Repository navigation
chore(deps): bump dotenv from 17.4.2 to 18.0.9 in /src/Dhadgar.BetterAuth - #202
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [dotenv](https://github.com/motdotla/dotenv) from 17.4.2 to 18.0.9. - [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md) - [Commits](motdotla/dotenv@v17.4.2...v18.0.9) --- updated-dependencies: - dependency-name: dotenv dependency-version: 18.0.9 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
javascript
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
Cadacious
added a commit
that referenced
this pull request
Oct 26, 2026
…Auth exchange (#212) * ci(deps): stop Dependabot proposing static-web-apps-deploy The action is only published as a moving v1 tag, which Dependabot resolves to the 2021 tag commit and offers as an update (#207). Ignore it and update the pin by hand. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014QCSL3vKBpaY5vx6epF7wE * chore(deps): dotenv 18 in BetterAuth Supersedes Dependabot #202 (17.4.2 -> 18.0.9). dotenv 18 adds a CLI and an opt-in fast parser, drops .env.vault support and preloading, and moves the "injected env" line to stderr. config() still logs unless quiet is set, so env.js keeps config({ quiet: true }); only its comment changes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014QCSL3vKBpaY5vx6epF7wE * fix(betterauth): rate-limit the exchange endpoint Addresses CodeQL js/missing-rate-limiting on POST /api/v1/betterauth/exchange, which does a session lookup, a DB query and signs a token per request. express-rate-limit 8 now limits it per client IP (default 30 per minute, EXCHANGE_RATE_LIMIT_MAX and EXCHANGE_RATE_LIMIT_WINDOW_MS override) and answers 429 { "error": "rate_limited" } with draft-8 RateLimit headers. The client IP comes from a new TRUST_PROXY setting (unset = trust nothing, integer = hop count, otherwise an address/subnet list). "true" is refused at startup because it lets clients spoof X-Forwarded-For. Behind the Gateway the deployment should set TRUST_PROXY=1. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014QCSL3vKBpaY5vx6epF7wE * deploy(compose): trust the Gateway hop in BetterAuth BetterAuth sits behind the Gateway, so without TRUST_PROXY every request looks like it comes from the Gateway and the /exchange rate limit becomes one bucket for all users. Trust one hop. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014QCSL3vKBpaY5vx6epF7wE * chore(deps): bump astro to 7.4.2 and @astrojs/react to 7.1.1 in Panel and ShoppingCart Resolves Dependabot #203, #204, #205 and #206. @astrojs/react 7 moves to @vitejs/plugin-react 6 (Oxc) and drops the `babel` option; neither site passes options to react(), so no config change is needed. Adds engines.node >=22.23.4 to match Scope and the new astro/@astrojs/react engine floor. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014QCSL3vKBpaY5vx6epF7wE * chore(deps): bump @astrojs/react to 7.1.1 in Scope Keeps Scope on the same @astrojs/react major as Panel and ShoppingCart. Scope passes no options to react(), so the removed `babel` option does not affect it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014QCSL3vKBpaY5vx6epF7wE * chore(deps): move Scope linting to ESLint 10 Resolves Dependabot #162 (eslint 9 -> 10; takes 10.13.0, the newest 10.x). - eslint 10.13.0, plus @eslint/js 10.0.1 as an explicit devDependency (eslint 10 no longer pulls it in). - eslint-plugin-react 7.37.5 -> @eslint-react/eslint-plugin 5.28.8. eslint-plugin-react crashes on ESLint 10 (removed context.getFilename) and its maintainer says it is not yet supported (jsx-eslint/eslint-plugin-react#3977). Uses recommended-typescript, with the old recommended rules it only warns on or omits raised to error (no-missing-component-display-name, jsx-no-comment-textnodes, jsx-no-children-prop, dom-no-unsafe-target-blank, dom-no-unknown-property). Its duplicate hook rules are turned off so eslint-plugin-react-hooks stays the only source of hooks checks. - eslint-plugin-jsx-a11y 6.10.2 -> eslint-plugin-jsx-a11y-x 0.2.0, the maintained drop-in fork that declares ESLint 10 support; the same 31 recommended rules, now under the jsx-a11y-x/ prefix. - eslint-plugin-security 3.0.1 -> 4.2.0: 3.x calls context.getSourceCode() and crashes on ESLint 10. 4.x adds detect-invisible-characters (warn). No --force, --legacy-peer-deps, overrides or compat shims. Lint: 0 errors, 22 warnings (12 new warnings from @eslint-react recommended rules). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014QCSL3vKBpaY5vx6epF7wE * chore(deps): NuGet minor/patch group and coverlet 10.1 Applies the target versions from Dependabot #196 (nuget-minor-patch group) and #197 (coverlet.collector) on top of current main, and regenerates the lock files. Notable bumps: - Aspire.Hosting.* and Aspire.Hosting.Testing 13.5.3 -> 13.6.4, with the AppHost SDK moved to 13.6.4 to match (MessagePack stays 3.1.12) - OpenTelemetry core, exporter and AspNetCore/Http/Runtime instrumentation 1.18.0 -> 1.20.1 - coverlet.collector 10.0.1 -> 10.1.0 - AngleSharp 1.8.6, MailKit 4.18.2, OpenIddict 7.7.2, Microsoft.Extensions.* (Resilience/Telemetry/Redaction/TimeProvider) 10.11.0, IdentityModel 8.23.0, Azure KeyVault patches, Azure.ResourceManager.KeyVault 1.5.0, FluentValidation 12.2.0, FluentAssertions 8.11.0, Microsoft.OpenApi 2.13.0, Scalar 2.18.3, Spectre.Console.Cli 0.57.2, Discord.Net 3.20.2, SQLitePCLRaw 2.1.14 Held back: - MassTransit stays 8.3.6 (deliberate hold, #195) - System.CommandLine stays 2.0.0-beta4 (the group's 2.0.14 is the stable line with a different API) The group's extra csproj edits (VersionOverride on StackExchange.Redis, direct FluentValidation/Jwt references in Identity) were not needed and are left out; no code changes were required. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014QCSL3vKBpaY5vx6epF7wE * chore(deps): bump MassTransit to 8.5.12 and System.CommandLine to 2.0.14 MassTransit, MassTransit.EntityFrameworkCore and MassTransit.RabbitMQ go from 8.3.6 to 8.5.12. The 8.5.12 nuspecs declare Apache-2.0, so this stays on the open-source v8 line; the hold on v9 (commercial) remains. MassTransit 8.5 registers a usage tracker that only implements IAsyncDisposable, so the messaging credential tests now dispose their ServiceProvider with await using, as the generic host does. System.CommandLine moves from 2.0.0-beta4.22272.1 to the 2.0.14 stable release. The CLI is migrated to the GA API: - SetHandler/InvocationContext -> SetAction with ParseResult.GetValue; commands that set an exit code now return it from the action - AddCommand/AddOption/AddArgument -> Subcommands/Options/Arguments.Add - descriptions move to the Description property, IsRequired -> Required, getDefaultValue -> DefaultValueFactory - option validators use Validators.Add and AddError - root.InvokeAsync(args) -> root.Parse(args).InvokeAsync() - the ping command forwards the action's cancellation token (CA2016) - the commands listing handles Option.Name now carrying the "--" prefix and ArgumentHelpName becoming HelpName Help, validation and error output is unchanged except that root help lists --help before --version and some blank lines move. Lock files regenerated with --force-evaluate. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014QCSL3vKBpaY5vx6epF7wE * fix(betterauth): close the direct-port bypass and log rate-limit hits - Bind BetterAuth's compose host port to 127.0.0.1. With TRUST_PROXY=1, a caller reaching port 5130 directly could set X-Forwarded-For per request and get a fresh bucket each time. - Log when the exchange limit rejects a request. - Parse TRUST_PROXY and the limit settings before loading secrets and running migrations, so a bad value fails fast. - README: per-client limits need Cloudflare in front of the Gateway, and the count is per process. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014QCSL3vKBpaY5vx6epF7wE --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
|
Superseded by #212, which shipped this update. |
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
dependabot
Bot
deleted the
dependabot/npm_and_yarn/src/Dhadgar.BetterAuth/dotenv-18.0.9
branch
October 26, 2026 23:16
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps dotenv from 17.4.2 to 18.0.9.
Changelog
Sourced from dotenv's changelog.
... (truncated)
Commits
8d1ab8518.0.959a40cechangelog88228bdMerge pull request #1076 from Enesuygurs/fix/cli-empty-dotenv-pathbc6ef94fix(cli): load the default .env when DOTENV_PATH is empty6d6e6c5Merge pull request #1075 from kory-kaai/test/fast-parser-branch-coverage10218f1test(parse-fast): cover the size-dependent and export-prefix branchese2fe95e18.0.87aa712atype detail improvement53405b0Merge pull request #1074 from himanshu748/codex/fix-dotenv-populate-undefined...0b4843achangelogDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)