[santoshkumarradha]

Summary

Monday’s scheduled security run on main (6d15d0f) failed pnpm audit --audit-level=high --prod on three better-auth advisories. 1.6 has no backport; the patch floor is 1.7.7. This PR upgrades dashboard and customer-app to 1.7.15 and completes the 1.7 client migration that Dependabot was previously blocked on.

Advisories:

• GHSA-965c-763c-88jm (critical): OAuth state can be used as a Magic Link to sign in as another user
• GHSA-r4xp-prcw-77qf (high): OAuth Proxy lets an attacker sign in as another user
• GHSA-q84f-53jg-9ppm (high): Device login approval does not show the requesting client or permissions

Changes

• Pin better-auth to 1.7.15 in both apps and pnpm.overrides
• Replace signIn.oauth2({ providerId }) with signIn.social({ provider }) and drop genericOAuthClient()
• Remove issuer / requireIssuerValidation from generic OAuth config (1.7 validates via discovery)
• Rewrite /api/auth/oauth2/callback/:id → /api/auth/callback/:id so already-registered IdP URIs still land
• Document the new callback URIs; lift the Dependabot ignore from >=1.7.0 to >=1.8.0

The core user / session / account / verification schema is unchanged on 1.7.3+ (we never ran 1.7.0–1.7.2), so no runtime SQL migration is required.

Test plan

• pnpm audit --audit-level=high --prod is clean (7 low/moderate only)
• tsc --noEmit passes in dashboard and customer-app
• CI green on this branch
• After merge, operators who already registered /api/auth/oauth2/callback/enterprise-sso should also add /api/auth/callback/enterprise-sso — 1.7 sends the new redirect_uri on the authorize request

Notes for reviewers

This is a fix(security): commit so the next release includes the patched apps. Email/password and magic-link flows are unchanged; SSO is the only client API change.

  

[AbirAbbas]

Heads-up: I merged the dependabot js-workspace bump (#243), which also touched pnpm-lock.yaml (it moved the root next override to 16.4.3), so this branch now conflicts in the lockfile only. The package.json files merge cleanly.

Merging main, taking main's lockfile and re-running pnpm install --lockfile-only with pnpm 9.15.0 resolves it. I tried that locally: better-auth 1.7.15 + next 16.4.3, frozen install OK, both apps build, and pnpm audit --audit-level=high --prod is clean. I didn't push it here since your agent is still updating this branch.