chore(deps): bump the npm-minor-patch group across 1 directory with 56 updates

[dependabot]

Bumps the npm-minor-patch group with 56 updates in the / directory:

Package	From	To
@biomejs/biome	2.5.6	2.5.12
@testing-library/react	16.3.2	16.3.3
@testing-library/user-event	14.6.1	14.6.7
eslint	10.9.1	10.10.0
turbo	2.10.7	2.10.12
better-sqlite3	13.0.2	13.0.3
@better-auth/api-key	1.7.0-rc.2	1.7.3
@better-auth/electron	1.7.0-rc.2	1.7.3
better-auth	1.7.0-rc.2	1.7.3
@electron/asar	4.2.1	4.3.0
@hookform/resolvers	5.5.7	5.9.1
foxact	0.3.10	0.3.11
playwright-core	1.62.0	1.63.0
react-hook-form	7.83.0	7.87.0
@better-auth/expo	1.7.0-rc.2	1.7.3
heroui-native	1.0.6	1.0.9
lucide-react-native	1.27.0	1.41.0
posthog-react-native	4.60.0	4.67.0
tailwind-variants	3.3.0	3.3.1
uniwind	1.10.0	1.12.0
posthog-js	1.407.3	1.427.2
@noble/ed25519	3.0.0	3.2.0
@noble/hashes	2.2.0	2.4.0
smol-toml	1.7.1	1.8.0
p-map	7.0.6	7.0.7
@types/semver	7.7.1	7.8.0
restty	0.2.6	0.3.0
@base-ui/react	1.7.0	1.8.0
@fontsource/noto-emoji	5.3.0	5.3.1
@lexical/react	0.48.0	0.50.0
@lexical/selection	0.48.0	0.50.0
@lexical/utils	0.48.0	0.50.0
@pierre/diffs	1.2.12	1.4.1
@shikijs/core	4.3.1	4.4.3
@shikijs/engine-javascript	4.3.1	4.4.3
@shikijs/langs	4.3.1	4.4.3
@shikijs/themes	4.3.1	4.4.3
dompurify	3.4.12	3.4.15
lexical	0.48.0	0.50.0
lucide-react	1.27.0	1.41.0
mermaid	11.16.0	11.17.2
pretty-bytes	7.1.1	7.1.3
pretty-ms	9.3.0	9.3.1
remend	1.3.0	1.3.1
streamdown	2.5.0	2.6.0
virtua	0.50.0	0.51.0
@lexical/headless	0.48.0	0.50.0
@iconify-json/material-icon-theme	1.2.69	1.2.70
@iconify-json/simple-icons	1.2.92	1.2.94
@vitejs/plugin-react	6.0.4	6.1.1
react-router	8.3.0	8.3.1
swr	2.4.2	2.5.1
tsx	4.23.1	4.23.13
use-intl	4.13.4	4.14.2
vite	8.1.5	8.2.2
zustand	5.0.14	5.0.15

Updates @biomejs/biome from 2.5.6 to 2.5.12

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.12

2.5.12

Patch Changes

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute expressions rejecting TypeScript and JSX syntax that is accepted in text expressions.

  <Component icon={<Icon />} count={total as number} onSelect={(e: Event) => e} />

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute names being split on : and . inside an expression, such as {x && <button x-on:keyup.enter={go} client:load.foo />}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a bare > in the children of an Astro expression being treated as markup, such as {x && <div>a > b</div>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed HTML comments inside an Astro expression failing to parse. They are now read as trivia, wherever they appear among the children.

  {x && <div><!-- first -->text<!-- last --></div>}
  {cond && <a></a><!-- c --><b></b>}

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed is:raw children inside an Astro expression being read as JSX, such as {x && <div is:raw>{not js} < & text</div>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed an apostrophe or quote in the text of a JSX element inside an Astro expression ending the expression early, such as {items.map((i) => <li>it's {i}</li>)}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed the children of a <script> or <style> inside an Astro expression being read as JSX. Their contents are text, so braces and comparisons no longer have to be escaped.

  {cond && <style>a { color: red }</style>}
  {cond && <script>let x = {a: 1};</script>}

• #11440 b88f1ea Thanks @​Princesseuh! - Added support for template literal attribute values inside an Astro expression, such as {x && <C data-x=`t${x}` />}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed unquoted attribute values being rejected inside an Astro expression, such as {x && <a class=foo maxlength=255 href=/about>go</a>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a template literal nested inside ${} breaking the rest of an Astro file, such as const href = `/blog${page === 0 ? '' : `/${page + 1}`}`;.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a quote inside a regex character class breaking the rest of an Astro file, such as const unsafe = /[/"]/;.

• #11508 54f3a2e Thanks @​dyc3! - Added the nursery rule useFlatMathMinMax. Because Math.min() and Math.max() accept any number of arguments, the rule reports unnecessary nested calls to the same method:

  Math.max(Math.max(a, b), c);

  The fix flattens this expression to Math.max(a, b, c).

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.12

Patch Changes

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute expressions rejecting TypeScript and JSX syntax that is accepted in text expressions.

  <Component icon={<Icon />} count={total as number} onSelect={(e: Event) => e} />

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute names being split on : and . inside an expression, such as {x && <button x-on:keyup.enter={go} client:load.foo />}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a bare > in the children of an Astro expression being treated as markup, such as {x && <div>a > b</div>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed HTML comments inside an Astro expression failing to parse. They are now read as trivia, wherever they appear among the children.

  {x && <div><!-- first -->text<!-- last --></div>}
  {cond && <a></a><!-- c --><b></b>}

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed is:raw children inside an Astro expression being read as JSX, such as {x && <div is:raw>{not js} < & text</div>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed an apostrophe or quote in the text of a JSX element inside an Astro expression ending the expression early, such as {items.map((i) => <li>it's {i}</li>)}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed the children of a <script> or <style> inside an Astro expression being read as JSX. Their contents are text, so braces and comparisons no longer have to be escaped.

  {cond && <style>a { color: red }</style>}
  {cond && <script>let x = {a: 1};</script>}

• #11440 b88f1ea Thanks @​Princesseuh! - Added support for template literal attribute values inside an Astro expression, such as {x && <C data-x=`t${x}` />}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed unquoted attribute values being rejected inside an Astro expression, such as {x && <a class=foo maxlength=255 href=/about>go</a>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a template literal nested inside ${} breaking the rest of an Astro file, such as const href = `/blog${page === 0 ? '' : `/${page + 1}`}`;.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a quote inside a regex character class breaking the rest of an Astro file, such as const unsafe = /[/"]/;.

• #11508 54f3a2e Thanks @​dyc3! - Added the nursery rule useFlatMathMinMax. Because Math.min() and Math.max() accept any number of arguments, the rule reports unnecessary nested calls to the same method:

  Math.max(Math.max(a, b), c);

  The fix flattens this expression to Math.max(a, b, c).

• #11585 c5c8315 Thanks @​Netail! - Fixed #11475: noUnresolvedImports no longer reports Bun runtime built-in modules (bun, bun:bundle, bun:ffi, bun:jsc, bun:sqlite, bun:test).

... (truncated)

Commits

• 0a31d7c ci: release (#11530)
• a20f44a feat: noBunModules (#11597)
• 1fc42ed feat(lint/js): add noThisOutsideOfClass (#11596)
• 6c7fd27 feat(lint/js/vue): add noVueDeprecatedScopedSlots (#11593)
• f4e5ebb feat(lint): add useModernMathApis (#11581)
• 54f3a2e feat(lint/js): add useFlatMathMinMax (#11508)
• 1d6210b feat(lint/js): add noUnmodifiedLoopCondition (#11491)
• 2d55931 feat(js_analyze): added a React naming convention rule (#11554)
• ee69e0e fix(schema): domains (#11565)
• f5d7896 feat(lint/js): add noInvalidFileInputAccept (#11497)
• Additional commits viewable in compare view

Updates @testing-library/react from 16.3.2 to 16.3.3

Release notes

Sourced from @​testing-library/react's releases.

v16.3.3

16.3.3 (2026-08-27)

Bug Fixes

• Avoid act() re-entrant when dispatching events (#1468) (20ce75f)

Commits

• 20ce75f fix: Avoid act() re-entrant when dispatching events (#1468)
• be9d81d docs: fix typos in comments and types (#1446)
• See full diff in compare view

Updates @testing-library/user-event from 14.6.1 to 14.6.7

Release notes

Sourced from @​testing-library/user-event's releases.

v14.6.7

14.6.7 (2026-09-02)

Bug Fixes

• normalize DataTransfer format aliases (#1326) (1e0020b)
• feature: Add iframe support for user.keyboard typing (#1275) (1e0020b)

v14.6.6

14.6.6 (2026-08-22)

Bug Fixes

• default pointer event pointerType to empty string instead of the string "undefined" (#1325) (71a5475)

v14.6.5

14.6.5 (2026-08-18)

Bug Fixes

• tab retargeting if focus moved during keydown (#1296) (43efda7)

v14.6.4

14.6.4 (2026-08-11)

Bug Fixes

• keyboard event repeat property (#1312) (d7e80e3)

v14.6.3

14.6.3 (2026-08-03)

Bug Fixes

• release: manually release a patch version (#1321) (1d18b1f), closes #1317

v14.6.2

14.6.2 (2026-08-03)

Commits

• 1e0020b fix: normalize DataTransfer format aliases (#1326)
• d4b0593 feature: Add iframe support for user.keyboard typing (#1275)
• 71a5475 fix: default pointer event pointerType to empty string instead of the string ...
• 43efda7 fix: tab retargeting if focus moved during keydown (#1296)
• d7e80e3 fix: keyboard event repeat property (#1312)
• 43d8e6c ci: remove broken npm backfill step (#1322)
• 1d18b1f fix(release): manually release a patch version (#1321)
• 232f3e6 docs: add migration note and clean up README badges (#1320)
• 83e2b22 ci: remove deprecated CodeSandbox CI (#1318)
• e8da819 ci: publish to npm via OIDC trusted publishing (#1317)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​testing-library/user-event since your current version.

Updates eslint from 10.9.1 to 10.10.0

Release notes

Sourced from eslint's releases.

v10.10.0

Features

• 264b434 feat: add d and v flags to no-unexpected-multiline (#21305) (Gihyeon Jeong / 정기현)
• c6cc6c5 feat: check Object.prototype property names in new-cap (#21269) (crimsonjay0)
• 5661fa6 feat: no-extra-bind false negatives with class fields and static blocks (#21260) (synthex-byte)

Bug Fixes

• bb47dc6 fix: update dependency file-entry-cache to v11 (#20801) (Milos Djermanovic)
• 427ac0a fix: use format strings in debug calls (#21247) (Francesco Trotta)
• 9d81532 fix: support __proto__ in /* exported */ comments (#21261) (sethamus)
• 87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282) (김채영)
• 8e2cb14 fix: new-cap false positive for UTC calls with properties: false (#21275) (Pixel)
• 9f4a364 fix: Ignore static imports in no-unreachable (#21276) (Taha Kotil)

Documentation

• 2417cad docs: Update README (GitHub Actions Bot)
• 9cecb8a docs: document \c control letter escapes in no-control-regex (#21286) (한국)
• 8724829 docs: update compat table links (#21263) (fnx)
• 5634542 docs: Clarify eqeqeq suggestion behavior (#21256) (Müslüm Yılmaz)

Chores

• b3d876b chore: disable npm audit in ecosystem tests (#21306) (Francesco Trotta)
• 1696682 ci: restore EMFILE test on Node.js 26 (#21297) (Marry (Subin Yang))
• 2c7f5d6 chore: update github/codeql-action action to v4.37.9 (#21296) (renovate[bot])
• 3c753f1 chore: update eslint (#21289) (renovate[bot])
• 1c73469 chore: update ecosystem plugins (#21280) (ESLint Bot)
• 08a02be test: add error locations to no-extra-boolean-cast (#21266) (lumir)
• 77bb1db chore: update github/codeql-action action to v4.37.8 (#21270) (renovate[bot])
• 007e81a ci: skip EMFILE test on Node.js 26 (#21265) (lumir)
• 0430280 chore: improve ecosystem tests compatibility on Windows (#21178) (crimsonjay0)

Commits

• 3f20a57 10.10.0
• f4e5284 Build: changelog update for 10.10.0
• bb47dc6 fix: update dependency file-entry-cache to v11 (#20801)
• 427ac0a fix: use format strings in debug calls (#21247)
• b3d876b chore: disable npm audit in ecosystem tests (#21306)
• 9d81532 fix: support __proto__ in /* exported */ comments (#21261)
• 264b434 feat: add d and v flags to no-unexpected-multiline (#21305)
• 1696682 ci: restore EMFILE test on Node.js 26 (#21297)
• 2c7f5d6 chore: update github/codeql-action action to v4.37.9 (#21296)
• 87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282)
• Additional commits viewable in compare view

Updates turbo from 2.10.7 to 2.10.12

Release notes

Sourced from turbo's releases.

Turborepo v2.10.12

What's Changed

Changelog

• chore: Release Turborepo 2.10.11 by @​github-actions[bot] in vercel/turborepo#13765
• feat: Refresh documentation social cards by @​christopherkindl in vercel/turborepo#13764
• fix: Preserve showcase logo sizes by @​christopherkindl in vercel/turborepo#13766
• fix: Refine mobile homepage interactions by @​christopherkindl in vercel/turborepo#13767
• fix: Align homepage KPIs to the right by @​christopherkindl in vercel/turborepo#13769
• fix: Prevent homepage KPI overflow by @​christopherkindl in vercel/turborepo#13770
• chore: Update Geistdocs to 1.20.4 by @​molebox in vercel/turborepo#13771
• perf: Skip unused Package Configuration stats by @​vercel-gh-bot-4[bot] in vercel/turborepo#13746
• chore: Update with-solid example by @​vercel-gh-bot-5[bot] in vercel/turborepo#13752
• chore: Update with-tailwind example by @​vercel-gh-bot-5[bot] in vercel/turborepo#13762
• perf: Stream dry-run JSON output by @​vercel-gh-bot-4[bot] in vercel/turborepo#13760
• chore: Update with-ultracite example by @​vercel-gh-bot-5[bot] in vercel/turborepo#13772
• perf: Merge same-prefix tree-wildcard globs into one directory walk by @​vercel-gh-bot-5[bot] in vercel/turborepo#13763
• chore: Update with-svelte example by @​floriansalihovic in vercel/turborepo#13118
• chore: Add unified agent control plane by @​anthonyshew in vercel/turborepo#13757
• fix: Remove incremental task caching by @​anthonyshew in vercel/turborepo#13773
• chore: Rename agents app to factory by @​anthonyshew in vercel/turborepo#13774
• chore: Update oxlint and oxfmt by @​charpeni in vercel/turborepo#13777
• feat: Add security.txt endpoint by @​charpeni in vercel/turborepo#13778
• feat: Redesign factory control plane by @​anthonyshew in vercel/turborepo#13775
• perf: Replace regex captures with hand-written parsers in berry lockfile identifiers by @​vercel-gh-bot-2[bot] in vercel/turborepo#13776
• chore: Upgrade the factory eve agent to 0.39.3 by @​anthonyshew in vercel/turborepo#13783
• chore: Update with-rsbuild-module-federation example by @​vercel-gh-bot-4[bot] in vercel/turborepo#13786
• perf: Index Berry lockfile resolution overrides by dependency name by @​vercel-gh-bot-5[bot] in vercel/turborepo#13787
• chore: Update remote cache action to v1.1.0 by @​anthonyshew in vercel/turborepo#13789
• docs: Fix reference links and validation by @​charpeni in vercel/turborepo#13784
• feat: Add SSH command affordance for factory sandboxes by @​anthonyshew in vercel/turborepo#13779
• fix: Show invalid affected task glob by @​anthonyshew in vercel/turborepo#13793
• perf: Skip unused repository indexing for package listings by @​vercel-gh-bot-4[bot] in vercel/turborepo#13792
• feat: Rebuild the factory image on every merge to main by @​anthonyshew in vercel/turborepo#13781
• chore: Add full-page terminal SSH sessions to Factory sandbox inventory by @​anthonyshew in vercel/turborepo#13780
• chore: Update with-shell-commands example by @​vercel-gh-bot-4[bot] in vercel/turborepo#13791
• chore: Allow SSH terminal for completed-run sandboxes in Factory by @​anthonyshew in vercel/turborepo#13782
• fix: Decouple graceful shutdown tests from the shell commands example by @​anthonyshew in vercel/turborepo#13799
• feat: Start ad-hoc factory work from the operator page by @​anthonyshew in vercel/turborepo#13798
• chore: Update with-solid example by @​vercel-gh-bot-4[bot] in vercel/turborepo#13797
• fix: Rebuild factory images without custom workflows by @​anthonyshew in vercel/turborepo#13801
• feat: Add factory navigation by @​anthonyshew in vercel/turborepo#13802
• refactor: Migrate Factory styles to Tailwind by @​anthonyshew in vercel/turborepo#13803
• feat: Add durable Factory workspaces by @​anthonyshew in vercel/turborepo#13804
• feat: Stream Factory sandbox as terminal by @​anthonyshew in vercel/turborepo#13807
• fix: Restore Factory workspace creation by @​anthonyshew in vercel/turborepo#13812
• fix: Update Factory session network policy by @​anthonyshew in vercel/turborepo#13814
• fix: Improve Factory terminal line spacing by @​anthonyshew in vercel/turborepo#13815
• fix: Install Factory publishing skill by @​anthonyshew in vercel/turborepo#13817

... (truncated)

Commits

• 53752d4 publish 2.10.12 to registry
• 9d2b03b fix: Run pnpm directly on Windows (#13843)
• c97782b feat: Require high confidence for issue fixes (#13842)
• f153cda chore: Alert Slack for low-confidence issues (#13841)
• e1674e4 chore: Add automatic issue handling (#13840)
• 7107f26 fix: Escape ampersands in RSS feed enclosure URLs (#13839)
• a76330b chore: Handle feedback on Factory pull requests (#13836)
• 3787c06 chore: Use geistdocs 1.23.1 (#13834)
• bbe5406 chore: Skip redundant Factory PR approval (#13837)
• 72805d7 fix: Move model selector to workspace creation (#13835)
• Additional commits viewable in compare view

Updates better-sqlite3 from 13.0.2 to 13.0.3

Release notes

Sourced from better-sqlite3's releases.

v13.0.3

What's Changed

• use Ubuntu 22.04-arm by @​neoxpert in WiseLibs/better-sqlite3#1510

Full Changelog: WiseLibs/better-sqlite3@v13.0.2...v13.0.3

Commits

• dbc2ea1 13.0.3
• b872585 use Ubuntu 22.04-arm (#1510)
• See full diff in compare view

Updates @better-auth/api-key from 1.7.0-rc.2 to 1.7.3

Release notes

Sourced from @​better-auth/api-key's releases.

v1.7.3

Upgrading from 1.7.0–1.7.2:

We restored the 1.6 account core schema to avoid requiring a disruptive backfill for existing users. We recognize the cost to users who already migrated and are committed to keeping the core schema stable throughout v1.

If you applied the 1.7 issuer schema, follow the upgrade guide for the required cleanup. No backfill is needed.

better-auth

Features

• Added Cloudflare as a built-in social provider with client-secret and PKCE support. (#9908)
• Enabled schema validation during initialization by default, including in production, and rejected authentication requests on detected mismatches. (#11178)
• Added isPasswordCompromised for checking passwords against Have I Been Pwned in custom server-side flows. (#11147)

Bug Fixes

• Aligned generated OpenAPI required fields with runtime validation. (#11066)
• Handled malformed custom-scheme callback URLs without excessive processing. (#11060)
• Improved Auth0 domain normalization to avoid slow trailing-slash processing. (#11188)
• Prevented generic OAuth discovery failures from taking down the authentication API. (#10978)
• Tracked email OTP sign-ins in the last login method plugin. (#10963)
• Fixed callback hooks being skipped after proxied OAuth sign-ins and preserved server state when callback cookies are unavailable. The legacy /oauth-proxy-callback endpoint is deprecated and will be removed in the next minor release. (#10988)
• Fixed getSession failures when cookie caching is disabled and cached session cookies remain. (#11120)
• Fixed TOTP re-enrollment replacing an active authenticator and its backup codes. (#11037)
• Prevented duplicate session requests and hydration mismatches in Nuxt useFetch. (#11084)
• Improved dynamic organization role permission check performance. (#11069)
• Added type-safe Nuxt useFetch integration for the Vue client's useSession hook. (#11085)
• Restored compatibility with 1.6 account schemas by identifying accounts with (providerId, accountId) instead of issuer. (#11153)

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added Cloudflare as a built-in social provider with client-secret and PKCE support. (#9908)
• Added initialization-time schema validation and actionable mismatch guidance for Drizzle and Prisma adapters. (#11179)
• Enabled schema validation during initialization by default, including in production, and rejected authentication requests on detected mismatches. (#11178)
• Added custom token endpoint authentication strategies for providers with non-standard request parameters. (#11101)

Bug Fixes

• Restored optional consumeOne and incrementOne methods for custom database adapters. (#11189)
• Fixed TikTok sign-in and token refresh with the documented clientKey and clientSecret options. (#11102)
• Improved request IP validation performance. (#11068)
• Improved PayPal authorization code and refresh token requests, including PKCE handling. (#11129)
• Improved Reddit token requests with OAuth-compliant Basic authentication and redirect protection. (#11134)
• Restored compatibility with 1.6 account schemas by identifying accounts with (providerId, accountId) instead of issuer. (#11153)

... (truncated)

Changelog

Sourced from @​better-auth/api-key's changelog.

1.7.3

1.7.2

1.7.1

1.7.0

1.7.0-rc.6

1.7.0-rc.5

1.7.0-rc.4

1.7.0-rc.3

Commits

• 597d39c chore: release v1.7.3 (#11032)
• c0444dc fix: align OpenAPI required fields with Zod 4.5 (#11066)
• ba12fcd chore: release v1.7.2 (#10870)
• 2344536 chore: release v1.7.1 (#10864)
• f577ec5 chore: exit pre-release mode for v1.7.0
• 69258d1 chore: sync main to next
• e84ec5e chore: release v1.6.30 (#10840)
• bc93b27 chore: release v1.7.0-rc.6 (#10772)
• 58c49eb chore: release v1.6.29 (#10809)
• 80799e6 chore: sync main to next
• Additional commits viewable in compare view

Updates @better-auth/electron from 1.7.0-rc.2 to 1.7.3

Release notes

Sourced from @​better-auth/electron's releases.

v1.7.3

Upgrading from 1.7.0–1.7.2:

We restored the 1.6 account core schema to avoid requiring a disruptive backfill for existing users. We recognize the cost to users who already migrated and are committed to keeping the core schema stable throughout v1.

If you applied the 1.7 issuer schema, follow the upgrade guide for the required cleanup. No backfill is needed.

better-auth

Features

• Added Cloudflare as a built-in social provider with client-secret and PKCE support. (#9908)
• Enabled schema validation during initialization by default, including in production, and rejected authentication requests on detected mismatches. (#11178)
• Added isPasswordCompromised for checking passwords against Have I Been Pwned in custom server-side flows. (#11147)

Bug Fixes

• Aligned generated OpenAPI required fields with runtime validation. (#11066)
• Handled malformed custom-scheme callback URLs without excessive processing. (#11060)
• Improved Auth0 domain normalization to avoid slow trailing-slash processing. (#11188)
• Prevented generic OAuth discovery failures from taking down the authentication API. (#10978)
• Tracked email OTP sign-ins in the last login method plugin. (#10963)
• Fixed callback hooks being skipped after proxied OAuth sign-ins and preserved server state when callback cookies are unavailable. The legacy /oauth-proxy-callback endpoint is deprecated and will be removed in the next minor release. (#10988)
• Fixed getSession failures when cookie caching is disabled and cached session cookies remain. (#11120)
• Fixed TOTP re-enrollment replacing an active authenticator and its backup codes. (#11037)
• Prevented duplicate session requests and hydration mismatches in Nuxt useFetch. (#11084)
• Improved dynamic organization role permission check performance. (#11069)
• Added type-safe Nuxt useFetch integration for the Vue client's useSession hook. (