[Zach Dunn (zachdunn)]

Requested by Zach · project thread

Summary

Better Auth

• better-auth, @better-auth/cimd, @better-auth/oauth-provider, @better-auth/stripe: 1.7.16 → 1.7.18
• @better-auth/infra: 0.4.14 → 0.4.27
• The oauth-provider patch only needed its hashed dist filename changed (authorize-BnSO_Slc.mjs → authorize-BzDrbYtI.mjs). Both hunks apply cleanly at the same offsets.
• Removed the 1.7.16 minimumReleaseAgeExclude entries. 1.7.18 is past the release-age cooldown, so it needs no exclude.

Other low-risk bumps (patch/minor within existing majors)

• astro 7.4.7, @astrojs/cloudflare 14.4.6, @astrojs/mdx 8.1.3, @astrojs/react 7.1.4, astro-expressive-code 0.44.3
• tailwindcss / @tailwindcss/* 4.3.5, vite 8.3.6, files-sdk 3.1.2, jose 6.2.15, drizzle-orm 0.45.4, prettier 3.9.10, @modelcontextprotocol/ext-apps 2.0.4
• vitest 4.1.12 (fixes two @vitest/mocker advisories)
• wrangler 4.158 (the new @astrojs/cloudflare pulls @cloudflare/vite-plugin, which needs wrangler ^4.156.1 as a peer)
• Refreshed transitive deps that have published security fixes: fast-uri, ip-address, proxy-addr, qs, body-parser, js-yaml, nanoid, postcss, brace-expansion, browserslist, source-map-js, postcss-selector-parser, systeminformation, baseline-browser-mapping

pnpm audit goes from 55 advisories to 10. The 10 left are all in dev or build tooling and need a major or pre-1.0 minor bump of a parent (oxfmt → tinypool, shadcn → zod 3 / minimatch / deepmerge, files-sdk → MCP SDK → @hono/node-server 2.x, astro → esbuild 0.27).

Held back on purpose: @astrojs/check stays at 0.9.10. 0.9.12 pulls a language server that resolves @emnapi/runtime@2.0.0-beta.2, and with that astro check fails to load.

Test plan

• pnpm typecheck
• pnpm test: 7,915 passed
• pnpm lint, pnpm format:check, pnpm changeset:lint, pnpm peers check
• CLI build + pack:check, MCP bundle:check, viewer:bundle:check

---

Generated by Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: b2e75e3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one): 2

• coderabbit:review
• review

🚫 Excluded labels (none allowed): 1

• wip

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: e873da0c-17f0-4a62-9cfa-8a9348a9978b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[uploads-sh]

No uploads on this PR yet

This PR changes UI files (packages/email/package.json). Screenshots help reviewers see what changed.

• From the CLI: uploads put before.png after.png --pr 1399
• From an agent: ask it to attach screenshots with uploads.sh
• By hand: drag images into the PR description and they're imported automatically

Tips for agents

Label each shot so reviewers know what they're seeing. Labels apply to every file in a call, so run one put per shot:

uploads put after.png --pr 1399 --meta path=/settings --state after --caption "Saved settings toast"
uploads put chat.png --pr 1399 --app ios --screen "Chat" --state after

No CLI? With the Uploads MCP, call sign_upload_url for files on disk (or put) with repo, pr: 1399 and the same screen, state and caption fields.

This comment updates with each upload, so you don't need to post the images yourself. A shot or two in the PR description is still welcome. Check what's attached with uploads list --pr 1399. More in the github-screenshots skill or the agent docs.

_{Workspace admins can turn this comment off in Settings → GitHub · docs}