fix(agentex-ui): bump next-auth 5.0.0-beta.31 -> 5.0.0-beta.32 (4 CVEs) (#376)

## Summary

Bumps **`next-auth` `5.0.0-beta.31` → `5.0.0-beta.32`** in `agentex-ui`,
which transitively pulls the fixed **`@auth/core` `0.41.2` → `0.41.3`**
(declared exactly by beta.32). One direct-dependency bump clears every
Auth.js advisory in this batch — no `overrides`/`resolutions` needed.

The app uses the Auth.js **v5** API (`NextAuth`/`NextAuthConfig` in
`auth.ts`, `getToken` from `next-auth/jwt`), so the fix stays on the 5.x
beta line rather than downgrading to the 4.24.15 branch.

## CVEs resolved (4 unique)

| Advisory | Severity | Description |
| --- | --- | --- |
| GHSA-7rqj-j65f-68wh | CRITICAL | Email normalizer validates the
address before Unicode normalization, allowing a homoglyph `@` bypass
(affects `@auth/core` and `next-auth`) |
| GHSA-8fpg-xm3f-6cx3 | CRITICAL | Configuration errors can cause
existence-based auth checks to fail open (`next-auth`) |
| GHSA-xmf8-cvqr-rfgj | HIGH | `getToken()` throws an uncaught exception
on malformed Bearer authorization headers |
| GHSA-x445-f3h2-j279 | MEDIUM | OAuth `state`, `nonce`, and PKCE check
cookies are not bound to the provider that created them |

## Changed files

- `agentex-ui/package.json` — raised the declared floor `next-auth:
^5.0.0-beta.29` → `^5.0.0-beta.32` so a future re-lock cannot reselect
the vulnerable version.
- `agentex-ui/package-lock.json` — re-locked: `next-auth` →
`5.0.0-beta.32`, `@auth/core` → `0.41.3`. Registry URLs remain public
npm; `lockfileVersion` unchanged.

## Verification

- Version gate (OSV): `next-auth@5.0.0-beta.32` and `@auth/core@0.41.3`
both report **zero** known advisories.
- Diff scope: only the two dependency blocks + the root constraint
changed; no unrelated lock churn, no mode/format changes.
- `npm ci` (the CI immutable-install gate) succeeds — lockfile is
deterministic and in sync with `package.json`.
- `tsc --noEmit` (`npm run typecheck`) passes clean — the
beta.31→beta.32 patch bump introduces no API breakage in the app's
NextAuth v5 usage.
- Confirmed the old vulnerable tarballs (`core-0.41.2.tgz`,
`next-auth-5.0.0-beta.31.tgz`) are gone from the lockfile.

## Linear

Resolves **GFDVR-20810** (`@auth/core`) and **GFDVR-20811**
(`next-auth`).

<!-- greptile_comment -->

<h3>Greptile Summary</h3>

This PR bumps `next-auth` from `5.0.0-beta.31` to `5.0.0-beta.32` (which
pins `@auth/core` to `0.41.3`) to resolve four Auth.js advisories — two
CRITICAL, one HIGH, one MEDIUM. The diff is minimal and scoped exactly
to the two dependency files.

- **`package.json`**: version floor raised from `^5.0.0-beta.29` →
`^5.0.0-beta.32`, preventing future re-lock from pulling in the
vulnerable range.
- **`package-lock.json`**: `next-auth` and `@auth/core`
versions/integrity hashes updated; `nodemailer` peer dep range widened
to `^7.0.7 || ^8.0.5` (upstream change in beta.32, no app-level impact).

<details><summary><h3>Confidence Score: 5/5</h3></summary>

Safe to merge — the change is a minimal, targeted dependency patch with
no app code touched.

Both files change only the two expected packages (next-auth, @auth/core)
and their integrity hashes. The version floor in package.json is
correctly raised so future installs cannot regress. The only non-version
change in the lockfile (widened nodemailer peer dep range) is upstream
metadata from beta.32 and has no runtime effect on the app. No unrelated
lock churn, no API surface changes, no code logic altered.

No files require special attention.
</details>

<details><summary><h3>Important Files Changed</h3></summary>

| Filename | Overview |
|----------|----------|
| agentex-ui/package.json | Raises next-auth version floor to
^5.0.0-beta.32, preventing any future npm install from resolving the
vulnerable beta.29–beta.31 range. |
| agentex-ui/package-lock.json | Re-locks next-auth@5.0.0-beta.32 and
@auth/core@0.41.3 with updated integrity hashes; also widens the
nodemailer peer dependency range in both packages — no unrelated churn
detected. |

</details>

<details><summary><h3>Sequence Diagram</h3></summary>

```mermaid
sequenceDiagram
    participant Client
    participant NextAuth as next-auth@5.0.0-beta.32
    participant Core as @auth/core@0.41.3
    participant Provider as OAuth Provider

    Client->>NextAuth: Auth request (login / getToken)
    Note over NextAuth,Core: GHSA-xmf8: malformed Bearer no longer throws uncaught exception
    NextAuth->>Core: "Delegate to @auth/core"
    Note over Core: GHSA-7rqj: Unicode normalization applied BEFORE email validation
    Core->>Provider: OAuth flow (state/nonce/PKCE)
    Note over Core,Provider: GHSA-x445: cookies now bound to originating provider
    Provider-->>Core: Callback
    Note over Core: GHSA-8fpg: existence-based auth checks no longer fail open
    Core-->>NextAuth: Verified session/token
    NextAuth-->>Client: Auth response
```
</details>

<sub>Reviews (1): Last reviewed commit: ["fix(agentex-ui): bump
next-auth
5.0.0-be..."](4fa105e)
| [Re-trigger
Greptile](https://app.greptile.com/api/retrigger?id=46838049)</sub>

<!-- /greptile_comment -->

Co-authored-by: scale-prodsec[bot] <262621375+scale-prodsec[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Brandon Allen <brandon.allen@scale.com>

Author: 3 people

agentex-ui/package-lock.json

@@ -41,7 +41,7 @@
     "jose": "^6.0.0",
     "lucide-react": "^0.525.0",
     "next": "15.5.18",
-    "next-auth": "^5.0.0-beta.29",
+    "next-auth": "^5.0.0-beta.32",
     "next-themes": "^0.4.6",
     "react": "^19.1.1",
     "react-dom": "^19.1.1",