chore: update some deps and fix qrcode complaint

apps/dashboard/package.json

@@ -42,8 +42,9 @@
 		"@tailwindcss/vite": "^4.3.3",
 		"@types/node": "^26.1.1",
 		"@types/pg": "^8.20.0",
+		"@types/qrcode": "^1.5.6",
 		"@typescript/native-preview": "7.0.0-dev.20260707.2",
-		"better-auth": "^1.6.23",
+		"better-auth": "^1.6.24",
 		"bits-ui": "^2.18.1",
 		"clsx": "^2.1.1",
 		"drizzle-kit": "^0.31.10",
@@ -68,9 +69,9 @@
 		"wrangler": "^4.111.0"
 	},
 	"dependencies": {
-		"@better-auth/core": "^1.6.23",
-		"@better-auth/passkey": "^1.6.23",
-		"@better-auth/telemetry": "^1.6.23",
+		"@better-auth/core": "^1.6.24",
+		"@better-auth/passkey": "^1.6.24",
+		"@better-auth/telemetry": "^1.6.24",
 		"@better-auth/utils": "^0.4.2",
 		"@better-svelte-email/components": "^2.1.1",
 		"@better-svelte-email/server": "^2.1.1",
@@ -79,9 +80,9 @@
 		"autumn-js": "1.2.33",
 		"ip-address": "^10.2.0",
 		"ky": "^2.0.2",
-		"qrcode-svg": "^1.1.0",
+		"qrcode": "^1.5.4",
 		"ulid": "^3.0.2",
-		"undici": "^8.7.0",
+		"undici": "^8.9.0",
 		"yaml": "^2.9.0"
 	}
 }

apps/dashboard/src/lib/components/dialogs/totp-onboarding-dialog.svelte

@@ -1,5 +1,5 @@
 <script lang="ts">
-	import QRCode from 'qrcode-svg';
+	import QRCode from 'qrcode';
 	import { authClient } from '$lib/auth-client';
 	import { Button } from '$lib/components/ui/button';
 	import { Input } from '$lib/components/ui/input';
@@ -28,20 +28,32 @@
 	let copiedSecret = $state(false);
 	let copiedBackup = $state(false);
 
-	let qrSvg = $derived(
-		totpUri
-			? new QRCode({
-					content: totpUri,
-					width: 180,
-					height: 180,
-					padding: 0,
-					color: '#fafafa',
-					background: '#27272a',
-					ecl: 'M'
-				}).svg()
-			: ''
-	);
-	let qrCodeSrc = $derived(qrSvg ? `data:image/svg+xml;utf8,${encodeURIComponent(qrSvg)}` : '');
+	let qrCodeSrc = $state('');
+
+	$effect(() => {
+		const uri = totpUri;
+		if (!uri) {
+			qrCodeSrc = '';
+			return;
+		}
+
+		let cancelled = false;
+		void QRCode.toDataURL(uri, {
+			width: 180,
+			margin: 0,
+			color: {
+				dark: '#fafafa',
+				light: '#27272a'
+			},
+			errorCorrectionLevel: 'M'
+		}).then((src) => {
+			if (!cancelled) qrCodeSrc = src;
+		});
+
+		return () => {
+			cancelled = true;
+		};
+	});
 	let normalizedVerifyCode = $derived(verifyCode.replace(/\D/g, ''));
 	const invalidCodeMessage =
 		'Invalid code. Use the newest scanned Fyra entry and make sure your device time is set automatically.';

apps/dashboard/src/lib/remote/password-change.remote.ts

@@ -23,8 +23,15 @@ function passwordChangePasskeyIdentifier(userId: string) {
 
 function generateCode() {
 	const max = 10 ** CODE_LENGTH;
-	const value = crypto.getRandomValues(new Uint32Array(1))[0] % max;
-	return value.toString().padStart(CODE_LENGTH, '0');
+	const range = 2 ** 32;
+	const limit = range - (range % max);
+	const values = new Uint32Array(1);
+
+	do {
+		crypto.getRandomValues(values);
+	} while (values[0] >= limit);
+
+	return (values[0] % max).toString().padStart(CODE_LENGTH, '0');
 }
 
 async function hashCode(userId: string, code: string) {