Summary
@neondatabase/auth-ui@0.2.0-beta does not build when Better Auth is overridden to 1.6.x, which is currently needed to clear the public Better Auth OAuth callback advisory GHSA-wxw3-q3m9-c3jr.
The package imports apiKeyClient from better-auth/client/plugins, but Better Auth 1.6.x no longer exports apiKeyClient from that module. The app build fails under Next/Turbopack before runtime.
Reproducer
In a Next 16 app using Neon Auth UI:
{
"dependencies": {
"@neondatabase/auth": "0.4.1-beta"
},
"overrides": {
"better-auth": "1.6.14",
"@better-auth/passkey": "1.6.14"
}
}Then run:
npm install
npm run build
Observed build failure:
./node_modules/@neondatabase/auth/node_modules/@neondatabase/auth-ui/dist/index.mjs
Export apiKeyClient doesn't exist in target module
The export apiKeyClient was not found in module .../better-auth/dist/client/plugins/index.mjs
The import in the published package is:
import { anonymousClient, apiKeyClient, emailOTPClient, genericOAuthClient, magicLinkClient, multiSessionClient, oneTapClient, organizationClient, twoFactorClient, usernameClient } from "better-auth/client/plugins";A quick package check showed:
better-auth@1.4.22: apiKeyClient export exists
better-auth@1.6.2: apiKeyClient export missing
better-auth@1.6.14: apiKeyClient export missing
better-auth@1.7.0-beta.4: apiKeyClient export missing
Expected
@neondatabase/auth-ui should support the patched Better Auth 1.6.x client plugin surface, likely by importing API key client support from the package/location expected by newer Better Auth versions or by upgrading the wrapped auth UI dependency tree.
Why this matters
@neondatabase/auth@0.4.1-beta can clear the critical Better Auth 2FA/session-cache advisory with a compatible better-auth@1.4.22 override, but the moderate OAuth callback state advisory remains until Neon Auth UI is compatible with Better Auth 1.6.x.
Summary
@neondatabase/auth-ui@0.2.0-betadoes not build when Better Auth is overridden to1.6.x, which is currently needed to clear the public Better Auth OAuth callback advisory GHSA-wxw3-q3m9-c3jr.The package imports
apiKeyClientfrombetter-auth/client/plugins, but Better Auth 1.6.x no longer exportsapiKeyClientfrom that module. The app build fails under Next/Turbopack before runtime.Reproducer
In a Next 16 app using Neon Auth UI:
{ "dependencies": { "@neondatabase/auth": "0.4.1-beta" }, "overrides": { "better-auth": "1.6.14", "@better-auth/passkey": "1.6.14" } }Then run:
Observed build failure:
The import in the published package is:
A quick package check showed:
Expected
@neondatabase/auth-uishould support the patched Better Auth 1.6.x client plugin surface, likely by importing API key client support from the package/location expected by newer Better Auth versions or by upgrading the wrapped auth UI dependency tree.Why this matters
@neondatabase/auth@0.4.1-betacan clear the critical Better Auth 2FA/session-cache advisory with a compatiblebetter-auth@1.4.22override, but the moderate OAuth callback state advisory remains until Neon Auth UI is compatible with Better Auth 1.6.x.