Elysia 1.4.31 Patches 28 Advisories, Better Auth 1.7.18: Dev Stack Release Audit, November 8, 2026

Today's audit covers the stack from official release pages and the npm and PyPI registries. The big items are a 28-advisory security release for Elysia and a Better Auth patch that closes a session revocation race. Hono 4.13.17, NestJS 12.4.0 and Tailwind 4.3.5 were covered in yesterday's audit, so I skip them here.

Executive Summary

• Elysia 1.4.31 is a security-only release that bundles 28 advisories: multipart parsing limits, signed-cookie verification, WebSocket validation and route authorization. Upgrade any Bun service that uses it. Release notes.
• Better Auth 1.7.18 fixes "revoke all sessions" so sessions created during revocation are also revoked when you use secondaryStorage with storeSessionInDatabase. Release notes.
• Better Auth 1.8.0-beta.6 is a breaking pre-release: repeated standard parameters on /oauth2/authorize now return invalid_request. Release notes.
• FastAPI 0.162.1 and 0.162.2 are docs, skill and dependency releases. The 0.162.0 boolean form-field breaking change from 23 October is still worth checking. 0.162.0 notes.
• BullMQ 6.7.1 and 6.7.2 carry dependency security hardening, and 6.7.0 added a way to count delayed jobs before a timestamp. Releases.
• Vue 3.5.45 is the latest stable release. The release body defers to the changelog. Release.
• Next.js only shipped canaries (16.5.0-canary.44) today, so there is no stable release to act on. Registry.

Elysia 1.4.31: 28 security advisories in one release

This release has no features. The notes group the fixes by area:

• Multipart request handling, file validation and parsing limits, including bounds on array parsing and total parsing work.
• Route compilation, encoded path routing, handler and schema compilation, and request validation.
• Authorization: route-level checks, and authorization is now preserved across plugins.
• Signed-cookie decoding and verification.
• Stricter incoming and outgoing WebSocket validation.
• Bounded validation-error handling and stream fan-out.
• The contents of the published package are now restricted.

I don't have per-advisory CVE IDs from the release page, so check the GitHub advisories for elysiajs/elysia before triaging. The upgrade is a one-liner:

bun update [email protected]
bun pm ls elysia

Elysia 2 is in release-candidate stage (2.0.0-rc.3 is on the npm registry). Stay on the 1.4.x line for production until 2.0 is stable. The Elysia 2 announcement covers the direction.

Better Auth 1.7.18 and the 1.7.16 security sweep

If you skipped 1.7.16 and 1.7.17, the 1.7.x line has been a security run:

• v1.7.16 fixed a long list, including revoked sessions staying usable with secondary storage, OAuth email_verified string values treated as verified, and passkey userVerification: "required" not being enforced.
• v1.7.17 rejected revoked sessions during device authorization and tightened IP wildcard trusted origins.
• v1.7.18 makes "revoke all sessions" also cover sessions created while the revocation runs (#12259).

Two upgrade notes from 1.7.16 can break existing code. /admin/update-user now needs the user:set-phone permission, so custom access-control statements need set-phone added. Server code that sets stripeCustomerId must write it through the database adapter instead of auth.api.updateUser.

import { createAccessControl } from "better-auth/plugins/access";

// 1.7.16+: add set-phone to custom admin statements
const statement = {
  user: ["create", "list", "set-role", "set-phone", "ban", "delete"],
} as const;

export const ac = createAccessControl(statement);

Check the exact statement list against your own admin plugin config. That snippet only shows where set-phone goes.

If you test with getTestInstance and testWith: "mysql", 1.7.18 needs a MySQL server at 127.0.0.1:3306 with root password root_password.

1.8.0-beta.6 is breaking for OAuth provider users. Form-encoded POSTs to /oauth2/authorize now follow the GET rules. Sending a standard parameter such as state twice returns invalid_request, where before the last value won and a code could be issued. Clients that send each parameter once are unaffected. The same beta lets a client's token exchange be bound to its DPoP key (#12262).

FastAPI 0.162.1 and 0.162.2

Neither release changes runtime behavior. 0.162.1 adds parameter-model guidance to the FastAPI agent skill, refreshes translations and bumps dependencies such as pillow 13.0.0. 0.162.2 adds FastAPI Cloud and AI-development guidance to the skill, and the notes say to install it with uvx library-skills.

The change that matters is still 0.162.0: omitted boolean form fields no longer default to False. For HTML checkboxes, declare the default yourself:

from typing import Annotated
from fastapi import FastAPI, Form

app = FastAPI()

@app.post("/subscribe")
def subscribe(newsletter: Annotated[bool, Form()] = False):
    return {"newsletter": newsletter}

See the Boolean Form Fields docs.

BullMQ 6.7.x

• v6.7.0 adds a queue method to count delayed jobs before a timestamp (#5026).
• v6.7.1 bumps semver to 7.8.6 as a security update (#5077).
• v6.7.2 pins dependencies as a security-related change (#5002).

These are low-risk patch updates. Run npm update bullmq and redeploy workers.

Vue 3.5.45

v3.5.45 is the latest stable release. The release body has no itemized notes, so read the CHANGELOG before bumping. The 3.6 line is at 3.6.0-rc.14.

Other registry movement

These had new versions on the registries in the last two days, but I could not retrieve release notes, so I make no claims about their contents:

• Motion 14.10.1.
• Prisma 8.0.0-rc.33.
• SvelteKit 2.70.4.
• Django 5.2.19, 6.0.10 and 6.1.3 shipped on 3 November and were covered in the November 6 audit.

What I'm doing today

1. Bumping Elysia to 1.4.31 on the Bun services.
2. Moving Better Auth to 1.7.18 and checking the admin access-control statements for set-phone.
3. Leaving Better Auth 1.8 beta, Elysia 2 RC and Prisma 8 RC alone until they go stable.

Sources

• Elysia 1.4.31 release
• Better Auth v1.7.16, v1.7.17, v1.7.18, v1.8.0-beta.6
• FastAPI 0.162.0, 0.162.1, 0.162.2
• BullMQ releases
• Vue 3.5.45
• npm registry: elysia, next, motion, prisma