Cannot add scopes as described in the docs

Environment

  System:
    OS: macOS 15.1.1
    CPU: (8) arm64 Apple M1 Pro
    Memory: 710.05 MB / 16.00 GB
    Shell: 5.9 - /bin/zsh
  Binaries:
    Node: 22.12.0 - /opt/homebrew/opt/node@22/bin/node
    npm: 10.9.0 - /opt/homebrew/opt/node@22/bin/npm
    pnpm: 9.15.0 - /opt/homebrew/bin/pnpm
    bun: 1.1.40 - /opt/homebrew/bin/bun
  Browsers:
    Chrome: 131.0.6778.205
    Safari: 18.1.1
  npmPackages:
    next: 15.1.3 => 15.1.3 
    next-auth: ^5.0.0-beta.25 => 5.0.0-beta.25 
    react: ^19.0.0 => 19.0.0 

Reproduction URL

https://github.com/rhufsky/authdemo

Describe the issue

The document https://authjs.dev/guides/configuring-oauth-providers states that requesting additional scopes can be implemented by just adding a property to the provider like so:

    GitLab({
      authorization: {
        params: { scope: "read_user api" },
      }
    }),

The modified properties should be deep merged into the defaults.

In reality, when doing this, i get an exception like this at login time:

[auth][error] TypeError: Invalid URL
    at new URL (node:internal/url:818:25)
    at getAuthorizationUrl (/Users/rhufsky/Documents/Development/HTL-IT/Experimental-Applications/authdemo/.next/server/chunks/ssr/node_modules_c31d8c._.js:11189:24)

Adding the original AUTH_URL to the config solves the problem, so no deep merging, at least in the Gitlab Provider.

const GITLAB_OAUTH_SCOPES = "read_user";
const GITLAB_AUTH_URL = "https://gitlab.com/oauth/authorize";

export const { handlers, auth, signIn, signOut } = NextAuth({
  providers: [
    GitLab({
      authorization: {
        url: GITLAB_AUTH_URL,
        params: { scope: GITLAB_OAUTH_SCOPES },
      },
    }),
  ],

How to reproduce

In the sample, comment out url: GITLAB_AUTH_URL, and try top log in.

Expected behavior

In should not be neccesary to add url: GITLAB_AUTH_URL, when I want to configure scopes.

Start with the GitLab provider configuration shown in the issue and the getAuthorizationUrl entry point from the stack trace. Reproduce the login flow from the linked authdemo with authorization.params.scope but without authorization.url, then verify that adding scopes no longer causes an Invalid URL error and that the documented configuration works.