fix(security): pin sanitizer and MCP audience

urjitc · urjitc · commit 99e2e7f73a5c · 2026-07-16T16:08:01.000-04:00
Force the patched DOMPurify release across transitive consumers.
Document the single-audience constraint mitigating Better Auth 1.6 resource widening.
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
@@ -9,6 +9,7 @@ trustPolicyExclude:
   - semver@6.3.1
 
 overrides:
+  dompurify: 3.4.11
   vite: npm:@voidzero-dev/vite-plus-core@0.2.2
   vitest: 4.1.9
 
diff --git a/src/lib/auth.server.ts b/src/lib/auth.server.ts
@@ -233,6 +233,8 @@ function createAuth(database: Db, env: AuthRuntimeEnv) {
 				loginPage: "/login",
 				scopes: [...mcpOAuthScopes],
 				silenceWarnings: { oauthAuthServerConfig: true },
+				// Keep this to one audience while Better Auth 1.6.x is in use. Its
+				// resource indicator is not bound to the original authorization grant.
 				validAudiences: [mcpResource],
 			}),
 			tanstackStartCookies(),
