Release v5.2.8 (#3375)

Upgrades to Better Auth 1.7, expands Custom Styles coverage of item headers, and adds a human-approval step to the AI agent's resume edits.

Breaking for self-hosters using a custom OAuth provider: the callback path changes from /api/auth/oauth2/callback/custom to /api/auth/callback/custom, and installs using OAUTH_DISCOVERY_URL need one additional UPDATE after upgrading. Both are documented in docs/self-hosting/sso.mdx.

- Better Auth 1.7, with the account issuer migration and the jwks alg/crv columns the 1.7 jwt plugin requires
- Agent edits gated behind an approval step, with crash-safe runs and context pruning
- item-header now covers every section header row on every template; adds the item-header-row part
- Fixes provider unlinking, auth error messages, and version conflicts on freshly created resumes
- New /auth/error page, translated across all 53 target locales
- DeepSeek Harness plugin moved into packages/dsh-plugin
- Dependency bumps across the workspace

packages/api/package.json

@@ -21,20 +21,20 @@
 		"test:agent": "vitest run --reporter=agent --reporter=json --outputFile.json=reports/vitest-results.json --passWithNoTests"
 	},
 	"dependencies": {
-		"@ai-sdk/anthropic": "^4.0.39",
-		"@ai-sdk/cerebras": "^3.0.31",
-		"@ai-sdk/cohere": "^4.0.27",
-		"@ai-sdk/deepseek": "^3.0.28",
-		"@ai-sdk/fireworks": "^3.0.33",
-		"@ai-sdk/google": "^4.0.44",
-		"@ai-sdk/groq": "^4.0.28",
-		"@ai-sdk/mistral": "^4.0.29",
-		"@ai-sdk/openai": "^4.0.42",
-		"@ai-sdk/openai-compatible": "^3.0.31",
-		"@ai-sdk/perplexity": "^4.0.29",
-		"@ai-sdk/togetherai": "^3.0.32",
-		"@ai-sdk/xai": "^4.0.40",
-		"@aws-sdk/client-s3": "^3.1111.0",
+		"@ai-sdk/anthropic": "^4.0.41",
+		"@ai-sdk/cerebras": "^3.0.35",
+		"@ai-sdk/cohere": "^4.0.29",
+		"@ai-sdk/deepseek": "^3.0.31",
+		"@ai-sdk/fireworks": "^3.0.38",
+		"@ai-sdk/google": "^4.0.50",
+		"@ai-sdk/groq": "^4.0.30",
+		"@ai-sdk/mistral": "^4.0.32",
+		"@ai-sdk/openai": "^4.0.46",
+		"@ai-sdk/openai-compatible": "^3.0.35",
+		"@ai-sdk/perplexity": "^4.0.31",
+		"@ai-sdk/togetherai": "^3.0.36",
+		"@ai-sdk/xai": "^4.0.43",
+		"@aws-sdk/client-s3": "^3.1116.0",
 		"@orpc/client": "^1.15.0",
 		"@orpc/experimental-ratelimit": "^1.15.0",
 		"@orpc/server": "^1.15.0",
@@ -46,9 +46,9 @@
 		"@reactive-resume/resume": "workspace:*",
 		"@reactive-resume/schema": "workspace:*",
 		"@reactive-resume/utils": "workspace:*",
-		"ai": "^7.0.66",
+		"ai": "^7.0.77",
 		"bcrypt": "^6.0.0",
-		"better-auth": "1.6.29",
+		"better-auth": "1.7.1",
 		"drizzle-orm": "1.0.0-rc.4",
 		"drizzle-zod": "1.0.0-beta.14-a36c63d",
 		"es-toolkit": "^1.51.0",