fix(deps): bump better-auth, kysely, and drizzle-orm for disclosed CVEs

[Svector-anu]

Automated dependency bump to address disclosed CVEs.

• CVE/Advisory: GHSA-qq9h-g4jm-xgf3 (better-auth pre-account hijacking via magic-link / email-OTP)
• Severity: high
• Package: better-auth 1.6.15 → 1.6.30 (specifier ^1.6.22)
• Also:
  • kysely → 0.28.17 — GHSA-8cpq-38p9-67gx, GHSA-wmrf-hv6w-mr66, GHSA-pv5w-4p9q-p3v2
  • drizzle-orm → 0.45.2 — GHSA-gpj5-g38j-94v9 (also required peer of better-auth ≥ 1.6.22)

Detected by osv-scanner. No code changes outside the lockfile/manifests.

Notes

www enables the better-auth magicLink plugin. The GHSA's full exploit path also needs open email/password registration; that path does not appear enabled in www/src/lib/auth.ts today. Bumping still removes the vulnerable range from the lockfile and satisfies the patched peer chain.

Verification

• Reproduced locally: yes (lockfile versions)
• Command: osv-scanner scan source --recursive --no-ignore --format=json . then inspected unique HIGH/CRITICAL package hits; confirmed www importer pinned better-auth@1.6.15 / drizzle-orm@0.44.7 and packages/corsair pinned kysely@0.28.9
• Before: vulnerable versions present in pnpm-lock.yaml importers
• After: better-auth@1.6.30, drizzle-orm@0.45.2, kysely@0.28.17 resolved for the bumped importers; pnpm typecheck passed on the branch
• Environment: osv-scanner 2.5.1, pnpm 10.20.0

Summary by CodeRabbit

• Chores
  • Updated underlying data access and authentication components to newer versions.
  • Incorporated the latest improvements and fixes from supporting platform components.
  • No user-facing features or public API changes were introduced.

[vercel]

@github-actions[bot] is attempting to deploy a commit to the corsair Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 59281b54-f412-475b-b789-c7e153debcfa

📥 Commits

Reviewing files that changed from the base of the PR and between 426c033 and e7e1e74.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (3)

• packages/corsair/package.json
• packages/studio/package.json
• www/package.json

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request updates dependency version ranges in the Corsair, Studio, and website package manifests.

Changes

Dependency version updates

Layer / File(s)	Summary
Update package dependency ranges packages/corsair/package.json, packages/studio/package.json, www/package.json	Kysely, better-auth, and drizzle-orm now use newer version ranges.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: ⚪ Minimal · up to e7e1e

This PR updates dependency versions and the lockfile without changing application code; no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: devjain32

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the dependency updates and states their security purpose. It matches the main changes described in the pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

The PR updates dependency ranges to patched releases addressing disclosed vulnerabilities, without changing application code.

• Updates Kysely to 0.28.17 in the Corsair and Studio packages.
• Updates better-auth to the patched 1.6.x line and Drizzle ORM to its required compatible peer version in the web application.

Confidence Score: 5/5

The PR appears safe to merge because the reviewed manifest updates align the affected dependencies without a concrete compatibility regression.

The existing authentication schema satisfies the upgraded better-auth adapter’s core requirements, better-auth and Drizzle ORM resolve to compatible versions, and the Kysely consumers remain aligned.

Important Files Changed

Filename	Overview
packages/corsair/package.json	Updates Kysely to 0.28.17; no incompatible use of the package’s public database surface was established.
packages/studio/package.json	Aligns Studio’s Kysely dependency with Corsair at 0.28.17 without introducing a demonstrated cross-version boundary.
www/package.json	Updates better-auth and Drizzle ORM to mutually compatible patched versions; the existing authentication schema and API usage remain compatible.

_{Reviews (1): Last reviewed commit: "fix(deps): bump better-auth, kysely, and..." | Re-trigger Greptile}