Verdict: Compatible (head 101fb06919972007a596cabac00f1267b0b41c94) · Confidence: High

Bumps @better-auth/oauth-provider 1.7.7→1.7.9 and @hono/node-server ^2.1.4→^2.1.5 in dependencies, @playwright/test ^1.64.0→^1.64.1, fallow 3.32.0→3.33.1 and prettier ^3.9.9→^3.9.10 in devDependencies, and lets better-auth float 1.7.7→1.7.9 in the lock within ^1.7.5. Every API the repo imports survives at runtime, the npm tree is peer-consistent, and the full tap suite plus fallow and prettier run clean on the upgraded lock — safe.

Checks

Check	Result
planner suite	pass
auth suite	pass
round-trip probe	pass

Contracts

Contract	Status	Basis
oauthProvider option surface (loginPage, scopes, accessTokenExpiresIn, customIdTokenClaims) intact in 1.7.9	Verified	1.7.9 dist types and runtime imports; option-key set identical to the 1.7.7 dist
better-auth exports used (betterAuth, admin/magicLink/jwt plugins, db/migration getMigrations) unchanged	Verified	Runtime import checks of all three exports after the upgrade
getMigrations generates and applies pg migrations	Verified	Local tap feature suite run against a real PostgreSQL 16 on the upgraded lock
serve, serve-static, conninfo subpath imports resolve in 2.1.5	Verified	Runtime import of all three subpaths against the 2.1.5 dist
fallow CLI and prettier --check run clean	Verified	fallow 3.33.1 CLI and prettier 3.9.10 --check executed locally over the repo
Playwright config/API compatibility for the e2e spec	Partially verified	Config and spec imports resolve; given probe pass; local browser run not attempted
OAuth round-trip between planner and auth app works on 1.7.9	Partially verified	Diffed the 1.7.7 and 1.7.9 dists; token surfaces the flows rely on unchanged, given probe pass

Compatibility analysis — 6 packages

• @better-auth/oauth-provider 1.7.7 → 1.7.9: Repo imports oauthProvider in src/auth.js and test helpers; every option key passed still exists in the 1.7.9 dist. New stricter pairwise custom-scheme redirect validation doesn't affect the https-only planner client.
• better-auth 1.7.7 → 1.7.9 (transitive within ^1.7.5): In-range caret bump pulled by the group. jwt and admin plugin files are byte-identical to 1.7.7; migrations were internally refactored but getMigrations still works against pg. The repo's dead pre-existing validAudiences key is unsupported in both versions, unchanged.
• @hono/node-server ^2.1.4 → ^2.1.5: Only changes are h2 aborted-request close handling and serve-static method gating; the repo's serve, serve-static, and conninfo imports all resolve.
• @playwright/test ^1.64.0 → ^1.64.1: Patch bump carrying playwright/playwright-core; defineConfig and devices exports intact for the e2e config and spec.
• fallow 3.32.0 → 3.33.1: Dev-only analysis CLI; runs clean locally with the same subcommands and config schema.
• prettier ^3.9.9 → ^3.9.10: Patch bump; prettier --check passes over the entire repo.

Usage of 6 dependencies

• @better-auth/oauth-provider: src/auth.js and test/helpers/test-instance.js: oauthProvider({loginPage, scopes, accessTokenExpiresIn, validAudiences, allowDynamicClientRegistration, customIdTokenClaims})
• better-auth: src/auth.js and test-instance.js: betterAuth with admin, magicLink, jwt plugins; scripts/migrate.js: getMigrations from better-auth/db/migration
• @hono/node-server: src/index.js: serve(); src/app/app.js: serveStatic; src/routes/test-magic-links.js: getConnInfo
• @playwright/test: playwright.config.js: defineConfig/devices; e2e/oauth-flow.spec.js: test/expect
• fallow: npm run fallow script and CI smoke job (CLI over src/test)
• prettier: prettier:check/write scripts, lint-staged config, CI smoke job

Test coverage

• Strong: full tap suite (121 feature plus 84 unit/integration subtests) run locally against PostgreSQL 16 with the upgraded lock; matches the given auth-suite pass
• Thin: e2e browser run not executed locally (patch-level bump; covered by the given probe pass and CI's e2e job)
• Thin: production-only paths such as the SendGrid send and Heroku release migration are unchanged app code, not exercised locally
• Gap: none blocking

Calibration and confidence

Confidence: High — Every changed dependency was checked against actual repo call sites at runtime, the lock tree is peer-consistent, and the full tap suite plus fallow and prettier ran clean locally on the upgraded lock.

1. Weakest claim: The e2e browser path was never exercised locally; compatibility there rests on the given probe pass and patch-level reasoning.
2. Relied on but unverified: better-auth 1.7.9 dropping decodeURIComponent on magic-link callbackURL queries is neutral for the plain callback URLs this repo sends.
3. Falsifier: Run CI's e2e job (full Playwright round-trip with the planner) against this head; if the authorization-code exchange fails on the callback, the upgrade is incompatible.