Repository navigation
chore(deps): Bump better-auth from 1.6.28 to 1.7.2 - #7053
dependabot[bot] wants to merge 1 commit into
Conversation
✅ Console Performance Budget
The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it. 📦 Bundle Size Report
Size Limits
|
b4984cf to
a7d3738
Compare
❌ Console Performance Budget
The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it. Which half objected:
📦 Bundle Size Report
Size Limits
|
Dependabot merge gate: NOT merged (
|
|
Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting |
9 similar comments
|
Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting |
|
Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting |
|
Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting |
|
Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting |
|
Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting |
|
Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting |
|
Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting |
|
Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting |
|
Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting |
a7d3738 to
d2f9ca6
Compare
❌ Console Performance Budget
The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it. Which half objected:
📦 Bundle Size Report
Size Limits
|
Dependabot merge gate: NOT merged (
|
d2f9ca6 to
07aafee
Compare
❌ Console Performance Budget
The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it. Which half objected:
📦 Bundle Size Report
Size Limits
|
Dependabot merge gate: NOT merged (
|
07aafee to
882dfc9
Compare
❌ Console Performance Budget
The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it. Which half objected:
📦 Bundle Size Report
Size Limits
|
Dependabot merge gate: NOT merged (
|
882dfc9 to
6b27a98
Compare
❌ Console Performance Budget
The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it. Which half objected:
📦 Bundle Size Report
Size Limits
|
Dependabot merge gate: NOT merged (
|
16bf48f to
83118b6
Compare
❌ Console Performance Budget
The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it. Which half objected:
📦 Bundle Size Report
Size Limits
|
Dependabot merge gate: NOT merged (
|
83118b6 to
46d6a66
Compare
Bumps [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) from 1.6.28 to 1.7.2. - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/better-auth) --- updated-dependencies: - dependency-name: better-auth dependency-version: 1.7.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
46d6a66 to
98b84d4
Compare
❌ Console Performance Budget
The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it. Which half objected:
📦 Bundle Size Report
Size Limits
|
Dependabot merge gate: NOT merged (
|
Diagnosis: the 1.7 MB is not better-auth's bytes — it is a duplicated
|
| chunk | base 9de7758d |
head 83118b6e |
delta |
|---|---|---|---|
vendor-objectstack |
1206.2 | 2944.3 | +1738.1 |
infrastructure |
29.3 | 29.4 | +0.1 |
i18n-locales |
441.6 | 441.6 | 0.0 |
ui-components |
383.8 | 383.8 | 0.0 |
vendor-markdown |
162.0 | 162.0 | 0.0 |
plugin-chatbot |
161.1 | 161.1 | 0.0 |
framework |
68.6 | 68.6 | 0.0 |
| the other 43 eager chunks | unchanged | unchanged | 0.0 |
| total eager closure | 3472.2 | 5210.3 | +1738.1 |
No chunk appeared and none disappeared — 50 eager chunks on both sides. Every chunk
except vendor-objectstack is byte-identical. The aggregate overage (1697.6 KB) and the
vendor-objectstack overage (1719.7 KB) are the same regression counted twice.
Traced cause
The bump itself is innocent. Comparing the installed manifests:
| 1.6.28 (base) | 1.7.2 (head) | |
|---|---|---|
dependencies.zod |
^4.3.6 |
^4.3.6 (unchanged) |
sideEffects |
false |
false (unchanged) |
exports entries |
56 | 54 |
No tightened zod range, no sideEffects change, no client entry that newly pulls server
code. What changed is the lockfile dependabot regenerated:
base 9de7758d |
head 83118b6e |
|
|---|---|---|
@objectstack/spec resolved |
17.3.0 only |
17.2.0 and 17.3.0 |
@objectstack/client, core, formula, lint, sdui-parser |
17.3.0 |
downgraded to 17.2.0 |
physical @objectstack/* copies in the store |
7 | 11 |
zod copies |
4.4.3 only |
4.4.3 and 4.5.4 |
apps/console, apps/site and packages/core all declare @objectstack/client: ^17.0.0,
and this lockfile resolves them to 17.2.0 while spec stays at 17.3.0 — even though
the registry latest for every one of these packages is 17.3.0. No package requires
17.2.0; nothing in the graph asks for it. The console therefore bundles both trees, and
that is the whole +1738.1 KB.
Direct evidence from the built chunk: raw size 4,030,557 → 9,620,107 bytes (2.39x), and
occurrences of the string @objectstack go 758 → 1747 (2.3x).
Proof that better-auth costs zero bytes
Same source at head 83118b6e, same better-auth 1.7.2, with the lockfile regenerated
so the workspace resolves onto a single @objectstack 17.3.0 tree:
Console eager closure is 3472.2 KB gzipped across 50 of 518 chunks
(budget: 3512.7 KB, headroom: 40.5 KB)
vendor-objectstack 1206.2 KB / 1224.6 KB ceiling (headroom 18.4 KB)
3472.2 KB — byte-identical to base, green, with headroom. The bump adds nothing.
Test (shard 3/4)
The failure is scripts/__tests__/ci-cd-pipeline-doc.test.ts at line 1394,
"resolves exactly one @objectstack/spec version to compare against":
AssertionError: The lockfile resolves more than one `@objectstack/spec` version:
- 17.2.0
- 17.3.0
expected [ '17.2.0', '17.3.0' ] to have a length of 1 but got 2
Classification: neither a better-auth 1.7 behaviour change nor a test pinning an
implementation detail. It is a lockfile-integrity guard correctly reporting the same
duplication the bundle gate measured — one cause, two red checks. Run from the repo root:
1 failed / 45 passed at this head; 46/46 passed on the regenerated lockfile.
The previous seat's experiments, measured
| experiment | what it did | measured effect |
|---|---|---|
-dedupe |
zod ^4.4.3 → ^4.5.4 across 8 package manifests |
void as left on disk — it had installed better-auth 1.7.3, not 1.7.2, so it never measured this PR. Re-running pnpm dedupe at this head made it worse: 16 @objectstack copies. |
-fix |
bump only, lockfile regenerated with no pin | still dirty — spec 17.2.0 + 17.3.0 again. A plain re-lock does not fix it. |
-fix2 |
root pnpm.overrides pinning better-auth: 1.7.2, then re-lock |
this is the one that works — single 17.3.0 tree, single zod, closure 3472.2 KB green, test 46/46. |
A caveat worth recording: resolution here is not reproducible. Re-locking main unchanged
floats ^1.6.28 up to better-auth 1.7.3 and produces two zod copies; re-locking this
head without an exact pin produces the 17.2.0 split. The floating ^17.0.0 ranges plus a
floating better-auth mean any lockfile regeneration can land somewhere different.
Verdict
(a) A bounded change makes the bump landable, and it is lockfile-only — but it cannot be
applied here.
The required change is to regenerate this PR's lockfile so the workspace resolves onto a
single @objectstack 17.3.0 tree (in the measurement above, an exact better-auth: 1.7.2
override was what made the re-lock settle there). Measured result: 3472.2 KB, green,
byte-identical to base, and Test (shard 3/4) green.
That change belongs on this branch, and this branch is dependabot's — it is not mine to
push to, and dependabot would overwrite it on its next rebase. So this PR cannot be
merged as it stands, and the fix must land as a PR that pairs the bump with the lockfile
pin. A follow-up card will be filed for that.
The bundle budget was not raised, and must not be: the payload it is refusing is real
duplicated bytes, not growth that the bump bought.
Generated by Claude Code
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
|
Superseded by #8332, which merged to Why it was superseded rather than pushed to. The correction is lockfile-only, and dependabot rewrites What was wrong here, for the record. better-auth 1.7.2 adds zero bytes. The What #8332 shipped instead. The identical manifest edit ( One follow-up came out of it and is filed as #8333: a from-scratch float of Generated by Claude Code |
Bumps better-auth from 1.6.28 to 1.7.2.
Release notes
Sourced from better-auth's releases.
... (truncated)
Changelog
Sourced from better-auth's changelog.
... (truncated)
Commits
ba12fcdchore: release v1.7.2 (#10870)79904f0fix(origin-check): support fragments in relative redirect URLs (#10983)c8dcfa5fix(origin-check): validate null origins using fetch metadata (#10959)e1d4011fix(logger): respect configured logger in auth request context (#10939)557e19brefactor(context): clarify auth endpoint context access (#10938)b4ad5a1refactor: centralize placeholder email generation (#10982)fced1a5fix(origin-check): improve relative callback URL validation (#10979)f6891a2fix(origin-check): allow tilde in relative callback URLs (#10041)ce8a3abfix(admin): ban without a duration should clear the previous expiration (#10823)a021eaffix(client): a client with more plugins fits a narrower client type again (#1...