4.0.0-beta.7 breaks grype scanning

[WTPOptAxe]

Checklist

• The issue can be reproduced in the nextjs-auth0 sample app (or N/A).
• I have looked into the Readme, Examples, and FAQ and have not found a suitable solution or answer.
• I have looked into the API documentation and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Description

When upgrading from 3.5 to 4.0.0-beta.7, grype scanning breaks for auth0/nextjs-auth0 and next. Installed versions are misreported, and fixed versions are older than we have installed.

The incorrect output from the repro below is as follows

NAME                 INSTALLED                     FIXED-IN           TYPE  VULNERABILITY        SEVERITY
@auth0/nextjs-auth0  file:../..                    1.4.2              npm   GHSA-954c-jjx6-cxv7  High
@auth0/nextjs-auth0  file:../..                    1.6.2              npm   GHSA-2mqv-4j3r-vjvp  Medium
@eslint/plugin-kit   0.2.2                         0.2.3              npm   GHSA-7q7g-4xm8-89cq  Low
cross-spawn          7.0.3                         7.0.5              npm   GHSA-3xgq-45jj-v275  High
next                 file:../../node_modules/next  5.1.0              npm   GHSA-5vj8-3v2h-h38v  High
next                 file:../../node_modules/next  11.1.3             npm   GHSA-25mp-g6fv-mqxx  High
next                 file:../../node_modules/next  11.1.0             npm   GHSA-vxf5-wxwp-m7g9  Medium
next                 file:../../node_modules/next  9.3.2              npm   GHSA-fq77-7p7r-83rj  Medium
next                 file:../../node_modules/next  13.4.20-canary.13  npm   GHSA-c59h-r6p8-q9wc  Low

We expect this output to be

NAME                 INSTALLED                     FIXED-IN           TYPE  VULNERABILITY        SEVERITY
@eslint/plugin-kit   0.2.2                         0.2.3              npm   GHSA-7q7g-4xm8-89cq  Low
cross-spawn          7.0.3                         7.0.5              npm   GHSA-3xgq-45jj-v275  High

Reproduction

yarn create next-app grypetest --no-install
cd grypetest
corepack enable
yarn set version stable
yarn install
grype . # all good at this point
# add `"@auth0/nextjs-auth0": "^4.0.0-beta.7",` to package.json
yarn install
grype . # gives incorrect responses

Additional context

No response

nextjs-auth0 version

4.0.0-beta.7

Next.js version

15.0.3

Node.js version

v22.11.0

[guabu]

Hey @WTPOptAxe 👋 Thanks for reporting this! We've included a fix in the upcoming release to exclude non-dist files which were triggering the errors reported.

[nandan-bhat]

This issue is fixed on 4.0.0-beta.10. Closing this ticket.