chore(deps): update npm minor group while retaining Better Auth 1.6

[dependabot]

Updates the npm-minor dependency group while keeping Better Auth, its API key plugin, Drizzle adapter, and core override aligned at 1.6.26. The proposed 1.7.7 plugins required exports absent from the overridden 1.6.26 core, breaking API startup and typechecks.

Regenerates the lockfile with the reviewed direct dependency versions and preserves the nodemailer, release tooling, and Vite+ upgrades already merged into main. Resolves the stale branch and lockfile conflicts.

Local validation: frozen lockfile install, repository lint, typecheck, full unit tests (including 873 API and 847 web tests), all package builds, and OpenAPI check pass. GitHub CI verifies browser smoke tests, PostgreSQL integration tests, and Docker images before merge.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	next@​16.3.6 ⏵ 16.3.8			+1
	@​tiptap/​extension-placeholder@​3.31.3 ⏵ 3.31.4				+2
	@​tiptap/​extension-table-cell@​3.31.3 ⏵ 3.31.4				+2
	@​tiptap/​extension-table-header@​3.31.3 ⏵ 3.31.4				+2
	@​tiptap/​extension-table-row@​3.31.3 ⏵ 3.31.4				+2
	@​tiptap/​extension-task-item@​3.31.3 ⏵ 3.31.4				+2
	@​tiptap/​extension-task-list@​3.31.3 ⏵ 3.31.4				+2
	@​tiptap/​pm@​3.31.3 ⏵ 3.31.4				-1
	@​tiptap/​extension-underline@​3.31.3 ⏵ 3.31.4				+1
	@​tiptap/​extension-hard-break@​3.31.3 ⏵ 3.31.4	+1		+1	+1
	@​tiptap/​starter-kit@​3.31.3 ⏵ 3.31.4				+1
	@​tiptap/​extension-code-block-lowlight@​3.31.3 ⏵ 3.31.4	+1		+1	+2
	@​tiptap/​extension-image@​3.31.3 ⏵ 3.31.4			+1	+1
	@​sentry/​node@​11.0.0 ⏵ 11.1.0	+1		-18	+1
	shiki@​4.4.3 ⏵ 4.5.0				+1
	@​tiptap/​extension-link@​3.31.3 ⏵ 3.31.4			+1	+1
	@​tiptap/​suggestion@​3.31.3 ⏵ 3.31.4				+2
	@​tanstack/​router-plugin@​1.168.40 ⏵ 1.168.42
	@​tiptap/​markdown@​3.31.3 ⏵ 3.31.4			+1	+2
	@​vitest/​coverage-v8@​5.0.1 ⏵ 5.0.3				+2
	@​tiptap/​extension-table@​3.31.3 ⏵ 3.31.4	+1		+1	+2
	@​tiptap/​react@​3.31.3 ⏵ 3.31.4			+1	+1
	@​sentry/​react@​11.0.0 ⏵ 11.1.0			-20	+1
	@​tiptap/​extension-list@​3.31.3 ⏵ 3.31.4	+1		+1	+1
	lucide-react@​1.48.0 ⏵ 1.49.0			+1	+1
	@​tiptap/​core@​3.31.3 ⏵ 3.31.4			+1	+1
	@​modelcontextprotocol/​server@​2.1.0 ⏵ 2.2.0	+1		+1	+1
	globals@​17.12.0 ⏵ 17.13.0			+1	-1
	react-day-picker@​10.0.1 ⏵ 10.0.2			+1	-5
	@​tanstack/​react-router@​1.170.39 ⏵ 1.170.41			+1	+1
	@​sentry/​profiling-node@​11.0.0 ⏵ 11.1.0			-9	+1
	pg@​8.23.0 ⏵ 8.23.1	+1		+1
See 3 more rows in the dashboard

View full report

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.

[qodo-code-review]

PR Summary by Qodo

Refresh npm dependencies while keeping Better Auth on 1.6.26

⚙️ Configuration changes 🕐 20-40 Minutes

AI Description

• Refresh API, site, web, and shared-package dependencies without changing application code.
• Keep Better Auth, its plugins, and the core override aligned at 1.6.26 to avoid startup and
 typecheck failures.
• Regenerate the pnpm lockfile and align the Vitest catalog and override at 5.0.3.

Diagram

graph TD
  A["Workspace catalog"] --> B["Vitest 5.0.3"] --> F["pnpm lockfile"]
  C["API manifest"] --> D["Better Auth 1.6"] --> F
  C --> E["Updated dependencies"] --> F
  G["Other manifests"] --> E

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Upgrade the entire Better Auth family to 1.7

• ➕ Allows adoption of the newer core and plugin releases together.
• ➖ Requires a coordinated compatibility review; upgrading plugins against the existing 1.6 core broke API startup and typechecks.

2. Split the dependency refresh into smaller PRs

• ➕ Narrows regression diagnosis and review scope.
• ➖ Adds coordination and repeated lockfile churn for an already grouped update.

Recommendation: Keep the compatible Better Auth 1.6.26 family pinned for this refresh. Handle a coordinated 1.7 migration separately after API startup and typecheck compatibility are established; complete the remaining validation before merging the broad dependency update.

Files changed (7) +854 / -1136

Other (7) +854 / -1136

package.jsonRefresh API dependencies without upgrading Better Auth +9/-9

Refresh API dependencies without upgrading Better Auth

• Raises AWS S3, Hono, MCP, Sentry, and PostgreSQL dependency requirements. Better Auth and its API key and Drizzle plugins remain at 1.6.26.

apps/api/package.json

package.jsonRefresh site framework and UI dependencies +3/-3

Refresh site framework and UI dependencies

• Raises Next.js, Lucide React, and React Day Picker versions.

apps/site/package.json

package.jsonRefresh web routing, editor, and UI dependencies +28/-28

Refresh web routing, editor, and UI dependencies

• Raises Sentry, TanStack Router, the Tiptap package family, and several UI and development dependencies. The Tiptap declarations advance together to 3.31.4.

apps/web/package.json

package.jsonRaise the shared library's Hono requirement +1/-1

Raise the shared library's Hono requirement

• Changes the Hono requirement from ^4.13.9 to ^4.13.12.

packages/libs/package.json

package.jsonRaise the MCP package's SDK requirement +1/-1

Raise the MCP package's SDK requirement

• Changes the Model Context Protocol SDK requirement from ^1.30.1 to ^1.31.0.

packages/mcp/package.json

pnpm-workspace.yamlAlign catalog test tooling at Vitest 5.0.3 +2/-2

Align catalog test tooling at Vitest 5.0.3

• Raises the shared Vitest and V8 coverage catalog entries from 5.0.1 to 5.0.3. The Better Auth core override remains at 1.6.26.

pnpm-workspace.yaml

pnpm-lock.yamlRegenerate resolutions for the dependency refresh +810/-1092

Regenerate resolutions for the dependency refresh

• Updates importer resolutions, package snapshots, and transitive dependencies for the refreshed manifests and Vitest catalog. The resolved Better Auth family remains on 1.6.26.

pnpm-lock.yaml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (3) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. The API keeps older routing packages 🐞 Bug ≡ Correctness

Description

The @hono/node-server and hono manifest bumps leave their workspace overrides unchanged, so the
supplied lockfile still resolves the API to node-server 2.0.12 and Hono 4.13.8. Installs using this
lockfile therefore do not receive the requested 2.1.3 and 4.13.12 upgrades, despite the new minimum
versions in the API and other affected manifests.

Code

apps/api/package.json[33]

+    "@hono/node-server": "^2.1.3",

Relevance

●●● Strong

Recent PRs accepted fixes for stale overrides preventing dependency bumps from reaching the
lockfile.

PR-#1313
PR-#1271
PR-#1223

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The supplied lockfile diff retains @hono/node-server at 2.0.12 on lines 124–126 and hono at
4.13.8 on lines 184–186. The workspace overrides permit those versions instead of enforcing the new
manifest minimums.

pnpm-workspace.yaml[4-14]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The workspace overrides keep the API on older Hono and node-server versions despite the dependency bumps.
## Fix Focus Areas
- pnpm-workspace.yaml[4-14]
- apps/api/package.json[33-52]
- pnpm-lock.yaml[124-126]
## Recommended Fix
Raise the Hono and node-server override minimums to the requested versions, then regenerate the lockfile and verify the API importer's resolved versions.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. The API keeps older routing packages 🐞 Bug ≡ Correctness

Description

The @hono/node-server and hono manifest bumps leave their workspace overrides unchanged, so the
supplied lockfile still resolves the API to node-server 2.0.12 and Hono 4.13.8. Installs using this
lockfile therefore do not receive the requested 2.1.3 and 4.13.12 upgrades, despite the new minimum
versions in the API and other affected manifests.

Code

apps/api/package.json[33]

+    "@hono/node-server": "^2.1.3",

Relevance

●●● Strong

Recent PRs accepted fixes for stale overrides preventing dependency bumps from reaching the
lockfile.

PR-#1313
PR-#1271
PR-#1223

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The supplied lockfile diff retains @hono/node-server at 2.0.12 on lines 124–126 and hono at
4.13.8 on lines 184–186. The workspace overrides permit those versions instead of enforcing the new
manifest minimums.

pnpm-workspace.yaml[4-14]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The workspace overrides keep the API on older Hono and node-server versions despite the dependency bumps.
## Fix Focus Areas
- pnpm-workspace.yaml[4-14]
- apps/api/package.json[33-52]
- pnpm-lock.yaml[124-126]
## Recommended Fix
Raise the Hono and node-server override minimums to the requested versions, then regenerate the lockfile and verify the API importer's resolved versions.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

3. The API and web keep older Hono versions 🐞 Bug ≡ Correctness

Description

The new Hono and Node server dependency minimums are overridden by broader workspace ranges, so the
lockfile still selects Hono 4.13.8 and the API's Node server 2.0.12. Installs from this lockfile
therefore do not deliver the requested 4.13.12 and 2.1.3 upgrades to the API, and web also remains
on Hono 4.13.8.

Code

apps/api/package.json[33]

+    "@hono/node-server": "^2.1.3",

Evidence

The PR raises the API minimums, but the workspace overrides take precedence and the resulting API
lockfile importer records the override ranges and older resolved versions. The web importer also
retains the older Hono resolution.

apps/api/package.json[33-33]
apps/api/package.json[52-52]
pnpm-workspace.yaml[3-9]
pnpm-lock.yaml[124-133]
pnpm-lock.yaml[184-186]
pnpm-lock.yaml[506-509]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The workspace overrides replace the new Hono and Node server minimums with broader ranges, leaving older versions installed.
## Fix Focus Areas
- pnpm-workspace.yaml[3-9]
- apps/api/package.json[33-33]
- apps/api/package.json[52-52]
- pnpm-lock.yaml[124-133]
- pnpm-lock.yaml[184-186]
## Recommended Fix
Raise or narrow both workspace overrides so they preserve the requested minimum versions, then regenerate the lockfile and verify the API and web importer resolutions.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-code-review]

1. The api keeps older routing packages 🐞 Bug ≡ Correctness

The @hono/node-server and hono manifest bumps leave their workspace overrides unchanged, so the
supplied lockfile still resolves the API to node-server 2.0.12 and Hono 4.13.8. Installs using this
lockfile therefore do not receive the requested 2.1.3 and 4.13.12 upgrades, despite the new minimum
versions in the API and other affected manifests.

Agent Prompt

## Issue description
The workspace overrides keep the API on older Hono and node-server versions despite the dependency bumps.

## Fix Focus Areas
- pnpm-workspace.yaml[4-14]
- apps/api/package.json[33-52]
- pnpm-lock.yaml[124-126]

## Recommended Fix
Raise the Hono and node-server override minimums to the requested versions, then regenerate the lockfile and verify the API importer's resolved versions.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Dismiss ↗ | View ↗

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (2) 📘 Rule violations (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. The API and web keep older Hono versions 🐞 Bug ≡ Correctness ⭐ New

Description

The new Hono and Node server dependency minimums are overridden by broader workspace ranges, so the
lockfile still selects Hono 4.13.8 and the API's Node server 2.0.12. Installs from this lockfile
therefore do not deliver the requested 4.13.12 and 2.1.3 upgrades to the API, and web also remains
on Hono 4.13.8.

Code

apps/api/package.json[33]

+    "@hono/node-server": "^2.1.3",

Evidence

The PR raises the API minimums, but the workspace overrides take precedence and the resulting API
lockfile importer records the override ranges and older resolved versions. The web importer also
retains the older Hono resolution.

apps/api/package.json[33-33]
apps/api/package.json[52-52]
pnpm-workspace.yaml[3-9]
pnpm-lock.yaml[124-133]
pnpm-lock.yaml[184-186]
pnpm-lock.yaml[506-509]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The workspace overrides replace the new Hono and Node server minimums with broader ranges, leaving older versions installed.
## Fix Focus Areas
- pnpm-workspace.yaml[3-9]
- apps/api/package.json[33-33]
- apps/api/package.json[52-52]
- pnpm-lock.yaml[124-133]
- pnpm-lock.yaml[184-186]
## Recommended Fix
Raise or narrow both workspace overrides so they preserve the requested minimum versions, then regenerate the lockfile and verify the API and web importer resolutions.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. The API keeps older routing packages 🐞 Bug ≡ Correctness

Description

The @hono/node-server and hono manifest bumps leave their workspace overrides unchanged, so the
supplied lockfile still resolves the API to node-server 2.0.12 and Hono 4.13.8. Installs using this
lockfile therefore do not receive the requested 2.1.3 and 4.13.12 upgrades, despite the new minimum
versions in the API and other affected manifests.

Code

apps/api/package.json[33]

+    "@hono/node-server": "^2.1.3",

Relevance

●●● Strong

Recent PRs accepted fixes for stale overrides preventing dependency bumps from reaching the
lockfile.

PR-#1313
PR-#1271
PR-#1223

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The supplied lockfile diff retains @hono/node-server at 2.0.12 on lines 124–126 and hono at
4.13.8 on lines 184–186. The workspace overrides permit those versions instead of enforcing the new
manifest minimums.

pnpm-workspace.yaml[4-14]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The workspace overrides keep the API on older Hono and node-server versions despite the dependency bumps.
## Fix Focus Areas
- pnpm-workspace.yaml[4-14]
- apps/api/package.json[33-52]
- pnpm-lock.yaml[124-126]
## Recommended Fix
Raise the Hono and node-server override minimums to the requested versions, then regenerate the lockfile and verify the API importer's resolved versions.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

✅ Compliance rules (platform): 6 rules

✅ Cross-repo context — repo relationships

Review mode: Auto: ⚖️ Balanced: Cross-cutting dependency updates affect multiple applications and runtime paths.

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-free-for-open-source-projects]

1. The api and web keep older hono versions 🐞 Bug ≡ Correctness

The new Hono and Node server dependency minimums are overridden by broader workspace ranges, so the
lockfile still selects Hono 4.13.8 and the API's Node server 2.0.12. Installs from this lockfile
therefore do not deliver the requested 4.13.12 and 2.1.3 upgrades to the API, and web also remains
on Hono 4.13.8.

Agent Prompt

## Issue description
The workspace overrides replace the new Hono and Node server minimums with broader ranges, leaving older versions installed.
## Fix Focus Areas
- pnpm-workspace.yaml[3-9]
- apps/api/package.json[33-33]
- apps/api/package.json[52-52]
- pnpm-lock.yaml[124-133]
- pnpm-lock.yaml[184-186]
## Recommended Fix
Raise or narrow both workspace overrides so they preserve the requested minimum versions, then regenerate the lockfile and verify the API and web importer resolutions.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools