chore(deps): bump next-auth from 5.0.0-beta.25 to 5.0.0-beta.32

[dependabot]

Bumps next-auth from 5.0.0-beta.25 to 5.0.0-beta.32.

Release notes

Sourced from next-auth's releases.

next-auth@5.0.0-beta.32

Beta release for the v5 line.

Picks up the @​auth/core@​0.41.3 security fixes (malformed Bearer token handling in getToken, provider-bound OAuth check cookies, and NFKC email normalization).

Fixes auth checks failing open on provider configuration errors: a non-OK session response now yields no session instead of an error object, so checks like !!auth fail closed.

next-auth@5.0.0-beta.31

Bugfixes (via @​auth/core@​0.41.2)

• providers: add issuer to GitHub provider for RFC 9207 compliance (#13410).
  • Supports both github.com and GitHub Enterprise Server (dynamic ${baseUrl}/login/oauth).
• signin/send-token: stricter email address validation (rejects quoted, multi-@, and empty-domain inputs).

Dependency bump

• @auth/core: 0.41.0 → 0.41.2. Resolves a peer-dep inconsistency in 5.0.0-beta.30 where next-auth declared nodemailer: ^7.0.7 while pinning @auth/core@0.41.0 (which wanted ^6.8.0). Both now align at ^7.0.7.

No changes to next-auth's own source.

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by better-gustavo, a new releaser for next-auth since your current version.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
drawxyz	Ready	Preview	Aug 17, 2026 8:38pm