chore(deps): bump the production-dependencies group with 3 updates

[dependabot]

Bumps the production-dependencies group with 3 updates: better-auth, @anthropic-ai/sdk and openai.

Updates better-auth from 1.6.28 to 1.7.1

Release notes

Sourced from better-auth's releases.

v1.7.1

better-auth

Bug Fixes

• Added native database transaction support to test instances for PostgreSQL and MySQL.
• Updated bundled dependencies (jose, nanostores, noble crypto packages, SimpleWebAuthn) to their latest compatible releases, with no changes required to existing projects.

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

• Fixed case-insensitive parsing of string Boolean values for SCIM User active and the primary sub-attribute of emails, phoneNumbers, addresses, roles, and entitlements at the HTTP ingress, improving Microsoft Entra interoperability.
• Added an optional SCIM-owned connection and credential catalog: configure managedConnections to allow trusted server code to create runtime tenant connections and issue, rotate, and revoke bearer credentials through server-only auth.api methods, without a code-defined connection or an application-owned verifier.
• Fixed an issue where trusted server code could not retain a terminal connection binding before a dynamic SCIM connection's first authenticated request when supplying a provisioning domain during decommissioning.

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed SSO provider registration to allow reusing a SCIM connection ID, as SCIM connections no longer participate in the authentication provider namespace.
• Fixed SAML assertion signature verification to validate signatures on the raw assertion instead of trusting an already-parsed response, and enforced signing policy and size limits on SP metadata. wantAssertionsSigned now correctly controls whether the SP requires signed assertions, matching real-world IdP signing behavior.

For detailed changes, see CHANGELOG

@better-auth/cimd

Bug Fixes

• Fixed Client ID Metadata Document caching to follow shared-cache freshness rules: the plugin now prefers s-maxage over max-age and Expires, honors s-maxage=0, conditionally revalidates with ETag or Last-Modified, and treats invalid or duplicate freshness directives as immediately stale. Concurrent refreshes now converge on a single client-resource link instead of failing on a unique constraint.

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• Fixed native adapter transactions for raw database instances (better-sqlite3, node:sqlite, bun:sqlite, mysql2, pg) passed directly as database, matching the behavior of the explicit { db }/{ dialect } config shapes. Plugins requiring native transactions (such as @better-auth/scim) now work correctly when using the quickstart database: new Database(...) form.

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed scope error responses so MCP clients now receive a 403 with an RFC 6750 insufficient_scope WWW-Authenticate challenge naming every missing scope, allowing clients to request all needed scopes in a single authorization request.

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.1

Patch Changes

• #10863 845bbd1 Thanks @​gustavovalverde! - auth migrate no longer attempts to add a required column with no default value to a table that already has rows. It stops with an error naming the column and the backfill to run first. Previously the generated statement failed on SQLite, Postgres, and SQL Server; on MySQL it filled the new column with an empty string for every existing row and reported success. If auth migrate already ran against a MySQL database on 1.7, run the check in the upgrade guide's account identity section.

  getMigrations throws the new UnsafeMigrationError (exported from better-auth/db/migration) for this refusal, so callers can distinguish it from other migration errors such as an index-definition conflict.

  auth generate still emits the statements for external migration tooling, with a comment banner naming any column that needs a manual backfill first.

  A required field whose database column is still nullable logs a warning instead of blocking the migration.

  A CLI command that fails now prints its error and exits with a non-zero code instead of an unhandled promise rejection.

• Updated dependencies []:

  • @​better-auth/core@​1.7.1
  • @​better-auth/drizzle-adapter@​1.7.1
  • @​better-auth/kysely-adapter@​1.7.1
  • @​better-auth/memory-adapter@​1.7.1
  • @​better-auth/mongo-adapter@​1.7.1
  • @​better-auth/prisma-adapter@​1.7.1
  • @​better-auth/telemetry@​1.7.1

1.7.0

Minor Changes

• #8733 4e8e4c7 Thanks @​bytaesu! - Add hydrateSession to seed the client with a server-fetched session so useSession returns data on the first render.

• #9930 0cbaf81 Thanks @​gustavovalverde! - Anonymous account linking now works after social and generic OAuth sign-in in Expo and other in-app browsers, where the OAuth callback returns without the session cookie. onLinkAccount fires and the anonymous user is migrated; before, it was silently skipped.

  Plugins can now carry server-trusted data across an OAuth redirect with the new addOAuthServerContext API, read back on the callback via getOAuthState().serverContext. Unlike additionalData, it cannot be set from the request body, so it is the right place for values the server must trust.

  For @better-auth/oauth-provider, the post-login authorization query now travels through that server-only channel, so it can no longer be injected through additionalData.

• #10004 b36c38f Thanks @​bytaesu! - The captcha plugin now requires endpoint entries to match full auth paths unless they use wildcard patterns. This prevents requests like /sign-in//email from bypassing captcha while preserving trailing-slash matches like /sign-in/email/. To protect multiple routes, replace partial paths like /sign-in with explicit wildcards such as /sign-in/* or /sign-in/**.

• #10746 6782647 Thanks @​gustavovalverde! - OAuth device grants now use oauthDeviceAuthorization() alongside oauthProvider() or mcp(). This single integration replaces both the standalone deviceCodeGrant() plugin and the shared-grant configuration. Standalone Device Authorization no longer accepts or stores RFC 8707 resources, and onDeviceAuthRequest receives only clientId and scope. The OAuth integration rejects resource indicators that are not absolute, fragment-free URIs.

  The OAuth integration replaces the optional resource column with oauthClientId and resources. Regenerate and apply the schema when using it. Before upgrading from an earlier 1.7 prerelease, let pending OAuth device codes expire or delete them because they cannot be exchanged through the new integration.

• #10402 763a267 Thanks @​gustavovalverde! - Plugin database schemas can now define named or generated table-level indexes across multiple fields. SQL migrations and generated Drizzle or Prisma schemas resolve configured table and column names consistently, while the MongoDB adapter creates the same indexes before the first index-enforcing write.

• #9766 bf39cbf Thanks @​GautamBytes! - Add a server-only auth.api.consumePhoneNumberOTP API for custom phone OTP flows that need to verify and consume a code without creating or updating users or sessions.

• #10330 081d3c3 Thanks @​ping-maxwell! - Allow the username plugin's separate displayUsername field to be omitted by setting displayUsername: false on both the server and client plugins.

• #10059 49b5cf6 Thanks @​GautamBytes! - Device Authorization now creates unique database indexes for deviceCode and userCode, so each generated code must be unique in its column. Existing installations on every adapter must resolve duplicate values before applying the migration. MySQL and SQL Server installations must also convert both columns to bounded strings and clean up values longer than 191 characters before running it.

... (truncated)

Commits

• 2344536 chore: release v1.7.1 (#10864)
• 845bbd1 fix(db): refuse adding required no-default columns to populated tables (#10863)
• ccd57c2 docs(changelog): align v1.7 release notes with final behavior (#10846)
• f577ec5 chore: exit pre-release mode for v1.7.0
• 69258d1 chore: sync main to next
• e84ec5e chore: release v1.6.30 (#10840)
• bc93b27 chore: release v1.7.0-rc.6 (#10772)
• 58c49eb chore: release v1.6.29 (#10809)
• e6e1b4e perf(db): replace sequential get-then-delete loop with parallel deletes in de...
• 80799e6 chore: sync main to next
• Additional commits viewable in compare view

Updates @anthropic-ai/sdk from 0.117.1 to 0.120.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.120.0

0.120.0 (2026-08-19)

Full Changelog: sdk-v0.119.0...sdk-v0.120.0

Features

• api: managed agents web search config and self hosted sandbox memory (ba8ec50)

Chores

• internal: use a single pnpm workspace lockfile (#359) (3c32145)

sdk: v0.119.0

0.119.0 (2026-08-19)

Full Changelog: sdk-v0.118.0...sdk-v0.119.0

Features

• api: Files and Skills APIs are now GA; add computer use and browser use toolsets (ab41aa3)

sdk: v0.118.0

0.118.0 (2026-08-18)

Full Changelog: sdk-v0.117.1...sdk-v0.118.0

Features

• api: additions to files and memory stores (fdc0379)
• api: updates to skill, files, and user profiles (671e6b1)
• client: add helpers for accessing the workspace ID in response headers (28aa5af)

Bug Fixes

• api: remove unsupported mid_conv_system content block (ae6ca94)
• session-runner: retry tool-result sends for at least the lease TTL (#339) (7dc6325)

Chores

• internal: bump zod to 4.4.3 (#334) (faa5b7b)
• internal: remove leftover prism references (a163b96)
• stop shipping the v0.50 migration guide and migrate CLI (53992d7)

Documentation

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.120.0 (2026-08-19)

Full Changelog: sdk-v0.119.0...sdk-v0.120.0

Features

• api: managed agents web search config and self hosted sandbox memory (ba8ec50)

Chores

• internal: use a single pnpm workspace lockfile (#359) (3c32145)

0.119.0 (2026-08-19)

Full Changelog: sdk-v0.118.0...sdk-v0.119.0

Features

• api: Files and Skills APIs are now GA; add computer use and browser use toolsets (ab41aa3)

0.118.0 (2026-08-18)

Full Changelog: sdk-v0.117.1...sdk-v0.118.0

Features

• api: additions to files and memory stores (fdc0379)
• api: updates to skill, files, and user profiles (671e6b1)
• client: add helpers for accessing the workspace ID in response headers (28aa5af)

Bug Fixes

• api: remove unsupported mid_conv_system content block (ae6ca94)
• session-runner: retry tool-result sends for at least the lease TTL (#339) (7dc6325)

Chores

• internal: bump zod to 4.4.3 (#334) (faa5b7b)
• internal: remove leftover prism references (a163b96)
• stop shipping the v0.50 migration guide and migrate CLI (53992d7)

Documentation

• tools: warn that blocking tool bodies stall the worker heartbeat (#299) (908fdb5)

Commits

• bfa9197 chore: release main
• bc167f3 feat(api): managed agents web search config and self hosted sandbox memory
• 83fd898 chore(internal): use a single pnpm workspace lockfile (#359)
• 7fe6dd5 remove internal ticket references from changelog- #360
• c67e4e2 chore: release main
• 50fc0db feat(api): Files and Skills APIs are now GA; add computer use and browser use...
• 18ea26d chore: release main
• 6ed9ddd feat(api): updates to skill, files, and user profiles
• 91921f5 fix(session-runner): retry tool-result sends for at least the lease TTL (#339)
• 142adcc docs(tools): warn that blocking tool bodies stall the worker heartbeat (#299)
• Additional commits viewable in compare view

Updates openai from 7.4.0 to 7.5.0

Release notes

Sourced from openai's releases.

v7.5.0

7.5.0 (2026-08-17)

Features

• add Bedrock Runtime endpoint support (SDK-290) (#2348) (4a199af)
• api: add new Daybreak and gpt-5.6-cyber model identifiers (9a38e63)
• api: add new Daybreak and gpt-5.6-cyber model identifiers (#2278) (9a38e63)
• api: Add ServiceTier and ImageDetail types (#2364) (602d481)
• api: add WebSocket stream IDs (#2314) (156a8db)
• api: add workload identity access token issued event (#2307) (322a5b1)
• api: deprecate Sora video APIs (#2313) (4424b40)
• api: Ultrafast tier, structured MCP and websocket errors, separate websocket events (#2332) (a3deafb)

Bug Fixes

• api: clarify audio upload metadata requirements (#2279) (34ecf3f)
• audio: prevent microphone leaks and playback pipe deadlocks (#2339) (1c692fe)
• audio: reject ffplay spawn errors (#2012) (6d42d4d)
• auth: reject redirects during workload identity token exchange (#2321) (240385e)
• auth: reject unsafe workload-identity token expirations (#2345) (1f0349d)
• avoid TypeError in toFile for Responses without a URL (#2311) (3313f54)
• await webhook verification in README examples (#2302) (0fe7ad0)
• azure: honor explicit browser denial for Entra token providers (#2328) (9d47510)
• azure: preserve model-to-deployment mapping for images.edit (#1918) (6c207c6)
• azure: prevent API-key disclosure across HTTP redirects (#2320) (f36c418)
• azure: prevent deployment path traversal (#2337) (a9d9d41)
• bedrock: safely sign inherited query parameter names (#2375) (3f8d5cc)
• chat: support custom tool calls in parser and ChatCompletionStream (#2023) (6fa9152)
• client: handle empty JSON response body without content-length (#1998) (b6447e9)
• configure Bash for pnpm scripts on Windows (#2330) (f5a0ad1)
• deps: remediate Dependabot and fixture vulnerabilities (#2282) (783da8f)
• embedding: response type for base64 encoding format (#1554) (ef69801)
• export AzureClientOptions (#1760) (511bf6d), closes #1735
• export workload identity helpers from openai/auth (#2344) (af8f14f)
• fail ecosystem CI when live credentials are missing (#2349) (a47dc75)
• format: restore formatting for generated SDK files (#2089) (6d69d4b)
• harden runTools against inherited function names (#2333) (f4496d1)
• honor defaultHeaders null for helper method header (#1857) (8eab09a)
• include items for strict Zod v3 any arrays (#2357) (4c32089)
• isolate Vercel ecosystem tests per request (#2359) (2831290)
• keep streamed Responses output text linear and canonical (#2354) (6827a40)
• lint: recognize Castiron-generated headers (#2124) (cf6237f)
• lint: restore generated SDK lint rules (#2126) (6b8162c)
• parse empty chat content when present (#2331) (53dd723)
• parser: recognize raw json_schema response format in auto-parsing checks (#2015) (fbd2541)
• pass file batch helper options through (#1855) (05ce028)
• preserve File-like metadata in toFile (#1883) (ba1a781)

... (truncated)

Changelog

Sourced from openai's changelog.

7.5.0 (2026-08-17)

Features

• add Bedrock Runtime endpoint support (SDK-290) (#2348) (4a199af)
• api: add new Daybreak and gpt-5.6-cyber model identifiers (9a38e63)
• api: add new Daybreak and gpt-5.6-cyber model identifiers (#2278) (9a38e63)
• api: Add ServiceTier and ImageDetail types (#2364) (602d481)
• api: add WebSocket stream IDs (#2314) (156a8db)
• api: add workload identity access token issued event (#2307) (322a5b1)
• api: deprecate Sora video APIs (#2313) (4424b40)
• api: Ultrafast tier, structured MCP and websocket errors, separate websocket events (#2332) (a3deafb)

Bug Fixes

• api: clarify audio upload metadata requirements (#2279) (34ecf3f)
• audio: prevent microphone leaks and playback pipe deadlocks (#2339) (1c692fe)
• audio: reject ffplay spawn errors (#2012) (6d42d4d)
• auth: reject redirects during workload identity token exchange (#2321) (240385e)
• auth: reject unsafe workload-identity token expirations (#2345) (1f0349d)
• avoid TypeError in toFile for Responses without a URL (#2311) (3313f54)
• await webhook verification in README examples (#2302) (0fe7ad0)
• azure: honor explicit browser denial for Entra token providers (#2328) (9d47510)
• azure: preserve model-to-deployment mapping for images.edit (#1918) (6c207c6)
• azure: prevent API-key disclosure across HTTP redirects (#2320) (f36c418)
• azure: prevent deployment path traversal (#2337) (a9d9d41)
• bedrock: safely sign inherited query parameter names (#2375) (3f8d5cc)
• chat: support custom tool calls in parser and ChatCompletionStream (#2023) (6fa9152)
• client: handle empty JSON response body without content-length (#1998) (b6447e9)
• configure Bash for pnpm scripts on Windows (#2330) (f5a0ad1)
• deps: remediate Dependabot and fixture vulnerabilities (#2282) (783da8f)
• embedding: response type for base64 encoding format (#1554) (ef69801)
• export AzureClientOptions (#1760) (511bf6d), closes #1735
• export workload identity helpers from openai/auth (#2344) (af8f14f)
• fail ecosystem CI when live credentials are missing (#2349) (a47dc75)
• format: restore formatting for generated SDK files (#2089) (6d69d4b)
• harden runTools against inherited function names (#2333) (f4496d1)
• honor defaultHeaders null for helper method header (#1857) (8eab09a)
• include items for strict Zod v3 any arrays (#2357) (4c32089)
• isolate Vercel ecosystem tests per request (#2359) (2831290)
• keep streamed Responses output text linear and canonical (#2354) (6827a40)
• lint: recognize Castiron-generated headers (#2124) (cf6237f)
• lint: restore generated SDK lint rules (#2126) (6b8162c)
• parse empty chat content when present (#2331) (53dd723)
• parser: recognize raw json_schema response format in auto-parsing checks (#2015) (fbd2541)
• pass file batch helper options through (#1855) (05ce028)
• preserve File-like metadata in toFile (#1883) (ba1a781)
• preserve skill upload paths without buffering native files (#2303) (30b9c41)

... (truncated)

Commits

• 5b96016 release: 7.5.0 (#2087)
• bfcccad fix(security): prevent Bedrock bearer credential disclosure across redirects ...
• 3f8d5cc fix(bedrock): safely sign inherited query parameter names (#2375)
• 16172a4 chore(deps-dev): bump oxfmt from 0.61.0 to 0.62.0 (#2373)
• 6320b64 chore(deps-dev): bump ts-jest from 29.4.11 to 29.4.12 (#2374)
• b49b227 chore(deps-dev): bump webpack from 5.108.4 to 5.109.2 in /ecosystem-tests/ts-...
• 2cc57c3 chore(deps-dev): bump @​aws-sdk/credential-provider-node from 3.972.77 to 3.97...
• 6983363 chore(deps-dev): bump @​cloudflare/workers-types from 5.20260804.1 to 5.202608...
• 50db5db chore(deps-dev): bump @​types/node from 24.12.4 to 26.2.0 (#2370)
• 7259f9f chore(deps-dev): bump html-webpack-plugin from 5.6.7 to 5.6.8 in /ecosystem-t...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[StuartMeeks]

Automated approval: version-update:semver-minor dependency update.