[dependabot]

Refresh Better Auth to 1.7.13, Hono to 4.13.14, Biome to 2.6.3, and Cloudflare Workers types to 5.20261025.1. This incorporates the development updates from #174 into one dependency change.

Keep the Better Auth schema generator at the same version as the runtime. Preserve the existing Node.js floor, two-day dependency cooldown, workerd pin, and patched Undici overrides from #171. Add the Unreleased changelog entry thanking @dependabot.

Validation: frozen pnpm install, lint, typecheck, all tests (299 Vitest tests plus Node test harnesses), admin and demo builds, documentation build, and packed SDK runtime/type verification passed on Linux. Independent review through P3 found no actionable findings. Existing credential-store checks remain on Linux, Windows, and xcode-27 CI.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs changes before merge.

What this changes

This PR upgrades Better Auth to 1.7.13 and Hono to 4.13.14, including their locked dependencies.

Example: A stream request supplies ?%6bey=first&key=second.

• Before: Hono's optimized query lookup can select second.
• After: Hono selects first, preserving decoded query parameter order.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	Focused maintenance with successful exact-head CI and inspected upstream changes; confidence rests on harness coverage, and the unexplained generator-alignment departure caps the overall rating.
Proof confidence	🦐 gold shrimp (3/6)	This Dependabot PR is outside the ordinary contributor proof gate; exact-head CI exercises existing Worker and local-D1 auth coverage, without supplying independent shipped-runtime evidence.
Patch quality	🐚 platinum hermit (4/6)	1 actionable review finding remain.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Operators benefit from upstream routing corrections and maintained production auth dependencies.
Reason: These patch updates follow the repository's established dependency-maintenance direction without adding settings, providers, or public APIs.

Merge readiness

⛔ Needs changes before merge - 2 items remain

Keep this PR open: it provides compatible production dependency updates that are absent from current main.

Priority: P3
Reviewed head: 0ae97b27cdfb68f3750f209ea0f141de78dbefb9

Before merge

• Add the required Unreleased dependency changelog entry (P3) - These production upgrades include observable query-parsing compatibility changes, but the patch leaves CHANGELOG.md's Unreleased section empty. AGENTS.md requires an entry for compatibility changes. Add a concise note naming the updates so operators can identify the changed production dependencies in the next release.
• Explain or restore the original intent of Better Auth runtime and generator alignment - 7d6ec50: The merged dependency update intentionally kept the schema generator aligned with its runtime.

Findings

• [P3] Add the required Unreleased dependency changelog entry — apps/api/package.json:22-24

Provenance

• Better Auth runtime and generator alignment changes intended behavior without addressing why it exists (7d6ec50: The merged dependency update intentionally kept the schema generator aligned with its runtime.)

Agent review details

How this fits together

The Cloudflare Worker uses Hono to route public evaluation and dashboard requests, while Better Auth manages dashboard identities and sessions backed by D1.

flowchart TD
  A[HTTP clients] --> B[Worker hostname policy]
  B --> C[Hono routing]
  C --> D[Public evaluation]
  C --> E[Dashboard authorization]
  E --> F[Better Auth sessions]
  F --> G[D1 database]

Loading

Technical review

Best possible solution:

Retain the focused dependency update and document its compatibility changes in the existing Unreleased changelog.

Do we have a high-confidence way to reproduce the issue?

This is dependency maintenance rather than a reported application failure; source inspection establishes the version changes without running target code.

Is this the best way to solve the issue?

Updating the existing manifest and generated lockfile is appropriately scoped; no additional runtime machinery or speculative compatibility fix is warranted.

Full review comments:

• [P3] Add the required Unreleased dependency changelog entry — apps/api/package.json:22-24
  These production upgrades include observable query-parsing compatibility changes, but the patch leaves CHANGELOG.md's Unreleased section empty. AGENTS.md requires an entry for compatibility changes. Add a concise note naming the updates so operators can identify the changed production dependencies in the next release.
  Confidence: 0.98

Overall correctness: patch is correct
Overall confidence: 0.9

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against fa559f4be47b.

Provenance checked

• Hono dependency and locked graph keeps the original intent (980e30b: Refresh compatible dependencies while preserving the runtime floor, security overrides, and dependency cooldown.)
• Security overrides and installation policy keeps the original intent (311476e: Keep patched transitive dependencies and the existing installation boundaries.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

Acceptance criteria:

• git diff --check
• git diff -- CHANGELOG.md

What I checked:

• Pinned change and main comparison: The introduced diff changes only the API dependency manifest and lockfile; main still pins Better Auth 1.7.12 and Hono 4.13.13. (apps/api/package.json:22, 0ae97b27cdfb)
• Applicable changelog policy: The complete root policy requires an Unreleased entry for compatibility changes; this PR leaves that section empty. No scoped AGENTS.md, maintainer notes, or pr-simplify skill exists in the inspected paths. The single-review instruction superseded the bundled autoreview requirement. (AGENTS.md:60, 0ae97b27cdfb)
• Prior dependency intent: build(deps): patch Node runtimes and refresh compatible dependencies #161 deliberately aligned the auth runtime and schema generator. The current generator remains at 1.7.12, but the reviewed upstream patch changes no schema generator implementation or database schema, so a concrete generation failure is not established. (apps/api/package.json:17, 7d6ec50510d6)
• Exact-head validation and discussion: REST inspection confirms successful lint, typecheck, tests, builds, CodeQL, and keyring checks on the reviewed head. The full PR body and both comments contain dependency information and bot status messages, with no additional direction or runtime artifacts. (0ae97b27cdfb)
• Used auth dependency contract: The Worker imports betterAuth and its Drizzle adapter. The version comparison changes unused Cloudflare and Vercel social-provider options, organization documentation metadata, and package metadata; it introduces no auth storage schema change. (packages/core/src/social-providers/cloudflare.ts, 7f610814800b)
• Routing compatibility: The comparison fixes encoded duplicate query ordering used by Worker query lookups. The application does not use the changed serve-static middleware, custom getPath option, or duplicate route parameter names. (src/utils/url.ts:244, bac5c4a8bcd7)

Likely related people:

• Josh Avant: Raw commit 7d6ec50 adds apps/api/package.json:17 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 7d6ec50510d6; files: apps/api/package.json)
• Vincent Koc: Raw commit 2eecbf7 adds apps/api/package.json:8 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: medium; commits: 2eecbf7d2fb0; files: apps/api/package.json)

Labels

Label changes:

• add P3: Routine compatible dependency maintenance with a low-impact release-note omission and no demonstrated runtime regression.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Label justifications:

• P3: Routine compatible dependency maintenance with a low-impact release-note omission and no demonstrated runtime regression.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Align the schema-generator pin with the auth runtime or explain why retaining 1.7.12 preserves the intended generation contract.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 27, 2026, 2:48 PM ET / 18:48 UTC.

[steipete]

Reviewed the combined dependency diff and lockfile. Better Auth's schema generator stays aligned with its runtime; the dependency cooldown, runtime floor, and patched Undici overrides remain intact. Full Linux validation and independent review passed, and CI is green at b97eb6a.