Merge branch 't3-oss:main' into docs/update-french-april-2025

joachimjusth · web-flow · commit d4cbef45b27f · 2025-12-26T23:08:18.000-05:00
diff --git a/.changeset/beige-clouds-behave.md b/.changeset/beige-clouds-behave.md
@@ -0,0 +1,5 @@
+---
+"create-t3-app": patch
+---
+
+fix #1903 #2157 #2163
diff --git a/.changeset/curly-zoos-add.md b/.changeset/curly-zoos-add.md
@@ -0,0 +1,5 @@
+---
+"create-t3-app": minor
+---
+
+Fixes Biome formatter during the initial installation process
diff --git a/.changeset/quick-snakes-give.md b/.changeset/quick-snakes-give.md
@@ -0,0 +1,5 @@
+---
+"create-t3-app": patch
+---
+
+fix(security): bump react and next ([BLOG](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components#update-instructions))
diff --git a/.changeset/tender-humans-hide.md b/.changeset/tender-humans-hide.md
@@ -0,0 +1,5 @@
+---
+"create-t3-app": patch
+---
+
+fix(security): bump react ([CVE-2025-55182](https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r))
diff --git a/cli/package.json b/cli/package.json
@@ -77,19 +77,19 @@
     "@trpc/server": "11.0.0",
     "@types/fs-extra": "^11.0.4",
     "@types/gradient-string": "^1.1.6",
-    "@types/node": "^20.14.10",
+    "@types/node": "^24.10.1",
     "better-auth": "^1.3",
     "drizzle-kit": "^0.30.5",
     "drizzle-orm": "^0.41.0",
     "mysql2": "^3.11.0",
-    "next": "^15.2.3",
+    "next": "^15.5.9",
     "next-auth": "^4.24.7",
     "postgres": "^3.4.4",
     "prettier": "^3.5.3",
     "prettier-plugin-tailwindcss": "^0.6.11",
     "prisma": "^6.6.0",
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0",
+    "react": "^19.2.3",
+    "react-dom": "^19.2.3",
     "superjson": "^2.2.1",
     "tailwindcss": "^4.0.15",
     "tsup": "^6.7.0",
diff --git a/cli/src/cli/index.ts b/cli/src/cli/index.ts
@@ -144,7 +144,7 @@ export const runCli = async (): Promise<CliResults> => {
     )
     /** @experimental - Used for CI E2E tests. Used in conjunction with `--CI` to skip prompting. */
     .option(
-      "-i, --import-alias",
+      "-i, --import-alias [alias]",
       "Explicitly tell the CLI to use a custom import alias",
       defaultOptions.flags.importAlias
     )
diff --git a/cli/template/base/_gitignore b/cli/template/base/_gitignore
@@ -12,6 +12,7 @@
 /prisma/db.sqlite
 /prisma/db.sqlite-journal
 db.sqlite
+/generated/
 
 # next.js
 /.next/
diff --git a/cli/template/base/package.json b/cli/template/base/package.json
@@ -12,15 +12,15 @@
   },
   "dependencies": {
     "@t3-oss/env-nextjs": "^0.12.0",
-    "next": "^15.2.3",
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0",
+    "next": "^15.5.9",
+    "react": "^19.2.3",
+    "react-dom": "^19.2.3",
     "zod": "^3.24.2"
   },
   "devDependencies": {
-    "@types/node": "^20.14.10",
-    "@types/react": "^19.0.0",
-    "@types/react-dom": "^19.0.0",
+    "@types/node": "^24.10.1",
+    "@types/react": "~19.1.0",
+    "@types/react-dom": "~19.1.0",
     "typescript": "^5.8.2"
   }
 }
diff --git a/cli/template/extras/src/app/page/with-better-auth-trpc-tw.tsx b/cli/template/extras/src/app/page/with-better-auth-trpc-tw.tsx
@@ -58,6 +58,7 @@ export default async function Home() {
               {!session ? (
                 <form>
                   <button
+                    type="submit"
                     className="rounded-full bg-white/10 px-10 py-3 font-semibold no-underline transition hover:bg-white/20"
                     formAction={async () => {
                       "use server";
@@ -79,6 +80,7 @@ export default async function Home() {
               ) : (
                 <form>
                   <button
+                    type="submit"
                     className="rounded-full bg-white/10 px-10 py-3 font-semibold no-underline transition hover:bg-white/20"
                     formAction={async () => {
                       "use server";
diff --git a/cli/template/extras/src/app/page/with-better-auth-trpc.tsx b/cli/template/extras/src/app/page/with-better-auth-trpc.tsx
@@ -59,6 +59,7 @@ export default async function Home() {
               {!session ? (
                 <form>
                   <button
+                    type="submit"
                     className={styles.loginButton}
                     formAction={async () => {
                       "use server";
@@ -79,6 +80,7 @@ export default async function Home() {
               ) : (
                 <form>
                   <button
+                    type="submit"
                     className={styles.loginButton}
                     formAction={async () => {
                       "use server";
diff --git a/cli/template/extras/src/app/page/with-better-auth-tw.tsx b/cli/template/extras/src/app/page/with-better-auth-tw.tsx
@@ -46,6 +46,7 @@ export default async function Home() {
             {!session ? (
               <form>
                 <button
+                  type="submit"
                   className="rounded-full bg-white/10 px-10 py-3 font-semibold no-underline transition hover:bg-white/20"
                   formAction={async () => {
                     "use server";
@@ -67,6 +68,7 @@ export default async function Home() {
             ) : (
               <form>
                 <button
+                  type="submit"
                   className="rounded-full bg-white/10 px-10 py-3 font-semibold no-underline transition hover:bg-white/20"
                   formAction={async () => {
                     "use server";
diff --git a/cli/template/extras/src/app/page/with-better-auth.tsx b/cli/template/extras/src/app/page/with-better-auth.tsx
@@ -47,6 +47,7 @@ export default async function Home() {
             {!session ? (
               <form>
                 <button
+                  type="submit"
                   className={styles.loginButton}
                   formAction={async () => {
                     "use server";
@@ -67,6 +68,7 @@ export default async function Home() {
             ) : (
               <form>
                 <button
+                  type="submit"
                   className={styles.loginButton}
                   formAction={async () => {
                     "use server";
diff --git a/cli/template/extras/src/pages/index/with-auth-trpc-tw.tsx b/cli/template/extras/src/pages/index/with-auth-trpc-tw.tsx
@@ -70,6 +70,7 @@ function AuthShowcase() {
         {secretMessage && <span> - {secretMessage}</span>}
       </p>
       <button
+        type="button"
         className="rounded-full bg-white/10 px-10 py-3 font-semibold text-white no-underline transition hover:bg-white/20"
         onClick={sessionData ? () => void signOut() : () => void signIn()}
       >
diff --git a/cli/template/extras/src/pages/index/with-auth-trpc.tsx b/cli/template/extras/src/pages/index/with-auth-trpc.tsx
@@ -71,6 +71,7 @@ function AuthShowcase() {
         {secretMessage && <span> - {secretMessage}</span>}
       </p>
       <button
+        type="button"
         className={styles.loginButton}
         onClick={sessionData ? () => void signOut() : () => void signIn()}
       >
diff --git a/cli/template/extras/src/server/better-auth/config/base.ts b/cli/template/extras/src/server/better-auth/config/base.ts
@@ -1,9 +1,12 @@
 import { betterAuth } from "better-auth";
+import { nextCookies } from "better-auth/next-js";
 
 export const auth = betterAuth({
   emailAndPassword: {
     enabled: true,
   },
+  // Make sure nextCookies() is the last plugin in the array
+  plugins: [nextCookies()],
 });
 
 export type Session = typeof auth.$Infer.Session;
diff --git a/cli/template/extras/src/server/better-auth/config/with-drizzle.ts b/cli/template/extras/src/server/better-auth/config/with-drizzle.ts
@@ -1,5 +1,6 @@
 import { betterAuth } from "better-auth";
 import { drizzleAdapter } from "better-auth/adapters/drizzle";
+import { nextCookies } from "better-auth/next-js";
 
 import { env } from "~/env";
 import { db } from "~/server/db";
@@ -18,6 +19,8 @@ export const auth = betterAuth({
       redirectURI: "http://localhost:3000/api/auth/callback/github",
     },
   },
+  // Make sure nextCookies() is the last plugin in the array
+  plugins: [nextCookies()],
 });
 
 export type Session = typeof auth.$Infer.Session;
diff --git a/cli/template/extras/src/server/better-auth/config/with-prisma.ts b/cli/template/extras/src/server/better-auth/config/with-prisma.ts
@@ -1,5 +1,6 @@
 import { betterAuth } from "better-auth";
 import { prismaAdapter } from "better-auth/adapters/prisma";
+import { nextCookies } from "better-auth/next-js";
 
 import { env } from "~/env";
 import { db } from "~/server/db";
@@ -18,6 +19,8 @@ export const auth = betterAuth({
       redirectURI: "http://localhost:3000/api/auth/callback/github",
     },
   },
+  // Make sure nextCookies() is the last plugin in the array
+  plugins: [nextCookies()],
 });
 
 export type Session = typeof auth.$Infer.Session;
diff --git a/package.json b/package.json
@@ -52,7 +52,7 @@
     "@ianvs/prettier-plugin-sort-imports": "^4.2.1",
     "@manypkg/cli": "^0.20.0",
     "@total-typescript/ts-reset": "^0.3.7",
-    "@types/node": "^20.14.10",
+    "@types/node": "^24.10.1",
     "eslint": "^9.23.0",
     "eslint-plugin-import-x": "^4.9.1",
     "eslint-plugin-isaacscript": "^4.0.0",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
diff --git a/www/package.json b/www/package.json
diff --git a/www/src/components/navigation/githubIcon.astro b/www/src/components/navigation/githubIcon.astro

-Original file line number
+Diff line change
@@ @@ -0,0 +1,5 @@ @@
 +---
 +"create-t3-app": patch
 +---
++
 +fix #1903 #2157 #2163
Original file line number	Diff line number	Diff line change
`@@ -144,7 +144,7 @@ export const runCli = async (): Promise<CliResults> => {`
`144`	`144`	`)`
`145`	`145`	/** @experimental - Used for CI E2E tests. Used in conjunction with `--CI` to skip prompting. */
`146`	`146`	`.option(`
`147`		`- "-i, --import-alias",`
	`147`	`+ "-i, --import-alias [alias]",`
`148`	`148`	`"Explicitly tell the CLI to use a custom import alias",`
`149`	`149`	`defaultOptions.flags.importAlias`
`150`	`150`	`)`