security: bump drizzle-orm and better-auth to patch CVEs#3560
Conversation
- drizzle-orm 0.45.1 → 0.45.2 (GHSA-gpj5-g38j-94v9 / CVE-2026-39356) - better-auth family 1.5.6 → 1.6.5 (GHSA-xr8f-h2gw-9xh6)
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (12)
📝 WalkthroughWalkthroughUpdates dependency versions across the monorepo: Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Greptile SummaryThis PR is a security-motivated dependency bump with no code changes — only
Key observations:
Confidence Score: 5/5Safe to merge — pure lockfile-only security patch with consistent version bumps across all workspaces, validated by typecheck, lint, and test suite. All changes are mechanical version bumps with no code modifications. Version alignment is consistent across all 13 files and the lockfile. Transitive dependency graph in bun.lock is coherent (no orphaned old versions, peer deps satisfied). The PR author verified bun run typecheck (25/25 pass), bun run lint (clean), and bun test (pre-existing failures only, none related to these packages). No files require special attention — all changes are straightforward version bumps. The follow-up to revisit allowUnauthenticatedClientRegistration in packages/auth/src/server.ts is appropriately deferred.
|
| Filename | Overview |
|---|---|
| packages/auth/package.json | All four @better-auth/* plugins and better-auth core bumped 1.5.6 → 1.6.5; drizzle-orm bumped 0.45.1 → 0.45.2. This is the central auth package — highest value security upgrade in the PR. |
| apps/api/package.json | Bumps @better-auth/oauth-provider, better-auth, and drizzle-orm — the API surface most directly impacted by the CVEs patched in this PR. |
| bun.lock | Lockfile regenerated consistently; all transitive @better-auth/* and drizzle-orm hashes/checksums updated to match new versions with no orphaned old entries detected. |
| apps/desktop/package.json | Bumps @better-auth/api-key, @better-auth/stripe, better-auth, and drizzle-orm — straightforward version alignment with rest of workspace. |
| apps/admin/package.json | Bumps better-auth and drizzle-orm — clean, consistent with other workspaces. |
| apps/web/package.json | Bumps better-auth only (no drizzle dependency in this workspace) — correct scoping. |
| apps/mobile/package.json | Bumps @better-auth/expo and better-auth — consistent with rest of the family upgrade. |
| apps/electric-proxy/package.json | Bumps drizzle-orm only — one of the two call-site packages for identifier construction mentioned in the CVE analysis. |
| packages/db/package.json | Bumps drizzle-orm 0.45.1 → 0.45.2 — clean, consistent change. |
| packages/host-service/package.json | Bumps drizzle-orm 0.45.1 → 0.45.2 — clean, consistent change. |
| packages/local-db/package.json | Bumps drizzle-orm 0.45.1 → 0.45.2 — clean, consistent change. |
| packages/mcp/package.json | Bumps drizzle-orm 0.45.1 → 0.45.2 — clean, consistent change. |
| packages/trpc/package.json | Bumps drizzle-orm 0.45.1 → 0.45.2 — clean, consistent change. |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart TD
subgraph CVE1["CVE-2026-39356 — drizzle-orm SQL injection"]
D1["drizzle-orm 0.45.1 - escapeName improperly escaped identifiers"]
D2["drizzle-orm 0.45.2 - identifiers properly escaped"]
D1 -->|bump| D2
end
subgraph CVE2["GHSA-xr8f-h2gw-9xh6 — better-auth unprivileged client reg"]
B1["better-auth 1.5.6 - clientPrivileges bypass in oauth-provider"]
B2["better-auth 1.6.5 - authorization callback enforced"]
B1 -->|bump| B2
end
subgraph Drizzle["drizzle-orm consumers — 10 workspaces"]
W1[apps/admin] & W2[apps/api] & W3[apps/desktop] & W4[apps/electric-proxy]
W7[packages/auth] & W8[packages/db] & W9[packages/host-service]
W10[packages/local-db] & W11[packages/mcp] & W12[packages/trpc]
end
subgraph BetterAuth["better-auth consumers — 6 workspaces"]
BA1[apps/admin] & BA2[apps/api] & BA3[apps/desktop]
BA5[apps/mobile] & BA6[apps/web] & BA7[packages/auth]
end
D2 --> Drizzle
B2 --> BetterAuth
Reviews (1): Last reviewed commit: "security: bump drizzle-orm and better-au..." | Re-trigger Greptile
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
🧹 Preview Cleanup CompleteThe following preview resources have been cleaned up:
Thank you for your contribution! 🎉 |
1 participant
Summary
drizzle-orm0.45.1 → 0.45.2across 10 workspaces (patches GHSA-gpj5-g38j-94v9 / CVE-2026-39356).better-auth+@better-auth/{api-key,expo,oauth-provider,stripe}1.5.6 → 1.6.5across 6 workspaces (patches GHSA-xr8f-h2gw-9xh6).Why / Context
Two Dependabot high-severity advisories on
main:1. Drizzle ORM — SQL injection via improperly escaped identifiers (GHSA-gpj5-g38j-94v9)
Dialect-specific
escapeName()did not double embedded"/`in identifiers, so untrusted input reachingsql.identifier()or.as()could break out of identifier quoting.apps/api/src/app/api/electric/[...path]/utils.tsandapps/electric-proxy/src/where.ts, and they passcolumn.namefrom static schema objects (tasks.organizationId,organizations.id, …) — no untrusted input flows to identifier construction today. So this was not directly exploitable, but upgrading is cheap defense-in-depth.2. @better-auth/oauth-provider — unprivileged client registration (GHSA-xr8f-h2gw-9xh6)
Client-creation endpoints did not invoke the authorization callback, so
clientPrivilegesrestrictions could be bypassed by any authenticated user.packages/auth/src/server.tsand exposed via.well-known/oauth-authorization-server+.well-known/openid-configuration. Current config setsallowDynamicClientRegistration: trueandallowUnauthenticatedClientRegistration: true, so the CVE is not the immediate concern — but upgrading unblocks future use ofclientPrivileges. (Revisiting those flags tracked as a follow-up.)How It Works
Pure version bumps in
package.jsonfiles + regeneratedbun.lock. All better-auth packages were moved together (1.5.6 → 1.6.5) to keep the family version-aligned and avoid peer-dep drift. Alldrizzle-ormconsumers are pinned to the same version (0.45.2) across the workspace.Manual QA Checklist
Manual QA was not performed for this PR — it is a lockfile-only dependency bump with no code changes, and the behavior surface (drizzle queries, better-auth sessions) is covered by typecheck and the existing test suite. Reviewers should flag if any runtime smoke test is expected before merge.
Testing
bun install— clean resolve, 32 packages installedbun run typecheck— ✅ 25/25 packages passbun run lint— ✅ 3538 files, no issuesbun test— 2657 pass, 3 fail (verified pre-existing on baseline by stashing these changes and rerunning the same tests; failures are inbuildForkAgentLaunch.test.ts(tRPC localhost connection refused),useOrderedSections.test.tsx(renderer client init ordering), andsetup.test.ts(config-parsing noise) — none referencebetter-authordrizzle-orm)Follow-ups
allowUnauthenticatedClientRegistration: trueinpackages/auth/src/server.ts:204— currently anyone can register OAuth clients via Dynamic Client Registration. Out of scope for this security patch; tracked separately.Risks / Rollout / Rollback
package.jsonfiles andbun.lock, so a revert +bun installfully restores prior state.Summary by cubic
Upgraded
drizzle-ormto 0.45.2 and thebetter-authpackage family to 1.6.5 across the monorepo to patch high‑severity CVEs. Dependency version bumps only; no app code changes.drizzle-orm: 0.45.1 → 0.45.2 — patches GHSA-gpj5-g38j-94v9 / CVE-2026-39356 (identifier escaping).better-authand@better-auth/{api-key,expo,oauth-provider,stripe}: 1.5.6 → 1.6.5 — patches GHSA-xr8f-h2gw-9xh6.Written for commit 4f1aa4c. Summary will update on new commits.
Summary by CodeRabbit
Chores