From 066d53467a5c61b53b9bb78f482bc24bcdbc79f6 Mon Sep 17 00:00:00 2001 From: Alejandro Bailo <59607668+alejandrobailo@users.noreply.github.com> Date: Fri, 24 Jul 2026 10:46:56 +0200 Subject: [PATCH] fix(ui): bump next-auth to 5.0.0-beta.32 to patch critical advisories (#12108) --- .../next-auth-critical-advisories.security.md | 1 + ui/dependency-log.json | 36 +++++++++---------- ui/package.json | 2 +- ui/pnpm-lock.yaml | 22 ++++++------ ui/pnpm-workspace.yaml | 2 +- 5 files changed, 32 insertions(+), 31 deletions(-) create mode 100644 ui/changelog.d/next-auth-critical-advisories.security.md diff --git a/ui/changelog.d/next-auth-critical-advisories.security.md b/ui/changelog.d/next-auth-critical-advisories.security.md new file mode 100644 index 0000000000..b4fb8b02c8 --- /dev/null +++ b/ui/changelog.d/next-auth-critical-advisories.security.md @@ -0,0 +1 @@ +next-auth from 5.0.0-beta.30 to 5.0.0-beta.32, patching 2 critical Auth.js advisories (GHSA-8fpg-xm3f-6cx3 fail-open auth checks, GHSA-7rqj-j65f-68wh email homoglyph bypass) diff --git a/ui/dependency-log.json b/ui/dependency-log.json index 16b7f627fe..8908168515 100644 --- a/ui/dependency-log.json +++ b/ui/dependency-log.json @@ -498,18 +498,18 @@ { "section": "dependencies", "name": "next", - "from": "16.2.6", - "to": "16.2.9", + "from": "16.2.9", + "to": "16.2.11", "strategy": "installed", - "generatedAt": "2026-06-15T07:49:41.143Z" + "generatedAt": "2026-07-24T08:32:45.227Z" }, { "section": "dependencies", "name": "next-auth", - "from": "5.0.0-beta.29", - "to": "5.0.0-beta.30", + "from": "5.0.0-beta.30", + "to": "5.0.0-beta.32", "strategy": "installed", - "generatedAt": "2025-12-15T11:18:25.093Z" + "generatedAt": "2026-07-24T08:32:45.227Z" }, { "section": "dependencies", @@ -770,26 +770,26 @@ { "section": "devDependencies", "name": "@vitest/browser", - "from": "4.0.18", - "to": "4.1.8", + "from": "4.1.8", + "to": "4.1.10", "strategy": "installed", - "generatedAt": "2026-06-02T11:34:46.264Z" + "generatedAt": "2026-07-24T08:32:45.227Z" }, { "section": "devDependencies", "name": "@vitest/browser-playwright", - "from": "4.0.18", - "to": "4.1.8", + "from": "4.1.8", + "to": "4.1.10", "strategy": "installed", - "generatedAt": "2026-06-02T11:34:46.264Z" + "generatedAt": "2026-07-24T08:32:45.227Z" }, { "section": "devDependencies", "name": "@vitest/coverage-v8", - "from": "4.0.18", - "to": "4.1.8", + "from": "4.1.8", + "to": "4.1.10", "strategy": "installed", - "generatedAt": "2026-06-02T11:34:46.264Z" + "generatedAt": "2026-07-24T08:32:45.227Z" }, { "section": "devDependencies", @@ -978,10 +978,10 @@ { "section": "devDependencies", "name": "vitest", - "from": "4.0.18", - "to": "4.1.8", + "from": "4.1.8", + "to": "4.1.10", "strategy": "installed", - "generatedAt": "2026-06-02T11:34:46.264Z" + "generatedAt": "2026-07-24T08:32:45.227Z" }, { "section": "devDependencies", diff --git a/ui/package.json b/ui/package.json index 920755722c..3703a594f9 100644 --- a/ui/package.json +++ b/ui/package.json @@ -98,7 +98,7 @@ "modern-screenshot": "4.7.0", "nanoid": "5.1.6", "next": "16.2.11", - "next-auth": "5.0.0-beta.30", + "next-auth": "5.0.0-beta.32", "next-themes": "0.2.1", "react": "19.2.7", "react-day-picker": "9.13.0", diff --git a/ui/pnpm-lock.yaml b/ui/pnpm-lock.yaml index 04000dd587..43aab5c37f 100644 --- a/ui/pnpm-lock.yaml +++ b/ui/pnpm-lock.yaml @@ -232,8 +232,8 @@ importers: specifier: 16.2.11 version: 16.2.11(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7) next-auth: - specifier: 5.0.0-beta.30 - version: 5.0.0-beta.30(next@16.2.11(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7) + specifier: 5.0.0-beta.32 + version: 5.0.0-beta.32(next@16.2.11(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7) next-themes: specifier: 0.2.1 version: 0.2.1(next@16.2.11(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7) @@ -473,12 +473,12 @@ packages: '@asamuzakjp/nwsapi@2.3.9': resolution: {integrity: sha512-n8GuYSrI9bF7FFZ/SjhwevlHc8xaVlb/7HmHelnc/PZXBD2ZR49NnN9sMMuDdEGPeeRQ5d0hqlSlEpgCX3Wl0Q==} - '@auth/core@0.41.0': - resolution: {integrity: sha512-Wd7mHPQ/8zy6Qj7f4T46vg3aoor8fskJm6g2Zyj064oQ3+p0xNZXAV60ww0hY+MbTesfu29kK14Zk5d5JTazXQ==} + '@auth/core@0.41.3': + resolution: {integrity: sha512-sJ3JMHHkXMD3aOjopv7mOBTO1Ocw4b0fAEXJBz6k7YHLpYQI6C40jCUPc5fNvUKxXRXNE1/sRISA15UrwWJBTw==} peerDependencies: '@simplewebauthn/browser': ^9.0.1 '@simplewebauthn/server': ^9.0.2 - nodemailer: ^6.8.0 + nodemailer: ^7.0.7 || ^8.0.5 peerDependenciesMeta: '@simplewebauthn/browser': optional: true @@ -5861,13 +5861,13 @@ packages: neo-async@2.6.2: resolution: {integrity: sha512-Yd3UES5mWCSqR+qNT93S3UoYUkqAZ9lLg8a7g9rimsWmYGK8cVToA4/sF3RrshdyV3sAGMXVUmpMYOw+dLpOuw==} - next-auth@5.0.0-beta.30: - resolution: {integrity: sha512-+c51gquM3F6nMVmoAusRJ7RIoY0K4Ts9HCCwyy/BRoe4mp3msZpOzYMyb5LAYc1wSo74PMQkGDcaghIO7W6Xjg==} + next-auth@5.0.0-beta.32: + resolution: {integrity: sha512-CGlChIEWZ6LltNVxrE5yiySMID+Idpmry47JYA5lLwgD8Sx02a8M65VL0TWVz9nbnOioS/tCW/rP/0+mE7Qp4Q==} peerDependencies: '@simplewebauthn/browser': ^9.0.1 '@simplewebauthn/server': ^9.0.2 next: ^14.0.0-0 || ^15.0.0 || ^16.0.0 - nodemailer: ^7.0.7 + nodemailer: ^7.0.7 || ^8.0.5 react: ^18.2.0 || ^19.0.0 peerDependenciesMeta: '@simplewebauthn/browser': @@ -7410,7 +7410,7 @@ snapshots: '@asamuzakjp/nwsapi@2.3.9': {} - '@auth/core@0.41.0': + '@auth/core@0.41.3': dependencies: '@panva/hkdf': 1.2.1 jose: 6.1.3 @@ -13524,9 +13524,9 @@ snapshots: neo-async@2.6.2: {} - next-auth@5.0.0-beta.30(next@16.2.11(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7): + next-auth@5.0.0-beta.32(next@16.2.11(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7): dependencies: - '@auth/core': 0.41.0 + '@auth/core': 0.41.3 next: 16.2.11(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7) react: 19.2.7 diff --git a/ui/pnpm-workspace.yaml b/ui/pnpm-workspace.yaml index 0a942af944..94016ac93d 100644 --- a/ui/pnpm-workspace.yaml +++ b/ui/pnpm-workspace.yaml @@ -109,7 +109,7 @@ trustPolicy: no-downgrade trustPolicyExclude: # next-auth: only one one-off manual test release (`0.0.0-manual.2824fa11`) has # provenance; real beta/stable releases don't. Scoped to current beta line. - - "next-auth@5.0.0-beta.30" + - "next-auth@5.0.0-beta.32" # semver: legacy major 6.x never had provenance (added in 7.5.1+). Pinned # to the exact 6.x version pulled transitively (via @babel/helper-compilation-targets). - "semver@6.3.1"