[dependabot]

Bumps the production group with 2 updates in the / directory: @tanstack/react-query and better-auth.

Updates @tanstack/react-query from 5.104.5 to 5.105.0

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.105.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.105.0
  • @​tanstack/react-query@​5.105.0

@​tanstack/react-query-next-experimental@​5.105.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.105.0

@​tanstack/react-query-persist-client@​5.105.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-persist-client-core@​5.105.0
  • @​tanstack/react-query@​5.105.0

@​tanstack/react-query@​5.105.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.105.0

Changelog

Sourced from @​tanstack/react-query's changelog.

5.105.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.105.0

Commits

• 5cc606e ci: Version Packages (#12301)
• 14cc330 style(packages): write durations in 'count * unit * 1000' order (#12382)
• d7c0418 chore(react-query/{useQuery,useInfiniteQuery}): remove the unused '@​eslint-re...
• aa3e26b chore(react-query/{HydrationBoundary,utils}): explain why 'react-hooks-js/ref...
• b2801aa test(react-query/useMutation): assert that the mutation settles in the cache ...
• 43636c4 test(react-query/useMutation): wait for the mutation to settle after unmount ...
• 1eed9d9 chore(*): explain why 'vitest-js/valid-expect' is disabled for the 'expectTyp...
• 6bdeb13 test(*/useQuery): rename the 'throwOnError' callback parameter to 'err' to av...
• 86b9f20 test(*/useMutationState): rename the built 'mutation' to 'existingMutation' t...
• d09972b test(*): rename the 'queryKey' test helper to 'createKey' since it creates ke...
• Additional commits viewable in compare view

Updates better-auth from 1.7.13 to 1.7.14

Release notes

Sourced from better-auth's releases.

v1.7.14

better-auth

Bug Fixes

• Fixed two-factor TOTP to accept imported Base32 secrets stored as base32:<secret> (#12031)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed Kakao sign-in to forward loginHint so the Kakao Account login page opens with the ID field prefilled (#12045)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​bytaesu, @​honuuk

Full changelog: v1.7.13...v1.7.14

Changelog

Sourced from better-auth's changelog.

1.7.14

Patch Changes

• #12031 d2cb7f5 Thanks @​bytaesu! - Two-factor TOTP now accepts imported Base32 secrets stored as base32:<secret>.

• Updated dependencies [2947ab7]:

  • @​better-auth/core@​1.7.14
  • @​better-auth/drizzle-adapter@​1.7.14
  • @​better-auth/kysely-adapter@​1.7.14
  • @​better-auth/memory-adapter@​1.7.14
  • @​better-auth/mongo-adapter@​1.7.14
  • @​better-auth/prisma-adapter@​1.7.14
  • @​better-auth/telemetry@​1.7.14

Commits

• a936663 chore: release v1.7.14 (#12055)
• d2cb7f5 fix(two-factor): accept imported Base32 TOTP secrets (#12031)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs changes before merge.

What this changes

Updates TanStack React Query to 5.105.0 and Better Auth to 1.7.14, including their lockfile dependencies.

Example: Install the dashboard and API dependencies from the frozen lockfile.

• Before: React Query resolves to 5.104.5 and Better Auth to 1.7.13.
• After: React Query resolves to 5.105.0 and Better Auth to 1.7.14.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	Focused maintenance with successful exact-head checks, but generator alignment departs from the recorded intent without explanation.
Proof confidence	🦐 gold shrimp (3/6)	This bot-authored maintenance PR is outside the ordinary contributor proof gate; passing CI supports compatibility but provides no live dashboard or sign-in demonstration.
Patch quality	🐚 platinum hermit (4/6)	1 actionable review finding remain.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: The dashboard and API dependencies need routine compatible updates.
Reason: The refresh follows established dependency maintenance without adding configuration, providers, or public APIs.

Merge readiness

⛔ Needs changes before merge - 2 items remain

This PR contains dependency updates absent from main; restore the intentionally aligned Better Auth generator before landing.

Priority: P3
Reviewed head: d65176fa5765b65b66581f43039faf9558982977

Before merge

• Keep the auth schema generator aligned with the runtime (P3) - After this bump, running pnpm --dir apps/api db:generate-auth still executes auth@1.7.13 while the application uses Better Auth 1.7.14. The preceding merged update explicitly preserves matching versions, and the Unreleased changelog still promises that alignment. Update the existing generator pin to 1.7.14 as part of this bump; the upstream diff does not establish a current schema mismatch, so this is a tooling consistency defect rather than demonstrated data corruption.
• Explain or restore the original intent of Better Auth runtime and generator versions - 666708d: The preceding merged update explicitly kept the auth schema generator at the same version as the runtime, continuing earlier paired updates.

Findings

• [P3] Keep the auth schema generator aligned with the runtime — apps/api/package.json:22

Provenance

• Better Auth runtime and generator versions changes intended behavior without addressing why it exists (666708d: The preceding merged update explicitly kept the auth schema generator at the same version as the runtime, continuing earlier paired updates.)

Agent review details

How this fits together

The dashboard uses React Query for API data, while the Worker uses Better Auth with a Drizzle-backed D1 adapter for dashboard sessions.

flowchart LR
  Browser --> Dashboard
  Dashboard --> ReactQuery
  ReactQuery --> Worker
  Worker --> BetterAuth
  BetterAuth --> D1
  Generator --> AuthSchema
  AuthSchema --> BetterAuth

Loading

Technical review

Best possible solution:

Land the focused dependency refresh with the Better Auth generator pinned to 1.7.14 alongside its runtime.

Do we have a high-confidence way to reproduce the issue?

The manifest directly shows db:generate-auth invoking auth@1.7.13 after the runtime moves to 1.7.14; no schema corruption or application failure was reproduced.

Is this the best way to solve the issue?

The dependency changes are focused and preserve existing overrides; updating the existing generator pin completes the established maintenance pattern.

Full review comments:

• [P3] Keep the auth schema generator aligned with the runtime — apps/api/package.json:22
  After this bump, running pnpm --dir apps/api db:generate-auth still executes auth@1.7.13 while the application uses Better Auth 1.7.14. The preceding merged update explicitly preserves matching versions, and the Unreleased changelog still promises that alignment. Update the existing generator pin to 1.7.14 as part of this bump; the upstream diff does not establish a current schema mismatch, so this is a tooling consistency defect rather than demonstrated data corruption.
  Confidence: 0.94

Overall correctness: patch is correct
Overall confidence: 0.91

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 666708d2ebd8.

Provenance checked

• TanStack React Query dependency keeps the original intent (7d6ec50: Refresh compatible application dependencies while preserving the runtime floor and dependency cooldown.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

Acceptance criteria:

• pnpm install --frozen-lockfile
• pnpm --dir apps/api db:generate-auth
• git diff --exit-code -- apps/api/src/db/authSchema.ts
• pnpm lint
• pnpm typecheck

What I checked:

• Pinned introduced diff: The PR changes two dependency declarations and their lockfile resolutions; main retains React Query 5.104.5 and Better Auth 1.7.13. (apps/api/package.json:22, d65176fa5765)
• Established generator alignment: build(deps): refresh compatible application and tooling dependencies #176 explicitly keeps the schema generator at the runtime version; earlier dependency updates also changed both pins together. (apps/api/package.json:17, 666708d2ebd8)
• Enabled auth boundary: Runtime configuration enables GitHub and guarded development credentials, with no two-factor plugin or Kakao provider; public evaluation remains separately routed. (apps/api/src/auth/auth.ts:38, d65176fa5765)
• Upstream runtime and schema inspection: The imported dependency's 1.7.13-to-1.7.14 production changes affect imported TOTP secrets and Kakao login hints, neither enabled here; no runtime schema or adapter changes appear in the comparison. (packages/better-auth/src/plugins/two-factor/totp/index.ts, a936663d3a3c)
• Exact-head checks: The reviewed head has 11 successful checks and two skipped dispatch checks, including successful frozen installation, lint, typecheck, tests, builds, and CodeQL. (.github/workflows/ci.yml, d65176fa5765)
• Earlier update was superseded, not merged: build(deps): bump @tanstack/react-query from 5.104.5 to 5.105.0 in the production group #177 proposed the same React Query update, was closed without merging, and has a Dependabot comment explaining that another update replaces it.

Likely related people:

• Peter Steinberger: Raw commit 311476e adds apps/admin/package.json:14 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 311476e9ae21; files: apps/admin/package.json)
• dependabot[bot]: Raw commit 666708d adds apps/api/package.json:17 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: medium; commits: 666708d2ebd8; files: apps/api/package.json)

Root-cause cluster

Relationship: canonical
Canonical: #179
Summary: This PR incorporates the React Query update from the earlier closed, unmerged dependency PR.

Members:

• superseded: build(deps): bump @tanstack/react-query from 5.104.5 to 5.105.0 in the production group #177 - Its exact React Query version change is included here, and Dependabot closed it as replaced.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Labels

Label changes:

• add P3: Routine dependency maintenance with a low-impact generator-version drift and passing checks.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Label justifications:

• P3: Routine dependency maintenance with a low-impact generator-version drift and passing checks.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 29, 2026, 2:48 PM ET / 18:48 UTC.

[vincentkoc]

Verified the generator-alignment correction against exact head d65176fa5765b65b66581f43039faf9558982977 in an unpublished local candidate:

• Change only the generator version in db:generate-auth from auth@1.7.13 to auth@1.7.14, preserving all flags and the trailing Biome command; update the existing Unreleased alignment note to name 1.7.14. No additional lockfile change is needed.
• With an independent frozen pnpm 11.28.0 install and Node 26.12.1, the real db:generate-auth command reproduced the committed schema byte-for-byte. The manifest Biome check, API typecheck, and all 142 API tests across 16 files passed. The generator emits its empty-config schema diagnostic; its command exits successfully and generated output remains unchanged.
• The PR branch is uneditable and has not been updated with this correction, so keep the finding open until the actual landed diff includes it. Coordinate the existing automatic Pages deployment before landing the lockfile update.

This proves the proposed generator correction; it does not claim the unchanged PR already contains the fix or that a deployment was performed.