Dependency refresh and more reliable account security flows

Both starter kits received a coordinated dependency refresh and focused fixes for account security flows.

Updated foundation

• Updated Next.js to 16.2.12, React and React DOM to 19.2.8 and Better Auth to 1.6.25.
• Refreshed the AI, storage, observability, email, form, UI and testing packages shared by both kits.
• Updated Prisma and its PostgreSQL adapter to 7.9.0 in Pro Prisma.
• Updated Oxlint and Oxfmt while resolving the new lint findings in both applications.

Account flow fixes

• Change-email verification now returns customers to their profile settings.
• One-time password verification now submits the completed code instead of relying on a pending input state update.
• Two-factor enrollment and removal now wait for the refreshed session before closing, keeping the security settings in sync.
• Invalid two-factor codes now show a clear error instead of leaving the modal without feedback.

Verification

Both kits were tested from clean installs against isolated PostgreSQL databases. Formatting, linting, type checking, unit tests, database tests and production builds pass.

The complete Playwright suites also pass in both kits, including authenticated navigation, two-factor enrollment and sign-in, AI credit enforcement and administrator access.

Existing projects

Review the dependency changes before applying them to an existing project, then regenerate the npm lockfile and run your normal production checks. This release does not add a database migration.