fix(agentex-ui): bump next-auth 5.0.0-beta.31 -> 5.0.0-beta.32 (4 CVEs)

[scale-prodsec]

Summary

Bumps next-auth 5.0.0-beta.31 → 5.0.0-beta.32 in agentex-ui, which transitively pulls the fixed @auth/core 0.41.2 → 0.41.3 (declared exactly by beta.32). One direct-dependency bump clears every Auth.js advisory in this batch — no overrides/resolutions needed.

The app uses the Auth.js v5 API (NextAuth/NextAuthConfig in auth.ts, getToken from next-auth/jwt), so the fix stays on the 5.x beta line rather than downgrading to the 4.24.15 branch.

CVEs resolved (4 unique)

Advisory	Severity	Description
GHSA-7rqj-j65f-68wh	CRITICAL	Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass (affects @auth/core and next-auth)
GHSA-8fpg-xm3f-6cx3	CRITICAL	Configuration errors can cause existence-based auth checks to fail open (next-auth)
GHSA-xmf8-cvqr-rfgj	HIGH	getToken() throws an uncaught exception on malformed Bearer authorization headers
GHSA-x445-f3h2-j279	MEDIUM	OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them

Changed files

• agentex-ui/package.json — raised the declared floor next-auth: ^5.0.0-beta.29 → ^5.0.0-beta.32 so a future re-lock cannot reselect the vulnerable version.
• agentex-ui/package-lock.json — re-locked: next-auth → 5.0.0-beta.32, @auth/core → 0.41.3. Registry URLs remain public npm; lockfileVersion unchanged.

Verification

• Version gate (OSV): [email protected] and @auth/[email protected] both report zero known advisories.
• Diff scope: only the two dependency blocks + the root constraint changed; no unrelated lock churn, no mode/format changes.
• npm ci (the CI immutable-install gate) succeeds — lockfile is deterministic and in sync with package.json.
• tsc --noEmit (npm run typecheck) passes clean — the beta.31→beta.32 patch bump introduces no API breakage in the app's NextAuth v5 usage.
• Confirmed the old vulnerable tarballs (core-0.41.2.tgz, next-auth-5.0.0-beta.31.tgz) are gone from the lockfile.

Linear

Resolves GFDVR-20810 (@auth/core) and GFDVR-20811 (next-auth).

Greptile Summary

This PR bumps next-auth from 5.0.0-beta.31 to 5.0.0-beta.32 (which pins @auth/core to 0.41.3) to resolve four Auth.js advisories — two CRITICAL, one HIGH, one MEDIUM. The diff is minimal and scoped exactly to the two dependency files.

• package.json: version floor raised from ^5.0.0-beta.29 → ^5.0.0-beta.32, preventing future re-lock from pulling in the vulnerable range.
• package-lock.json: next-auth and @auth/core versions/integrity hashes updated; nodemailer peer dep range widened to ^7.0.7 || ^8.0.5 (upstream change in beta.32, no app-level impact).

Confidence Score: 5/5

Safe to merge — the change is a minimal, targeted dependency patch with no app code touched.

Both files change only the two expected packages (next-auth, @auth/core) and their integrity hashes. The version floor in package.json is correctly raised so future installs cannot regress. The only non-version change in the lockfile (widened nodemailer peer dep range) is upstream metadata from beta.32 and has no runtime effect on the app. No unrelated lock churn, no API surface changes, no code logic altered.

No files require special attention.

Important Files Changed

Filename	Overview
agentex-ui/package.json	Raises next-auth version floor to ^5.0.0-beta.32, preventing any future npm install from resolving the vulnerable beta.29–beta.31 range.
agentex-ui/package-lock.json	Re-locks [email protected] and @auth/[email protected] with updated integrity hashes; also widens the nodemailer peer dependency range in both packages — no unrelated churn detected.

Sequence Diagram

sequenceDiagram
    participant Client
    participant NextAuth as [email protected]
    participant Core as @auth/[email protected]
    participant Provider as OAuth Provider

    Client->>NextAuth: Auth request (login / getToken)
    Note over NextAuth,Core: GHSA-xmf8: malformed Bearer no longer throws uncaught exception
    NextAuth->>Core: "Delegate to @auth/core"
    Note over Core: GHSA-7rqj: Unicode normalization applied BEFORE email validation
    Core->>Provider: OAuth flow (state/nonce/PKCE)
    Note over Core,Provider: GHSA-x445: cookies now bound to originating provider
    Provider-->>Core: Callback
    Note over Core: GHSA-8fpg: existence-based auth checks no longer fail open
    Core-->>NextAuth: Verified session/token
    NextAuth-->>Client: Auth response

Loading

_{Reviews (1): Last reviewed commit: "fix(agentex-ui): bump next-auth 5.0.0-be..." | Re-trigger Greptile}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​next-auth@​5.0.0-beta.31 ⏵ 5.0.0-beta.32		+75

View full report