nuxt-auth-utils 0.5.28 → 0.5.30

package/dist/runtime/server/lib/oauth/roblox.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthRobloxEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -18,6 +18,7 @@ export function defineOAuthRobloxEventHandler({ config, onSuccess, onError }) {
       return handleAccessTokenErrorResponse(event, "roblox", query, onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || [];
       return sendRedirect(
@@ -27,10 +28,14 @@ export function defineOAuthRobloxEventHandler({ config, onSuccess, onError }) {
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "roblox", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       body: {
         client_id: config.clientId,

package/dist/runtime/server/lib/oauth/salesforce.js

@@ -40,8 +40,8 @@ export function defineOAuthSalesforceEventHandler({
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          state,
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }

package/dist/runtime/server/lib/oauth/seznam.js

@@ -1,7 +1,7 @@
 import defu from "defu";
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
-import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleMissingConfiguration, requestAccessToken } from "../utils.js";
+import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleInvalidState, handleMissingConfiguration, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthSeznamEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -15,6 +15,7 @@ export function defineOAuthSeznamEventHandler({ config, onSuccess, onError }) {
       return handleMissingConfiguration(event, "seznam", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || ["identity"];
       return sendRedirect(
@@ -24,10 +25,13 @@ export function defineOAuthSeznamEventHandler({ config, onSuccess, onError }) {
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(","),
-          state: query.state || ""
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "seznam", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       body: {
         grant_type: "authorization_code",

package/dist/runtime/server/lib/oauth/shopifyCustomer.js

@@ -1,7 +1,7 @@
 import { createError, eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleMissingConfiguration, handlePkceVerifier, handleState, requestAccessToken } from "../utils.js";
+import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleInvalidState, handleMissingConfiguration, handlePkceVerifier, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthShopifyCustomerEventHandler({
   config,
@@ -42,6 +42,9 @@ export function defineOAuthShopifyCustomerEventHandler({
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "shopifyCustomer", onError);
+    }
     const tokens = await requestAccessToken(discoveryResponse.token_endpoint, {
       body: {
         grant_type: "authorization_code",

package/dist/runtime/server/lib/oauth/slack.js

@@ -40,8 +40,8 @@ export function defineOAuthSlackEventHandler({
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          state,
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }

package/dist/runtime/server/lib/oauth/spotify.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthSpotifyEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -15,6 +15,7 @@ export function defineOAuthSpotifyEventHandler({ config, onSuccess, onError }) {
       return handleMissingConfiguration(event, "spotify", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || [];
       if (config.emailRequired && !config.scope.includes("user-read-email")) {
@@ -27,10 +28,14 @@ export function defineOAuthSpotifyEventHandler({ config, onSuccess, onError }) {
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "spotify", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       headers: {
         Authorization: `Basic ${Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64")}`

package/dist/runtime/server/lib/oauth/steam.js

@@ -1,7 +1,7 @@
 import { eventHandler, createError, getQuery, getRequestURL, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration } from "../utils.js";
+import { handleInvalidState, handleMissingConfiguration, handleState } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthSteamEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -13,8 +13,9 @@ export function defineOAuthSteamEventHandler({ config, onSuccess, onError }) {
       return handleMissingConfiguration(event, "steam", ["apiKey"], onError);
     }
     const url = getRequestURL(event);
+    const state = await handleState(event, { isCallback: Boolean(query["openid.claimed_id"]) });
     if (!query["openid.claimed_id"]) {
-      const redirectURL = config.redirectURL || getRequestURL(event).href;
+      const redirectURL = withQuery(config.redirectURL || getRequestURL(event).href, { state });
       const realm = url.port ? `${url.protocol}//${url.hostname}:${url.port}` : `${url.protocol}//${url.hostname}`;
       const steamOpenIdParams = {
         "openid.ns": "http://specs.openid.net/auth/2.0",
@@ -26,6 +27,9 @@ export function defineOAuthSteamEventHandler({ config, onSuccess, onError }) {
       };
       return sendRedirect(event, withQuery(config.authorizationURL, steamOpenIdParams));
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "steam", onError);
+    }
     if (!query["openid.signed"] || !query["openid.sig"]) {
       const error = createError({
         statusCode: 400,

package/dist/runtime/server/lib/oauth/strava.js

@@ -4,7 +4,9 @@ import { defu } from "defu";
 import {
   getOAuthRedirectURL,
   handleAccessTokenErrorResponse,
+  handleInvalidState,
   handleMissingConfiguration,
+  handleState,
   requestAccessToken
 } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
@@ -36,6 +38,7 @@ export function defineOAuthStravaEventHandler({
     const authorizationURL = "https://www.strava.com/oauth/authorize";
     const tokenURL = "https://www.strava.com/oauth/token";
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       return sendRedirect(
         event,
@@ -44,10 +47,14 @@ export function defineOAuthStravaEventHandler({
           redirect_uri: redirectURL,
           response_type: "code",
           approval_prompt: config.approvalPrompt || "auto",
-          scope: config.scope
+          scope: config.scope,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "strava", onError);
+    }
     const tokens = await requestAccessToken(tokenURL, {
       body: {
         client_id: config.clientId,

package/dist/runtime/server/lib/oauth/tiktok.js

@@ -2,7 +2,7 @@ import crypto from "node:crypto";
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleAccessTokenErrorResponse, handleMissingConfiguration, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleAccessTokenErrorResponse, handleInvalidState, handleMissingConfiguration, getOAuthRedirectURL, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
 export function defineOAuthTikTokEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -17,6 +17,7 @@ export function defineOAuthTikTokEventHandler({ config, onSuccess, onError }) {
     }
     const codeVerifier = "verify";
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || [];
       if (!config.scope.includes("user.info.basic")) {
@@ -33,10 +34,14 @@ export function defineOAuthTikTokEventHandler({ config, onSuccess, onError }) {
             code_verifier: codeVerifier,
             code_challenge: crypto.createHash("sha256").update(codeVerifier).digest("hex"),
             code_challenge_method: "S256"
-          } : {}
+          } : {},
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "tiktok", onError);
+    }
     const tokens = await requestAccessToken(
       config.tokenURL,
       {

package/dist/runtime/server/lib/oauth/twitch.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
 export function defineOAuthTwitchEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -15,6 +15,7 @@ export function defineOAuthTwitchEventHandler({ config, onSuccess, onError }) {
       return handleMissingConfiguration(event, "twitch", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || [];
       if (config.emailRequired && !config.scope.includes("user:read:email")) {
@@ -27,10 +28,14 @@ export function defineOAuthTwitchEventHandler({ config, onSuccess, onError }) {
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "twitch", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       body: {
         grant_type: "authorization_code",

package/dist/runtime/server/lib/oauth/vk.js

@@ -6,6 +6,8 @@ import {
   handleMissingConfiguration,
   handleAccessTokenErrorResponse,
   getOAuthRedirectURL,
+  handleInvalidState,
+  handleState,
   requestAccessToken
 } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
@@ -31,6 +33,7 @@ export function defineOAuthVKEventHandler({
     }
     const codeVerifier = "verify";
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || [];
       if (config.emailRequired && !config.scope.includes("email")) {
@@ -43,12 +46,15 @@ export function defineOAuthVKEventHandler({
           client_id: config.clientId,
           code_challenge: crypto.createHash("sha256").update(codeVerifier).digest("base64url"),
           code_challenge_method: "s256",
-          state: crypto.randomUUID(),
+          state,
           redirect_uri: redirectURL,
           scope: config.scope.join(" ")
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "vk", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       body: {
         grant_type: "authorization_code",

package/dist/runtime/server/lib/oauth/workos.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect, getRequestIP, getRequestHeader } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthWorkOSEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -14,6 +14,7 @@ export function defineOAuthWorkOSEventHandler({ config, onSuccess, onError }) {
     if (query.error) {
       return handleAccessTokenErrorResponse(event, "workos", query, onError);
     }
+    const state = await handleState(event);
     if (!query.code) {
       return sendRedirect(
         event,
@@ -24,10 +25,14 @@ export function defineOAuthWorkOSEventHandler({ config, onSuccess, onError }) {
           redirect_uri: redirectURL || void 0,
           connection_id: config.connectionId || void 0,
           screen_hint: config.screenHint || "sign-in",
-          organization_id: config.organizationId || void 0
+          organization_id: config.organizationId || void 0,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "workos", onError);
+    }
     const authenticateResponse = await requestAccessToken("https://api.workos.com/user_management/authenticate", {
       headers: {
         "Content-Type": "application/json"

package/dist/runtime/server/lib/oauth/xsuaa.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthXSUAAEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -13,6 +13,7 @@ export function defineOAuthXSUAAEventHandler({ config, onSuccess, onError }) {
     const authorizationURL = `https://${config.domain}/oauth/authorize`;
     const tokenURL = `https://${config.domain}/oauth/token`;
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || [];
       return sendRedirect(
@@ -21,10 +22,14 @@ export function defineOAuthXSUAAEventHandler({ config, onSuccess, onError }) {
           response_type: "code",
           client_id: config.clientId,
           redirect_uri: redirectURL,
-          scope: config.scope.join(" ")
+          scope: config.scope.join(" "),
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "xsuaa", onError);
+    }
     const tokens = await requestAccessToken(tokenURL, {
       body: {
         grant_type: "authorization_code",

package/dist/runtime/server/lib/oauth/yandex.js

@@ -5,6 +5,8 @@ import {
   handleMissingConfiguration,
   handleAccessTokenErrorResponse,
   getOAuthRedirectURL,
+  handleInvalidState,
+  handleState,
   requestAccessToken
 } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
@@ -29,6 +31,7 @@ export function defineOAuthYandexEventHandler({
       );
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || [];
       if (config.emailRequired && !config.scope.includes("login:email")) {
@@ -40,10 +43,14 @@ export function defineOAuthYandexEventHandler({
           response_type: "code",
           client_id: config.clientId,
           redirect_uri: redirectURL,
-          scope: config.scope.join(" ")
+          scope: config.scope.join(" "),
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "yandex", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       body: {
         grant_type: "authorization_code",

package/dist/runtime/server/lib/oauth/zitadel.js

@@ -36,10 +36,10 @@ export function defineOAuthZitadelEventHandler({ config, onSuccess, onError }) {
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          state,
           code_challenge: verifier.code_challenge,
           code_challenge_method: verifier.code_challenge_method,
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }

package/dist/runtime/server/lib/utils.d.ts

@@ -70,7 +70,11 @@ export declare function handlePkceVerifier(event: H3Event): Promise<{
     code_challenge?: undefined;
     code_challenge_method?: undefined;
 }>;
-export declare function handleState(event: H3Event): Promise<string | undefined>;
+interface HandleStateOptions {
+    isCallback?: boolean;
+    sameSite?: 'lax' | 'none' | 'strict';
+}
+export declare function handleState(event: H3Event, options?: HandleStateOptions): Promise<string | undefined>;
 export declare function parseJwt(token: string): jose.JWTPayload;
 export declare function handleNonce(event: H3Event): string | undefined;
 export {};

package/dist/runtime/server/lib/utils.js

@@ -101,21 +101,23 @@ export async function handlePkceVerifier(event) {
     };
   }
   const verifier = getCookie(event, "nuxt-auth-pkce");
-  deleteCookie(event, "nuxt-auth-pkce");
+  deleteCookie(event, "nuxt-auth-pkce", { path: "/" });
   return { code_verifier: verifier };
 }
-export async function handleState(event) {
+export async function handleState(event, options = {}) {
   const query = getQuery(event);
-  if (query.state) {
+  const isCallback = options.isCallback ?? Boolean(query.code);
+  if (isCallback) {
     const state2 = getCookie(event, "nuxt-auth-state");
-    deleteCookie(event, "nuxt-auth-state");
+    deleteCookie(event, "nuxt-auth-state", { path: "/" });
     return state2;
   }
-  const state = encodeBase64Url(getRandomBytes(8));
+  const state = encodeBase64Url(getRandomBytes());
+  const sameSite = options.sameSite || "lax";
   setCookie(event, "nuxt-auth-state", state, {
     httpOnly: true,
-    secure: !isDevelopment,
-    sameSite: "lax",
+    secure: sameSite === "none" || !isDevelopment,
+    sameSite,
     maxAge: OAUTH_COOKIE_MAX_AGE,
     path: "/"
   });
@@ -128,10 +130,10 @@ export function handleNonce(event) {
   const query = getQuery(event);
   if (query.code) {
     const nonce2 = getCookie(event, "nuxt-auth-nonce");
-    deleteCookie(event, "nuxt-auth-nonce");
+    deleteCookie(event, "nuxt-auth-nonce", { path: "/" });
     return nonce2;
   }
-  const nonce = encodeBase64Url(getRandomBytes(8));
+  const nonce = encodeBase64Url(getRandomBytes());
   setCookie(event, "nuxt-auth-nonce", nonce, {
     httpOnly: true,
     secure: !isDevelopment,

package/dist/runtime/types/oauth-config.d.ts

@@ -1,6 +1,6 @@
 import type { H3Event, H3Error } from 'h3';
 export type ATProtoProvider = 'bluesky';
-export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'azureb2c' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'kick' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | 'livechat' | 'salesforce' | 'slack' | 'heroku' | 'roblox' | 'okta' | 'ory' | 'shopifyCustomer' | 'oidc' | 'osu' | (string & {});
+export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'azureb2c' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'kick' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | 'livechat' | 'salesforce' | 'slack' | 'heroku' | 'roblox' | 'okta' | 'ory' | 'shopifyCustomer' | 'oidc' | 'osu' | 'riotgames' | 'box' | (string & {});
 export type OnError = (event: H3Event, error: H3Error) => Promise<void> | void;
 export interface OAuthConfig<TConfig, TResult = {
     user: any;

package/dist/runtime/types/webauthn.d.ts

@@ -86,7 +86,7 @@ export interface WebAuthnComposable {
      * @param user.displayName - The display name to register, used for convenience and personalization and should not be relied upon as a secure identifier for authentication processes
      * @returns true if the registration was successful
      */
-    register: <T extends WebAuthnUser>(data: T) => Promise<boolean>;
+    register: <T extends WebAuthnUser>(user: T) => Promise<boolean>;
     /**
      * Authenticate a credential
      * @param userName - The user name to authenticate, can be an email address, a username, or any other form of unique ID chosen by the user

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-auth-utils",
-  "version": "0.5.28",
+  "version": "0.5.30",
   "description": "Add Authentication to Nuxt applications with secured & sealed cookies sessions.",
   "repository": {
     "type": "git",
@@ -8,7 +8,7 @@
   },
   "license": "MIT",
   "type": "module",
-  "packageManager": "pnpm@10.28.0",
+  "packageManager": "pnpm@10.29.3",
   "exports": {
     ".": {
       "types": "./dist/types.d.mts",
@@ -40,13 +40,13 @@
   },
   "dependencies": {
     "@adonisjs/hash": "^9.1.1",
-    "@nuxt/kit": "^4.2.2",
+    "@nuxt/kit": "^4.3.1",
     "defu": "^6.1.4",
     "h3": "^1.15.4",
     "hookable": "^6.0.1",
     "jose": "^6.1.3",
     "ofetch": "^1.5.1",
-    "openid-client": "^6.8.1",
+    "openid-client": "^6.8.2",
     "pathe": "^2.0.3",
     "scule": "^1.3.0",
     "uncrypto": "^0.1.3"
@@ -72,20 +72,20 @@
     }
   },
   "devDependencies": {
-    "@iconify-json/simple-icons": "^1.2.66",
-    "@nuxt/devtools": "3.1.1",
-    "@nuxt/eslint-config": "^1.12.1",
+    "@iconify-json/simple-icons": "^1.2.71",
+    "@nuxt/devtools": "3.2.1",
+    "@nuxt/eslint-config": "^1.15.1",
     "@nuxt/module-builder": "^1.0.2",
-    "@nuxt/schema": "^4.2.2",
-    "@nuxt/test-utils": "^3.23.0",
+    "@nuxt/schema": "^4.3.1",
+    "@nuxt/test-utils": "^4.0.0",
     "@types/node": "latest",
-    "@nuxt/ui": "^4.3.0",
+    "@nuxt/ui": "^4.4.0",
     "@simplewebauthn/types": "^12.0.0",
     "changelogen": "^0.6.2",
-    "eslint": "^9.39.2",
-    "nuxt": "^4.2.2",
+    "eslint": "^10.0.0",
+    "nuxt": "^4.3.1",
     "typescript": "5.9.3",
-    "vitest": "^4.0.17",
-    "vue-tsc": "^3.2.2"
+    "vitest": "^4.0.18",
+    "vue-tsc": "^3.2.4"
   }
 }