Release v5.2.8 (#3375)

Upgrades to Better Auth 1.7, expands Custom Styles coverage of item headers, and adds a human-approval step to the AI agent's resume edits.

Breaking for self-hosters using a custom OAuth provider: the callback path changes from /api/auth/oauth2/callback/custom to /api/auth/callback/custom, and installs using OAUTH_DISCOVERY_URL need one additional UPDATE after upgrading. Both are documented in docs/self-hosting/sso.mdx.

- Better Auth 1.7, with the account issuer migration and the jwks alg/crv columns the 1.7 jwt plugin requires
- Agent edits gated behind an approval step, with crash-safe runs and context pruning
- item-header now covers every section header row on every template; adds the item-header-row part
- Fixes provider unlinking, auth error messages, and version conflicts on freshly created resumes
- New /auth/error page, translated across all 53 target locales
- DeepSeek Harness plugin moved into packages/dsh-plugin
- Dependency bumps across the workspace

apps/server/package.json

@@ -18,25 +18,25 @@
 		"#react-pdf-renderer": "@react-pdf/renderer"
 	},
 	"dependencies": {
-		"@ai-sdk/anthropic": "^4.0.39",
-		"@ai-sdk/cerebras": "^3.0.31",
-		"@ai-sdk/cohere": "^4.0.27",
-		"@ai-sdk/deepseek": "^3.0.28",
-		"@ai-sdk/fireworks": "^3.0.33",
-		"@ai-sdk/google": "^4.0.44",
-		"@ai-sdk/groq": "^4.0.28",
-		"@ai-sdk/mistral": "^4.0.29",
-		"@ai-sdk/openai": "^4.0.42",
-		"@ai-sdk/openai-compatible": "^3.0.31",
-		"@ai-sdk/perplexity": "^4.0.29",
-		"@ai-sdk/togetherai": "^3.0.32",
-		"@ai-sdk/xai": "^4.0.40",
-		"@aws-sdk/client-s3": "^3.1111.0",
-		"@better-auth/api-key": "^1.6.29",
-		"@better-auth/drizzle-adapter": "^1.6.29",
-		"@better-auth/infra": "^0.3.7",
-		"@better-auth/oauth-provider": "^1.6.29",
-		"@better-auth/passkey": "^1.6.29",
+		"@ai-sdk/anthropic": "^4.0.41",
+		"@ai-sdk/cerebras": "^3.0.35",
+		"@ai-sdk/cohere": "^4.0.29",
+		"@ai-sdk/deepseek": "^3.0.31",
+		"@ai-sdk/fireworks": "^3.0.38",
+		"@ai-sdk/google": "^4.0.50",
+		"@ai-sdk/groq": "^4.0.30",
+		"@ai-sdk/mistral": "^4.0.32",
+		"@ai-sdk/openai": "^4.0.46",
+		"@ai-sdk/openai-compatible": "^3.0.35",
+		"@ai-sdk/perplexity": "^4.0.31",
+		"@ai-sdk/togetherai": "^3.0.36",
+		"@ai-sdk/xai": "^4.0.43",
+		"@aws-sdk/client-s3": "^3.1116.0",
+		"@better-auth/api-key": "^1.7.1",
+		"@better-auth/drizzle-adapter": "^1.7.1",
+		"@better-auth/infra": "^0.4.2",
+		"@better-auth/oauth-provider": "^1.7.1",
+		"@better-auth/passkey": "^1.7.1",
 		"@bramus/specificity": "^2.4.2",
 		"@hono/node-server": "^2.1.1",
 		"@modelcontextprotocol/sdk": "^1.30.0",
@@ -46,7 +46,7 @@
 		"@orpc/openapi": "^1.15.0",
 		"@orpc/server": "^1.15.0",
 		"@orpc/zod": "^1.15.0",
-		"@react-pdf/renderer": "^4.6.1",
+		"@react-pdf/renderer": "^4.8.1",
 		"@reactive-resume/api": "workspace:*",
 		"@reactive-resume/auth": "workspace:*",
 		"@reactive-resume/db": "workspace:*",
@@ -57,17 +57,17 @@
 		"@sindresorhus/slugify": "^3.0.0",
 		"@t3-oss/env-core": "^0.13.11",
 		"@uiw/color-convert": "^2.10.3",
-		"ai": "^7.0.66",
+		"ai": "^7.0.77",
 		"bcrypt": "^6.0.0",
-		"better-auth": "1.6.29",
+		"better-auth": "1.7.1",
 		"cjk-regex": "^3.4.0",
 		"css-tree": "^3.2.1",
-		"deepmerge-ts": "^8.0.1",
+		"deepmerge-ts": "^8.0.2",
 		"drizzle-orm": "1.0.0-rc.4",
 		"drizzle-zod": "1.0.0-beta.14-a36c63d",
 		"es-toolkit": "^1.51.0",
 		"fast-json-patch": "^3.1.1",
-		"hono": "^4.13.2",
+		"hono": "^4.13.4",
 		"jsonrepair": "^3.15.0",
 		"node-html-parser": "^9.0.1",
 		"nodemailer": "^9.0.5",
@@ -82,18 +82,18 @@
 		"tokenx": "^2.1.0",
 		"ts-pattern": "^5.9.0",
 		"unique-names-generator": "^4.7.1",
-		"uuid": "^14.0.1",
+		"uuid": "^14.0.2",
 		"zod": "^4.4.3"
 	},
 	"devDependencies": {
 		"@reactive-resume/config": "workspace:*",
 		"@types/node": "^26.2.0",
-		"@types/pg": "^8.23.0",
+		"@types/pg": "^8.23.1",
 		"@types/react": "^19.2.18",
 		"@typescript/native-preview": "7.0.0-dev.20260707.2",
 		"tsdown": "^0.22.14",
 		"tsx": "^4.23.12",
 		"typescript": "^7.0.2",
-		"vitest": "^4.1.10"
+		"vitest": "^4.1.11"
 	}
 }