github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-08-24 14:34:26 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

chore: release v1.7.0-rc.2 (#10327)

Browse Source
This commit is contained in:
better-release[bot]
2026-07-22 15:51:41 -04:00
committed by GitHub
parent 973fdde79d
commit cc708e51bc
45 changed files with 243 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.changeset/pre.json
+12
View File
@@ -39,11 +39,13 @@
"cli-requires-node-22",
"cloudflare-create-require-runtime",
"code-replay-invalid-grant",
"compound-database-indexes",
"consume-phone-number-otp",
"cool-lights-burn",
"create-initial-admin-cli",
"dcr-graceful-override-confidential",
"dcr-pkce-policy",
"drizzle-relations-v2-schema-name",
"dynamic-baseurl-hardening",
"fiery-guests-visit",
"fix-2fa-bypass",
@@ -62,10 +64,14 @@
"honest-regions-jam",
"honest-symbols-stick",
"host-classifier-ssrf-hardening",
"hungry-camels-listen",
"hungry-drinks-read",
"i18n-built-in-translations",
"id-token-claim-authority",
"issuer-scoped-account-identities",
"joins-out-of-experimental",
"kysely-migrate-add-column-defaults",
"kysely-migration-constants",
"lovely-toes-swim",
"mcp-oauth-provider-migration",
"microsoft-client-assertion",
@@ -89,6 +95,7 @@
"oauth-signup-transaction",
"oidc-id-token-userinfo-claims",
"oidc-offline-access-nonce",
"organization-get-organization",
"pr-8926",
"pr-8931",
"pr-8977",
@@ -108,10 +115,14 @@
"restore-stripe-cancel-event-required",
"safe-url-runtime-fragment",
"saml-response-validation-hardening",
"schema-preserving-sso-user-resolution",
"scim-active-user-link",
"scim-decoupled-provisioning",
"scim-group-resources",
"scim-org-scoped-connections",
"scim-personal-provider-ownership",
"silver-gardens-wander",
"siwe-addressless-nonces",
"social-auth-validation",
"sso-oidc-manual-redirects",
"sso-provider-additional-fields",
@@ -119,6 +130,7 @@
"sso-saml-model-split",
"sso-upgrade-samlify",
"strict-one-tap-audience",
"tidy-ravens-revoke",
"tighten-adapter-peerdeps",
"two-factor-otp-enable",
"userinfo-form-body-token",
packages/api-key/CHANGELOG.md
+2
View File
@@ -1,5 +1,7 @@
# @better-auth/api-key
## 1.7.0-rc.2
## 1.7.0-rc.1
## 1.7.0-rc.0
packages/api-key/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@better-auth/api-key",
"version": "1.7.0-rc.1",
"version": "1.7.0-rc.2",
"description": "API Key plugin for Better Auth.",
"type": "module",
"license": "MIT",
packages/better-auth/CHANGELOG.md
+55
View File
@@ -1,5 +1,60 @@
# better-auth
## 1.7.0-rc.2
### Minor Changes
- [#10402](https://github.com/better-auth/better-auth/pull/10402) [`763a267`](https://github.com/better-auth/better-auth/commit/763a2671c5372d88c291881977c8a1c2e29034b1) Thanks [@gustavovalverde](https://github.com/gustavovalverde)! - Plugin database schemas can now define named or generated table-level indexes across multiple fields. SQL migrations and generated Drizzle or Prisma schemas resolve configured table and column names consistently, while the MongoDB adapter creates the same indexes before the first index-enforcing write.
- [#10403](https://github.com/better-auth/better-auth/pull/10403) [`dbd302e`](https://github.com/better-auth/better-auth/commit/dbd302e422c66620cde391f6a80ab90ee34182f9) Thanks [@gustavovalverde](https://github.com/gustavovalverde)! - Scope account identity by trusted issuer instead of provider configuration. Accounts now use the unique `(issuer, providerAccountId)` key, so aliases for one OpenID Connect issuer deduplicate one external identity while equal subjects from different issuers remain separate. This identity deduplication does not introduce independent grant or provider lifecycle records for aliases.
This release is breaking. `Account.accountId` is renamed to `Account.providerAccountId`, and `Account.issuer` is required. Account-specific APIs select the local `Account.id` through `accountId`; token and provider-profile APIs can instead select the signed account cookie with `useAccountCookie: true`. Credential accounts use `local:credential` and the linked user's stable `id` as their provider identity.
OAuth provider identity now comes from raw verified profiles. OpenID Connect discovery uses `sub`, plain OAuth uses `id`, and providers can declare `accountSubject` for another immutable field; Better Auth no longer switches between `sub` and `id` at runtime. `getUserInfo().user` no longer carries provider identity, and `mapProfileToUser` cannot return `id`. Read the selected identity from `accountInfo.account.providerAccountId` instead of `accountInfo.user.id`. The generic `microsoftEntraId` helper now requires a concrete tenant GUID; use the built-in Microsoft provider for multi-tenant authorities.
SSO account subjects are now protocol-defined. OIDC uses the verified `sub` claim, and SAML uses the signed `NameID`; `mapping.id` is removed from both configurations. A manual SAML configuration without metadata XML must set `idpMetadata.entityID`, because `samlConfig.issuer` identifies the service provider and no longer acts as the IdP identity.
Apply the reviewed account-identity backfill in the Better Auth 1.7 upgrade guide before deploying. The generated schema migration cannot assign trusted issuers or resolve existing identity collisions automatically.
- [#10359](https://github.com/better-auth/better-auth/pull/10359) [`8784c1c`](https://github.com/better-auth/better-auth/commit/8784c1c1f4301acf96d980e5bf81ff56435e2545) Thanks [@ping-maxwell](https://github.com/ping-maxwell)! - Database joins have moved out of `experimental` into a stable option at `advanced.database.joins` (default: `false`).
If you previously set `experimental: { joins: true }`, update your config to:
```ts
advanced: {
database: {
joins: true,
},
}
```
Adapters that support native joins use them when enabled. If an adapter cannot return joined data for a query, Better Auth falls back to additional queries and combines the results. Drizzle and Prisma users should ensure their schema includes the required relations (`npx auth@latest generate`).
- [#10397](https://github.com/better-auth/better-auth/pull/10397) [`bb6c102`](https://github.com/better-auth/better-auth/commit/bb6c1021e8f6200e60ff852cbd95fb6841a0ec4b) Thanks [@ping-maxwell](https://github.com/ping-maxwell)! - Add `organization.getOrganization()` to fetch organization metadata without members or invitations.
- [#10473](https://github.com/better-auth/better-auth/pull/10473) [`ed61b47`](https://github.com/better-auth/better-auth/commit/ed61b4798e0ccedadc3b0c0e0a2d08b5d4b7ed5a) Thanks [@gustavovalverde](https://github.com/gustavovalverde)! - Add transactional OIDC user resolution so applications can link verified issuer and subject pairs to exact existing users while preserving or updating the local profile.
- [#10234](https://github.com/better-auth/better-auth/pull/10234) [`973fdde`](https://github.com/better-auth/better-auth/commit/973fdde79d9746b15d5ac0427049e8a008a7705c) Thanks [@gustavovalverde](https://github.com/gustavovalverde)! - The SIWE plugin now issues nonces before the wallet address or Chain ID is known. `authClient.siwe.nonce()` and `authClient.siwe.getNonce()` no longer accept wallet fields, `getNonce` must return an ERC-4361 nonce (8-250 alphanumeric characters), and SIWE verification now reads the wallet address and Chain ID from the signed ERC-4361 message.
### Patch Changes
- [#10299](https://github.com/better-auth/better-auth/pull/10299) [`cf8eaac`](https://github.com/better-auth/better-auth/commit/cf8eaac26e11bcdb7309d537f1730b2559963861) Thanks [@momomuchu](https://github.com/momomuchu)! - widen drizzle-kit peer dependency range
- [#10390](https://github.com/better-auth/better-auth/pull/10390) [`0de88f5`](https://github.com/better-auth/better-auth/commit/0de88f5e61d96f460e02b8a526e58acb16455d15) Thanks [@gustavovalverde](https://github.com/gustavovalverde)! - SCIM connections can now provision Users, Groups, and direct memberships into application-defined provisioning domains without the organization or SSO plugins. Applications can map Group membership to validated custom roles through projections. The service also supports SCIM 2.0 discovery, filtering, pagination, response attribute selection, atomic PATCH operations, and common request patterns used by Microsoft Entra ID and Okta.
This replaces the previous SCIM configuration, client APIs, database schema, and organization-backed Group model. Existing SCIM installations cannot migrate provisioning state in place. Follow the SCIM cutover in the 1.7 upgrade guide, including full directory reprovisioning, before resuming traffic.
Deferred database side effects now run only after a successful transaction. A rolled-back User update no longer refreshes its cached profile, and a rolled-back bulk session revocation no longer invalidates sessions.
- Updated dependencies [[`763a267`](https://github.com/better-auth/better-auth/commit/763a2671c5372d88c291881977c8a1c2e29034b1), [`5d38b13`](https://github.com/better-auth/better-auth/commit/5d38b138c3c73eb06fe247ef6631c66e86ccc92b), [`dbd302e`](https://github.com/better-auth/better-auth/commit/dbd302e422c66620cde391f6a80ab90ee34182f9), [`8784c1c`](https://github.com/better-auth/better-auth/commit/8784c1c1f4301acf96d980e5bf81ff56435e2545), [`e4818b5`](https://github.com/better-auth/better-auth/commit/e4818b545984dce99e3c798ead5691c5bf775a70), [`ed61b47`](https://github.com/better-auth/better-auth/commit/ed61b4798e0ccedadc3b0c0e0a2d08b5d4b7ed5a), [`0de88f5`](https://github.com/better-auth/better-auth/commit/0de88f5e61d96f460e02b8a526e58acb16455d15)]:
- @better-auth/core@1.7.0-rc.2
- @better-auth/drizzle-adapter@1.7.0-rc.2
- @better-auth/mongo-adapter@1.7.0-rc.2
- @better-auth/kysely-adapter@1.7.0-rc.2
- @better-auth/memory-adapter@1.7.0-rc.2
- @better-auth/prisma-adapter@1.7.0-rc.2
- @better-auth/telemetry@1.7.0-rc.2
## 1.7.0-rc.1
### Patch Changes
packages/better-auth/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "better-auth",
"version": "1.7.0-rc.1",
"version": "1.7.0-rc.2",
"description": "The most comprehensive authentication framework for TypeScript.",
"type": "module",
"license": "MIT",
packages/cimd/CHANGELOG.md
+2
View File
@@ -1,5 +1,7 @@
# @better-auth/cimd
## 1.7.0-rc.2
## 1.7.0-rc.1
## 1.7.0-rc.0
packages/cimd/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@better-auth/cimd",
"version": "1.7.0-rc.1",
"version": "1.7.0-rc.2",
"description": "Client ID Metadata Document plugin for Better Auth",
"type": "module",
"license": "MIT",
packages/cli/CHANGELOG.md
+13
View File
@@ -1,5 +1,18 @@
# auth
## 1.7.0-rc.2
### Minor Changes
- [#10402](https://github.com/better-auth/better-auth/pull/10402) [`763a267`](https://github.com/better-auth/better-auth/commit/763a2671c5372d88c291881977c8a1c2e29034b1) Thanks [@gustavovalverde](https://github.com/gustavovalverde)! - Plugin database schemas can now define named or generated table-level indexes across multiple fields. SQL migrations and generated Drizzle or Prisma schemas resolve configured table and column names consistently, while the MongoDB adapter creates the same indexes before the first index-enforcing write.
### Patch Changes
- Updated dependencies [[`763a267`](https://github.com/better-auth/better-auth/commit/763a2671c5372d88c291881977c8a1c2e29034b1), [`cf8eaac`](https://github.com/better-auth/better-auth/commit/cf8eaac26e11bcdb7309d537f1730b2559963861), [`dbd302e`](https://github.com/better-auth/better-auth/commit/dbd302e422c66620cde391f6a80ab90ee34182f9), [`8784c1c`](https://github.com/better-auth/better-auth/commit/8784c1c1f4301acf96d980e5bf81ff56435e2545), [`bb6c102`](https://github.com/better-auth/better-auth/commit/bb6c1021e8f6200e60ff852cbd95fb6841a0ec4b), [`ed61b47`](https://github.com/better-auth/better-auth/commit/ed61b4798e0ccedadc3b0c0e0a2d08b5d4b7ed5a), [`0de88f5`](https://github.com/better-auth/better-auth/commit/0de88f5e61d96f460e02b8a526e58acb16455d15), [`973fdde`](https://github.com/better-auth/better-auth/commit/973fdde79d9746b15d5ac0427049e8a008a7705c)]:
- @better-auth/core@1.7.0-rc.2
- better-auth@1.7.0-rc.2
- @better-auth/telemetry@1.7.0-rc.2
## 1.7.0-rc.1
### Patch Changes
packages/cli/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "auth",
"version": "1.7.0-rc.1",
"version": "1.7.0-rc.2",
"description": "The CLI for Better Auth",
"type": "module",
"license": "MIT",
packages/core/CHANGELOG.md
+40
View File
@@ -1,5 +1,45 @@
# @better-auth/core
## 1.7.0-rc.2
### Minor Changes
- [#10402](https://github.com/better-auth/better-auth/pull/10402) [`763a267`](https://github.com/better-auth/better-auth/commit/763a2671c5372d88c291881977c8a1c2e29034b1) Thanks [@gustavovalverde](https://github.com/gustavovalverde)! - Plugin database schemas can now define named or generated table-level indexes across multiple fields. SQL migrations and generated Drizzle or Prisma schemas resolve configured table and column names consistently, while the MongoDB adapter creates the same indexes before the first index-enforcing write.
- [#10403](https://github.com/better-auth/better-auth/pull/10403) [`dbd302e`](https://github.com/better-auth/better-auth/commit/dbd302e422c66620cde391f6a80ab90ee34182f9) Thanks [@gustavovalverde](https://github.com/gustavovalverde)! - Scope account identity by trusted issuer instead of provider configuration. Accounts now use the unique `(issuer, providerAccountId)` key, so aliases for one OpenID Connect issuer deduplicate one external identity while equal subjects from different issuers remain separate. This identity deduplication does not introduce independent grant or provider lifecycle records for aliases.
This release is breaking. `Account.accountId` is renamed to `Account.providerAccountId`, and `Account.issuer` is required. Account-specific APIs select the local `Account.id` through `accountId`; token and provider-profile APIs can instead select the signed account cookie with `useAccountCookie: true`. Credential accounts use `local:credential` and the linked user's stable `id` as their provider identity.
OAuth provider identity now comes from raw verified profiles. OpenID Connect discovery uses `sub`, plain OAuth uses `id`, and providers can declare `accountSubject` for another immutable field; Better Auth no longer switches between `sub` and `id` at runtime. `getUserInfo().user` no longer carries provider identity, and `mapProfileToUser` cannot return `id`. Read the selected identity from `accountInfo.account.providerAccountId` instead of `accountInfo.user.id`. The generic `microsoftEntraId` helper now requires a concrete tenant GUID; use the built-in Microsoft provider for multi-tenant authorities.
SSO account subjects are now protocol-defined. OIDC uses the verified `sub` claim, and SAML uses the signed `NameID`; `mapping.id` is removed from both configurations. A manual SAML configuration without metadata XML must set `idpMetadata.entityID`, because `samlConfig.issuer` identifies the service provider and no longer acts as the IdP identity.
Apply the reviewed account-identity backfill in the Better Auth 1.7 upgrade guide before deploying. The generated schema migration cannot assign trusted issuers or resolve existing identity collisions automatically.
- [#10359](https://github.com/better-auth/better-auth/pull/10359) [`8784c1c`](https://github.com/better-auth/better-auth/commit/8784c1c1f4301acf96d980e5bf81ff56435e2545) Thanks [@ping-maxwell](https://github.com/ping-maxwell)! - Database joins have moved out of `experimental` into a stable option at `advanced.database.joins` (default: `false`).
If you previously set `experimental: { joins: true }`, update your config to:
```ts
advanced: {
database: {
joins: true,
},
}
```
Adapters that support native joins use them when enabled. If an adapter cannot return joined data for a query, Better Auth falls back to additional queries and combines the results. Drizzle and Prisma users should ensure their schema includes the required relations (`npx auth@latest generate`).
- [#10473](https://github.com/better-auth/better-auth/pull/10473) [`ed61b47`](https://github.com/better-auth/better-auth/commit/ed61b4798e0ccedadc3b0c0e0a2d08b5d4b7ed5a) Thanks [@gustavovalverde](https://github.com/gustavovalverde)! - Add transactional OIDC user resolution so applications can link verified issuer and subject pairs to exact existing users while preserving or updating the local profile.
### Patch Changes
- [#10390](https://github.com/better-auth/better-auth/pull/10390) [`0de88f5`](https://github.com/better-auth/better-auth/commit/0de88f5e61d96f460e02b8a526e58acb16455d15) Thanks [@gustavovalverde](https://github.com/gustavovalverde)! - SCIM connections can now provision Users, Groups, and direct memberships into application-defined provisioning domains without the organization or SSO plugins. Applications can map Group membership to validated custom roles through projections. The service also supports SCIM 2.0 discovery, filtering, pagination, response attribute selection, atomic PATCH operations, and common request patterns used by Microsoft Entra ID and Okta.
This replaces the previous SCIM configuration, client APIs, database schema, and organization-backed Group model. Existing SCIM installations cannot migrate provisioning state in place. Follow the SCIM cutover in the 1.7 upgrade guide, including full directory reprovisioning, before resuming traffic.
Deferred database side effects now run only after a successful transaction. A rolled-back User update no longer refreshes its cached profile, and a rolled-back bulk session revocation no longer invalidates sessions.
## 1.7.0-rc.1
## 1.7.0-rc.0
packages/core/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@better-auth/core",
"version": "1.7.0-rc.1",
"version": "1.7.0-rc.2",
"description": "The most comprehensive authentication framework for TypeScript.",
"type": "module",
"license": "MIT",
packages/drizzle-adapter/CHANGELOG.md
+22
View File
@@ -1,5 +1,27 @@
# @better-auth/drizzle-adapter
## 1.7.0-rc.2
### Minor Changes
- [#10402](https://github.com/better-auth/better-auth/pull/10402) [`763a267`](https://github.com/better-auth/better-auth/commit/763a2671c5372d88c291881977c8a1c2e29034b1) Thanks [@gustavovalverde](https://github.com/gustavovalverde)! - Plugin database schemas can now define named or generated table-level indexes across multiple fields. SQL migrations and generated Drizzle or Prisma schemas resolve configured table and column names consistently, while the MongoDB adapter creates the same indexes before the first index-enforcing write.
- [#7169](https://github.com/better-auth/better-auth/pull/7169) [`5d38b13`](https://github.com/better-auth/better-auth/commit/5d38b138c3c73eb06fe247ef6631c66e86ccc92b) Thanks [@ping-maxwell](https://github.com/ping-maxwell)! - Add a `schemaName` option to the Drizzle Relations v2 adapter config. When set on PostgreSQL, schema generation now emits a `pgSchema("...")` namespace and uses namespaced table definitions (for example, `authSchema.user(...)`), matching the v1 CLI generator behavior.
- [#10359](https://github.com/better-auth/better-auth/pull/10359) [`8784c1c`](https://github.com/better-auth/better-auth/commit/8784c1c1f4301acf96d980e5bf81ff56435e2545) Thanks [@ping-maxwell](https://github.com/ping-maxwell)! - Database joins have moved out of `experimental` into a stable option at `advanced.database.joins` (default: `false`).
If you previously set `experimental: { joins: true }`, update your config to:
```ts
advanced: {
database: {
joins: true,
},
}
```
Adapters that support native joins use them when enabled. If an adapter cannot return joined data for a query, Better Auth falls back to additional queries and combines the results. Drizzle and Prisma users should ensure their schema includes the required relations (`npx auth@latest generate`).
## 1.7.0-rc.1
## 1.7.0-rc.0
packages/drizzle-adapter/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@better-auth/drizzle-adapter",
"version": "1.7.0-rc.1",
"version": "1.7.0-rc.2",
"bugs": {
"url": "https://github.com/better-auth/better-auth/issues"
},
packages/electron/CHANGELOG.md
+2
View File
@@ -1,5 +1,7 @@
# @better-auth/electron
## 1.7.0-rc.2
## 1.7.0-rc.1
## 1.7.0-rc.0
packages/electron/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@better-auth/electron",
"version": "1.7.0-rc.1",
"version": "1.7.0-rc.2",
"description": "Better Auth integration for Electron applications.",
"type": "module",
"license": "MIT",
packages/expo/CHANGELOG.md
+2
View File
@@ -1,5 +1,7 @@
# @better-auth/expo
## 1.7.0-rc.2
## 1.7.0-rc.1
## 1.7.0-rc.0
packages/expo/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@better-auth/expo",
"version": "1.7.0-rc.1",
"version": "1.7.0-rc.2",
"description": "Better Auth integration for Expo and React Native applications.",
"type": "module",
"license": "MIT",
packages/i18n/CHANGELOG.md
+2
View File
@@ -1,5 +1,7 @@
# @better-auth/i18n
## 1.7.0-rc.2
## 1.7.0-rc.1
## 1.7.0-rc.0
packages/i18n/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@better-auth/i18n",
"version": "1.7.0-rc.1",
"version": "1.7.0-rc.2",
"description": "i18n plugin for Better Auth - translate error messages",
"type": "module",
"license": "MIT",
packages/kysely-adapter/CHANGELOG.md
+6
View File
@@ -1,5 +1,11 @@
# @better-auth/kysely-adapter
## 1.7.0-rc.2
### Patch Changes
- [#10377](https://github.com/better-auth/better-auth/pull/10377) [`e4818b5`](https://github.com/better-auth/better-auth/commit/e4818b545984dce99e3c798ead5691c5bf775a70) Thanks [@ping-maxwell](https://github.com/ping-maxwell)! - Fix SQLite dialect bundles with Kysely 0.29 by using locally mirrored migration-table constants.
## 1.7.0-rc.1
## 1.7.0-rc.0
packages/kysely-adapter/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@better-auth/kysely-adapter",
"version": "1.7.0-rc.1",
"version": "1.7.0-rc.2",
"description": "Kysely adapter for Better Auth",
"type": "module",
"license": "MIT",
packages/mcp/CHANGELOG.md
+7
View File
@@ -1,5 +1,12 @@
# @better-auth/mcp
## 1.7.0-rc.2
### Patch Changes
- Updated dependencies [[`69acb7a`](https://github.com/better-auth/better-auth/commit/69acb7a3db3cd148a9cd1db5063dbdc69909165a)]:
- @better-auth/oauth-provider@1.7.0-rc.2
## 1.7.0-rc.1
### Patch Changes
packages/mcp/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@better-auth/mcp",
"version": "1.7.0-rc.1",
"version": "1.7.0-rc.2",
"description": "Model Context Protocol (MCP) plugin for Better Auth",
"type": "module",
"license": "MIT",
packages/memory-adapter/CHANGELOG.md
+2
View File
@@ -1,5 +1,7 @@
# @better-auth/memory-adapter
## 1.7.0-rc.2
## 1.7.0-rc.1
## 1.7.0-rc.0
packages/memory-adapter/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@better-auth/memory-adapter",
"version": "1.7.0-rc.1",
"version": "1.7.0-rc.2",
"description": "Memory adapter for Better Auth",
"type": "module",
"license": "MIT",
packages/mongo-adapter/CHANGELOG.md
+6
View File
@@ -1,5 +1,11 @@
# @better-auth/mongo-adapter
## 1.7.0-rc.2
### Minor Changes
- [#10402](https://github.com/better-auth/better-auth/pull/10402) [`763a267`](https://github.com/better-auth/better-auth/commit/763a2671c5372d88c291881977c8a1c2e29034b1) Thanks [@gustavovalverde](https://github.com/gustavovalverde)! - Plugin database schemas can now define named or generated table-level indexes across multiple fields. SQL migrations and generated Drizzle or Prisma schemas resolve configured table and column names consistently, while the MongoDB adapter creates the same indexes before the first index-enforcing write.
## 1.7.0-rc.1
## 1.7.0-rc.0
packages/mongo-adapter/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@better-auth/mongo-adapter",
"version": "1.7.0-rc.1",
"version": "1.7.0-rc.2",
"description": "Mongo adapter for Better Auth",
"type": "module",
"license": "MIT",
packages/oauth-provider/CHANGELOG.md
+6
View File
@@ -1,5 +1,11 @@
# @better-auth/oauth-provider
## 1.7.0-rc.2
### Patch Changes
- [#10472](https://github.com/better-auth/better-auth/pull/10472) [`69acb7a`](https://github.com/better-auth/better-auth/commit/69acb7a3db3cd148a9cd1db5063dbdc69909165a) Thanks [@gustavovalverde](https://github.com/gustavovalverde)! - Revoke session-bound OAuth tokens and deliver back-channel logout only after the related session deletion succeeds.
## 1.7.0-rc.1
## 1.7.0-rc.0
packages/oauth-provider/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@better-auth/oauth-provider",
"version": "1.7.0-rc.1",
"version": "1.7.0-rc.2",
"description": "An oauth provider plugin for Better Auth",
"type": "module",
"license": "MIT",
packages/passkey/CHANGELOG.md
+2
View File
@@ -1,5 +1,7 @@
# @better-auth/passkey
## 1.7.0-rc.2
## 1.7.0-rc.1
## 1.7.0-rc.0
packages/passkey/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@better-auth/passkey",
"version": "1.7.0-rc.1",
"version": "1.7.0-rc.2",
"description": "Passkey plugin for Better Auth",
"type": "module",
"license": "MIT",
packages/prisma-adapter/CHANGELOG.md
+2
View File
@@ -1,5 +1,7 @@
# @better-auth/prisma-adapter
## 1.7.0-rc.2
## 1.7.0-rc.1
## 1.7.0-rc.0
packages/prisma-adapter/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@better-auth/prisma-adapter",
"version": "1.7.0-rc.1",
"version": "1.7.0-rc.2",
"description": "Prisma adapter for Better Auth",
"type": "module",
"license": "MIT",
packages/redis-storage/CHANGELOG.md
+2
View File
@@ -1,5 +1,7 @@
# @better-auth/redis-storage
## 1.7.0-rc.2
## 1.7.0-rc.1
## 1.7.0-rc.0
packages/redis-storage/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@better-auth/redis-storage",
"version": "1.7.0-rc.1",
"version": "1.7.0-rc.2",
"description": "Redis storage for Better Auth secondary storage",
"type": "module",
"license": "MIT",
packages/scim/CHANGELOG.md
+14
View File
@@ -1,5 +1,19 @@
# @better-auth/scim
## 1.7.0-rc.2
### Minor Changes
- [#10474](https://github.com/better-auth/better-auth/pull/10474) [`dec763e`](https://github.com/better-auth/better-auth/commit/dec763ef2c5af1217888a4d7f3e8b6815cd0df52) Thanks [@gustavovalverde](https://github.com/gustavovalverde)! - Add `acquireActiveSCIMUserLink` for transaction-safe authentication of provisioned users. The helper maps an exact SCIM connection ID and `externalId` to an active Better Auth User while fencing concurrent subject changes, deactivation, deletion, and connection decommissioning.
Compose the helper with SSO `resolveUser` to link the provisioned User without matching by email or `userName`.
- [#10390](https://github.com/better-auth/better-auth/pull/10390) [`0de88f5`](https://github.com/better-auth/better-auth/commit/0de88f5e61d96f460e02b8a526e58acb16455d15) Thanks [@gustavovalverde](https://github.com/gustavovalverde)! - SCIM connections can now provision Users, Groups, and direct memberships into application-defined provisioning domains without the organization or SSO plugins. Applications can map Group membership to validated custom roles through projections. The service also supports SCIM 2.0 discovery, filtering, pagination, response attribute selection, atomic PATCH operations, and common request patterns used by Microsoft Entra ID and Okta.
This replaces the previous SCIM configuration, client APIs, database schema, and organization-backed Group model. Existing SCIM installations cannot migrate provisioning state in place. Follow the SCIM cutover in the 1.7 upgrade guide, including full directory reprovisioning, before resuming traffic.
Deferred database side effects now run only after a successful transaction. A rolled-back User update no longer refreshes its cached profile, and a rolled-back bulk session revocation no longer invalidates sessions.
## 1.7.0-rc.1
## 1.7.0-rc.0
packages/scim/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@better-auth/scim",
"version": "1.7.0-rc.1",
"version": "1.7.0-rc.2",
"description": "SCIM plugin for Better Auth",
"type": "module",
"license": "MIT",
packages/sso/CHANGELOG.md
+16
View File
@@ -1,5 +1,21 @@
# @better-auth/sso
## 1.7.0-rc.2
### Minor Changes
- [#10403](https://github.com/better-auth/better-auth/pull/10403) [`dbd302e`](https://github.com/better-auth/better-auth/commit/dbd302e422c66620cde391f6a80ab90ee34182f9) Thanks [@gustavovalverde](https://github.com/gustavovalverde)! - Scope account identity by trusted issuer instead of provider configuration. Accounts now use the unique `(issuer, providerAccountId)` key, so aliases for one OpenID Connect issuer deduplicate one external identity while equal subjects from different issuers remain separate. This identity deduplication does not introduce independent grant or provider lifecycle records for aliases.
This release is breaking. `Account.accountId` is renamed to `Account.providerAccountId`, and `Account.issuer` is required. Account-specific APIs select the local `Account.id` through `accountId`; token and provider-profile APIs can instead select the signed account cookie with `useAccountCookie: true`. Credential accounts use `local:credential` and the linked user's stable `id` as their provider identity.
OAuth provider identity now comes from raw verified profiles. OpenID Connect discovery uses `sub`, plain OAuth uses `id`, and providers can declare `accountSubject` for another immutable field; Better Auth no longer switches between `sub` and `id` at runtime. `getUserInfo().user` no longer carries provider identity, and `mapProfileToUser` cannot return `id`. Read the selected identity from `accountInfo.account.providerAccountId` instead of `accountInfo.user.id`. The generic `microsoftEntraId` helper now requires a concrete tenant GUID; use the built-in Microsoft provider for multi-tenant authorities.
SSO account subjects are now protocol-defined. OIDC uses the verified `sub` claim, and SAML uses the signed `NameID`; `mapping.id` is removed from both configurations. A manual SAML configuration without metadata XML must set `idpMetadata.entityID`, because `samlConfig.issuer` identifies the service provider and no longer acts as the IdP identity.
Apply the reviewed account-identity backfill in the Better Auth 1.7 upgrade guide before deploying. The generated schema migration cannot assign trusted issuers or resolve existing identity collisions automatically.
- [#10473](https://github.com/better-auth/better-auth/pull/10473) [`ed61b47`](https://github.com/better-auth/better-auth/commit/ed61b4798e0ccedadc3b0c0e0a2d08b5d4b7ed5a) Thanks [@gustavovalverde](https://github.com/gustavovalverde)! - Add transactional OIDC user resolution so applications can link verified issuer and subject pairs to exact existing users while preserving or updating the local profile.
## 1.7.0-rc.1
## 1.7.0-rc.0
packages/sso/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@better-auth/sso",
"version": "1.7.0-rc.1",
"version": "1.7.0-rc.2",
"description": "SSO plugin for Better Auth",
"type": "module",
"license": "MIT",
packages/stripe/CHANGELOG.md
+2
View File
@@ -1,5 +1,7 @@
# @better-auth/stripe
## 1.7.0-rc.2
## 1.7.0-rc.1
## 1.7.0-rc.0
packages/stripe/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@better-auth/stripe",
"version": "1.7.0-rc.1",
"version": "1.7.0-rc.2",
"description": "Stripe plugin for Better Auth",
"type": "module",
"license": "MIT",
packages/telemetry/CHANGELOG.md
+2
View File
@@ -1,5 +1,7 @@
# @better-auth/telemetry
## 1.7.0-rc.2
## 1.7.0-rc.1
## 1.7.0-rc.0
packages/telemetry/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@better-auth/telemetry",
"version": "1.7.0-rc.1",
"version": "1.7.0-rc.2",
"description": "Telemetry package for Better Auth",
"type": "module",
"license": "MIT",
packages/test-utils/CHANGELOG.md
+2
View File
@@ -1,5 +1,7 @@
# @better-auth/test-utils
## 1.7.0-rc.2
## 1.7.0-rc.1
## 1.7.0-rc.0
packages/test-utils/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@better-auth/test-utils",
"version": "1.7.0-rc.1",
"version": "1.7.0-rc.2",
"description": "Testing utilities for Better Auth adapter development",
"type": "module",
"license": "MIT",