fix(core): preserve string-shorthand endpoint URL when merging a partial config override

[HeroCode007]

☕️ Reasoning

authorization, token, and userinfo accept a string shorthand for just the endpoint URL (e.g. Spotify's default: "https://accounts.spotify.com/authorize?scope=user-read-email"). When a user overrides only part of that config — e.g. authorization: { params: { scope } }, without a new url, exactly as the docs for customizing a built-in OAuth provider recommend — merge() sees a string default next to an object override and can't combine them, so it silently resets the target to {} and discards the string default entirely. The base URL is lost, and normalizeEndpoint falls back to its hardcoded placeholder (https://authjs.dev) instead of the real provider endpoint.

This is the scenario originally reported in #9448 (Discord provider, scope override). A related direction of this bug (object default overridden by a string) was fixed in #11685, but that fix doesn't cover this case — I confirmed it's still reproducible today, straight from main:

// packages/core/src/providers/spotify.ts default:
authorization: "https://accounts.spotify.com/authorize?scope=user-read-email"

// user override, per the docs:
authorization: { params: { scope: "user-read-email playlist-read-private" } }

// => before this fix, final authorization URL:
// https://authjs.dev/?scope=user-read-email+playlist-read-private

Fix

Rather than changing merge() itself (which is a generic deep-merge utility with no URL-specific knowledge), this promotes a string-shorthand default to { url } before merging, in parseProviders, which already owns the domain knowledge that authorization/token/userinfo support this shorthand. Both sides of the merge are then objects, so merge() combines them correctly instead of discarding one.

After the fix, the same scenario produces:

https://accounts.spotify.com/authorize?scope=user-read-email+playlist-read-private

Verified this doesn't affect the two existing merge-direction cases already covered in merge.test.ts (string target fully replaced by an object override that includes its own url, and object target replaced by a string override).

🧢 Checklist

• Documentation
• Tests
• Ready to be merged

🎫 Affected issues

Fixes: #9448

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
auth-docs	Ready	Preview	Sep 6, 2026 6:14pm UTC

1 Skipped Deployment

Project	Deployment	Actions	Updated
next-auth-docs	Ignored	Preview	Sep 6, 2026 6:14pm UTC

[vercel]

Someone is attempting to deploy a commit to the authjs Team on Vercel.

A member of the Team first needs to authorize it.