Taesu and GitHub
ce8141a21c
fix(api): align fresh age with session creation time ( #8762 )
2026-03-31 10:00:13 +00:00
Gustavo Valverde and GitHub
3860c09d9f
fix(two-factor): allow passwordless 2FA management ( #7243 )
2026-03-30 07:43:18 +00:00
Gustavo Valverde and GitHub
7c2ce8a371
feat(passkey): add pre-auth registration and extensions ( #7154 )
2026-03-30 06:43:10 +00:00
Taesu and GitHub
23bad5139f
feat(sso): enable InResponseTo validation by default for SAML flows ( #8736 )
2026-03-30 06:20:27 +00:00
Martin Rädlinger and GitHub
e16b184b0b
fix(sso): provisionUser inconsistency and option to run on every login ( #8818 )
2026-03-30 06:18:11 +00:00
Taesu and GitHub
db26161113
fix: compare account cookie by provider accountId instead of internal id ( #8786 )
2026-03-30 05:25:05 +00:00
Maxwell and GitHub
6f30fd65a4
fix(email-otp): trigger sessionSignal on req-email-change ( #8816 )
2026-03-30 05:17:26 +00:00
David Frankel and GitHub
e9f49bd7c8
chore: fix type inference for future TS compatibility ( #8820 )
2026-03-30 05:00:05 +00:00
03d2df6603
fix(stripe): return correct priceId for annual subscriptions in list ( #8810 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-03-29 06:10:40 +10:00
Gustavo Valverde and GitHub
8afe2a7cea
fix(oauth-provider): return JSON redirects from post-login OAuth continuation ( #8815 )
2026-03-28 19:05:29 +00:00
Gustavo Valverde and GitHub
5dc004a177
fix(oauth-provider): let customIdTokenClaims override acr and auth_time ( #8633 )
2026-03-28 09:36:47 +00:00
221103bce7
fix(oauth-provider): handle dynamic baseURL config in init ( #8649 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-03-27 20:33:35 +00:00
5b7a5811e1
fix(kysely-adapter): remove deprecated numUpdatedOrDeletedRows from D1 dialect ( #8798 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-03-27 16:35:00 +00:00
Taesu
183be977f0
Revert "fix(oauth-provider): only require storeSessionInDatabase when secondaryStorage is configured"
...
This reverts commit cd835f6a58
2026-03-27 05:49:35 +09:00
Gustavo Valverde
cd835f6a58
fix(oauth-provider): only require storeSessionInDatabase when secondaryStorage is configured
...
The init guard checked for `session` options broadly, which caused a
false error when users set any session config (e.g., `expiresIn`) without
secondaryStorage. Without secondaryStorage, sessions always persist to
the database, making the constraint irrelevant.
2026-03-26 16:13:55 +00:00
4be065c505
fix(magic-link): return additional fields in /magic-link/verify ( #7223 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-03-26 18:33:06 +10:00
Taesu and GitHub
14347d2627
chore: centralize to use catalog and bump @better-auth/utils, better-call ( #8684 )
2026-03-26 04:09:49 +00:00
Gustavo Valverde and GitHub
2d56c6af68
fix(oauth-provider): normalize auth_time timestamps ( #8761 )
2026-03-24 15:22:35 -07:00
Maxwell and GitHub
ed269e93a6
fix(test-utils): remove using keyword ( #8756 )
2026-03-24 14:36:55 +00:00
Taesu and GitHub
573d32d763
test: use fake timers in JWT max age expiry test case to prevent flaky failure ( #8755 )
2026-03-24 13:37:19 +00:00
a399653e88
fix(username): dont set other username prop in updateUser ( #7570 )
...
Co-authored-by: Bereket Engida <86073083+Bekacru@users.noreply.github.com >
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-03-24 13:34:15 +00:00
4bc1d1634b
fix(username): enforce username uniqueness in updateUser ( #8731 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-03-24 08:05:41 +00:00
d0b62a0cd8
feat(cli): migrate MCP server URL to mcp.better-auth.com ( #8747 )
...
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-03-23 17:30:04 -07:00
Harry Yep and GitHub
24a6a20d2f
fix(passkey): use message ( #8751 )
2026-03-23 17:29:39 -07:00
Jonathan Samines and GitHub
a1b0fdcd70
feat(db): add case insensitive queries support ( #8556 )
2026-03-23 13:09:29 -07:00
Bereket Engida
841410031a
chore: release v1.5.7-beta.1
2026-03-22 21:09:52 -07:00
Bereket Engida
c527d4e4cc
chore: release v1.5.1-beta.4
2026-03-22 21:04:04 -07:00
df9abae0bc
feat(haveibeenpwned): add enable option ( #8728 )
...
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-03-22 22:30:56 +00:00
Taesu and GitHub
b647ef3488
fix(sso): skip state cookie check for SAML ACS cross-site POST ( #8735 )
2026-03-22 14:27:55 -07:00
Alex Yang and GitHub
c2cbb9d566
fix(one-tap): opt into FedCM to suppress Google GSI deprecation warnings ( #8720 )
2026-03-21 00:48:38 +00:00
Alex Yang and GitHub
c8617fd445
fix: set stateless cookieCache maxAge to match session expiresIn ( #8648 )
2026-03-20 23:18:09 +00:00
5c7bc4b434
chore(deps): bump fast-xml-parser from 5.5.6 to 5.5.7 ( #8698 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-20 22:26:50 +00:00
Ollie and GitHub
8682b7aebc
fix(adapters): use IS NULL / IS NOT NULL for null value comparisons ( #8660 )
2026-03-20 22:24:38 +00:00
Taesu and GitHub
faffbd6206
feat(oauth-proxy): add dedicated secret option to reduce shared key exposure surface ( #8699 )
2026-03-20 22:18:42 +00:00
Andreas Osberghaus and GitHub
d198a82736
fix(last-login-method): normalize missing resolver path ( #8589 )
2026-03-20 22:18:24 +00:00
1486fafb77
chore(deps): bump kysely from 0.28.12 to 0.28.14 ( #8718 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-20 21:43:42 +00:00
Taesu and GitHub
767f129d1a
fix: prevent revoked sessions from being restored via database fallback ( #8708 )
2026-03-20 18:34:29 +00:00
Gustavo Valverde and GitHub
c41fa044d4
fix(oauth-provider): fix dist declaration type errors ( #8701 )
2026-03-20 00:28:29 +00:00
ab158b1e8c
chore(deps): bump kysely from 0.28.11 to 0.28.12 ( #8700 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-20 00:08:17 +00:00
Alex Yang and GitHub
a67630edb4
fix(sso): use namespace import for samlify to fix ESM compatibility ( #8697 )
2026-03-19 19:31:11 +00:00
5648bd8680
feat: agent auth plugin ( #8696 )
...
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
2026-03-19 12:18:34 -07:00
06e38a442a
fix(organization): filter null organizations in listUserInvitations ( #8694 )
...
Co-authored-by: Raihan Sharif <raihansharif.info@gmail.com >
2026-03-19 18:51:01 +00:00
Oscar Cornish and GitHub
ac9541a846
feat(sso): Add logging for when code validation fails in oidc callback ( #8693 )
2026-03-19 18:23:35 +00:00
Alex Yang and GitHub
92d60cd0d4
chore(deps): bump next.js from 16.1.6 to 16.2.0 ( #8682 )
2026-03-18 22:11:23 +00:00
Taesu and GitHub
3aa107291e
feat(mongo-adapter): store UUIDs as native BSON UUID ( #8681 )
2026-03-18 20:54:59 +00:00
Taesu and GitHub
0556575457
fix(core): prioritize generateId "uuid" over adapter customIdGenerator ( #8679 )
2026-03-18 20:32:57 +00:00
Gustavo Valverde and GitHub
8304f655ab
fix(api): return Response for HTTP request contexts ( #7521 )
2026-03-18 18:28:33 +00:00
Dylan Vanmali and GitHub
20e4561c9b
feat(oauth-provider): public client prelogin endpoint ( #8214 )
2026-03-18 17:27:19 +00:00
Dylan Vanmali and GitHub
40e7676155
fix(oauth-provider): improve allowed paths for oauth_query for client plugin ( #8320 )
2026-03-18 16:55:12 +00:00
40b5e23b3b
chore(deps): bump fast-xml-parser from 5.4.1 to 5.5.6 ( #8665 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-18 16:55:02 +00:00
TaesuandGitHub
Gustavo ValverdeandGitHub
Martin RädlingerandGitHub
MaxwellandGitHub
David FrankelandGitHub
Taesu
Harry YepandGitHub
Jonathan SaminesandGitHub
Bereket Engida
OllieandGitHub
Andreas OsberghausandGitHub
Oscar CornishandGitHub
Dylan VanmaliandGitHub