build(deps): bump next-auth from 5.0.0-beta.30 to 5.0.0-beta.32

[dependabot]

Bumps next-auth from 5.0.0-beta.30 to 5.0.0-beta.32.

Release notes

Sourced from next-auth's releases.

next-auth@5.0.0-beta.32

Beta release for the v5 line.

Picks up the @​auth/core@​0.41.3 security fixes (malformed Bearer token handling in getToken, provider-bound OAuth check cookies, and NFKC email normalization).

Fixes auth checks failing open on provider configuration errors: a non-OK session response now yields no session instead of an error object, so checks like !!auth fail closed.

next-auth@5.0.0-beta.31

Bugfixes (via @​auth/core@​0.41.2)

• providers: add issuer to GitHub provider for RFC 9207 compliance (#13410).
  • Supports both github.com and GitHub Enterprise Server (dynamic ${baseUrl}/login/oauth).
• signin/send-token: stricter email address validation (rejects quoted, multi-@, and empty-domain inputs).

Dependency bump

• @auth/core: 0.41.0 → 0.41.2. Resolves a peer-dep inconsistency in 5.0.0-beta.30 where next-auth declared nodemailer: ^7.0.7 while pinning @auth/core@0.41.0 (which wanted ^6.8.0). Both now align at ^7.0.7.

No changes to next-auth's own source.

Commits

• e293b37 chore(release): next-auth@5.0.0-beta.32 [skip ci]
• b690d91 chore: add npm bugs metadata and fix repository field format (#13452)
• 5af7357 chore(release): bump package version(s) [skip ci]
• 8a933f9 fix(core): document that getToken returns null for malformed authorization he...
• 5b1aa47 chore(ci): pin surrealdb test server to the v2 image for the 1.3 client (#13468)
• 1116034 Chore/nodemailer 8 peer deps (#13434)
• 7b35fc3 fix(docs): repair docs build broken by floating TypeScript resolution (#13450)
• b24abfa fix(proxy): override Vercel build command so it doesn't run turbo (#13448)
• a99514b chore(deps): resolve remaining Dependabot alerts via cross-major dependency u...
• d008b9b Merge commit from fork
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by better-gustavo, a new releaser for next-auth since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Summary by cubic

Upgrade next-auth to 5.0.0-beta.32 to pull in security fixes and stricter auth behavior. No code changes; only yarn.lock updated.

• Bug Fixes

  • Hardened auth: malformed Bearer tokens return null in getToken, provider-bound OAuth cookies, and NFKC email normalization.
  • GitHub provider adds issuer (RFC 9207) and stricter email validation for magic links.
  • Auth checks now fail closed on provider config errors (non-OK session returns no session).

• Dependencies

  • next-auth → 5.0.0-beta.32 (pulls @auth/core@0.41.3).
  • Aligns nodemailer peer dependency to ^7.0.7.

^{Written for commit a962ed5. Summary will update on new commits.}

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[socket-security]

Dependency limit exceeded — report not shown.

This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report.

Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard.

Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}