 Bereket Engida
|
afc9818880
|
feat(oauth): add optional resource parameter to authorization flow
|
2026-04-14 20:44:12 -07:00 |
|
  
|
504ea253ac
|
chore(deps-dev): bump @sveltejs/kit from 2.53.3 to 2.57.1 (#9109)
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
|
2026-04-12 08:24:12 +00:00 |
|
 Gustavo ValverdeandGitHub
|
e2e25a4954
|
fix(oauth-provider): graceful DCR override for unauthenticated confidential clients (#9123)
|
2026-04-11 15:25:06 +00:00 |
|
|
f8758975ae
|
fix(two-factor): updated backup codes respect storeBackupCodes option (#7231)
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com>
|
2026-04-11 13:19:46 +00:00 |
|
|
Gustavo ValverdeandGitHub
|
484ce6a262
|
fix(two-factor): enforce 2FA on all sign-in paths (#9122)
|
2026-04-11 12:33:58 +00:00 |
|
|
Gustavo ValverdeandGitHub
|
314e06f0fd
|
feat(oauth-provider): add customTokenResponseFields and harden authorization code validation (#9118)
|
2026-04-11 09:54:48 +00:00 |
|
 TaesuandGitHub
|
4673c6d83c
|
fix(cli): handle extends and mid-path wildcards in tsconfig paths (#9032)
|
2026-04-10 16:26:53 +00:00 |
|
|
Gustavo ValverdeandGitHub
|
52c47517a2
|
fix(sso): unify SAML response processing and fix bugs (#9097)
|
2026-04-10 15:00:26 +00:00 |
|
|
|
c5066fe5d6
|
fix(stripe): omit quantity for metered prices in checkout and upgrades (#8926)
Co-authored-by: better-release[bot] <273320539+better-release[bot]@users.noreply.github.com>
|
2026-04-10 12:55:44 +00:00 |
|
  
|
684154d3d1
|
chore: replace z.union with z.xor for permission schemas in admin plugin (#8982)
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com>
Co-authored-by: Taesu <bytaesu@gmail.com>
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com>
|
2026-04-10 12:47:23 +00:00 |
|
|
5f84335815
|
feat(stripe): support Stripe SDK v21 and v22 (#9084)
Co-authored-by: leonardo2204 <1509421+leonardo2204@users.noreply.github.com>
Co-authored-by: better-release[bot] <273320539+better-release[bot]@users.noreply.github.com>
|
2026-04-10 06:19:34 +00:00 |
|
 
|
f6428d02fc
|
fix(open-api): correct get-session nullable schema for OAS 3.1 (#8389)
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com>
Co-authored-by: ping-maxwell <maxwell.multinite@gmail.com>
|
2026-04-09 20:44:35 +00:00 |
|
|
6ce30cf138
|
fix: incorrect operationId in password reset callback endpoint (#9072)
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com>
|
2026-04-09 20:13:06 +00:00 |
|
 better-release[bot]andGitHub
|
700d298e1e
|
chore: version packages (#9052)
|
2026-04-09 15:19:07 +01:00 |
|
|
Gustavo ValverdeandGitHub
|
4c829bf289
|
fix(oauth-provider): preserve multi-valued query params through prompt redirects (#9060)
|
2026-04-09 13:13:39 +00:00 |
|
|
|
b20fa424c3
|
fix(next-js): replace cookie probe with header-based RSC detection in nextCookies (#9059)
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com>
|
2026-04-09 12:41:10 +00:00 |
|
|
Gustavo ValverdeandGitHub
|
608d8c3082
|
fix(sso): include RelayState in signed SAML AuthnRequests (#9058)
|
2026-04-09 12:05:02 +00:00 |
|
 Dylan VanmaliandGitHub
|
c6922dce8e
|
refactor(oauth-provider): reject skip_consent at schema level in DCR (#8998)
|
2026-04-09 11:56:29 +00:00 |
|
|
5e5d3f62fc
|
fix(sso): normalize SAMLResponse whitespace at request boundary (#8968)
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com>
|
2026-04-09 11:04:10 +00:00 |
|
|
2cbcb9baac
|
fix(oauth2): prevent cross-provider account collision in link-social callback (#8983)
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com>
|
2026-04-09 10:17:42 +00:00 |
|
|
9deb7936ab
|
fix: cookie store strategy should verify oauth state (#8949)
Co-authored-by: Bereket Engida <86073083+Bekacru@users.noreply.github.com>
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com>
|
2026-04-09 09:26:36 +00:00 |
|
|
84098432ad
|
feat(two-factor): include enabled 2fa methods in sign-in redirect response (#8772)
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com>
|
2026-04-09 09:25:49 +00:00 |
|
|
|
e78a7b120d
|
fix(two-factor): prevent unverified TOTP enrollment from gating sign-in (#8711)
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com>
|
2026-04-09 08:48:10 +00:00 |
|
|
|
85bb710edc
|
chore: version packages (#9018)
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
|
2026-04-08 19:22:59 +00:00 |
|
|
TaesuandGitHub
|
7495830659
|
fix(api): restore getSession accessibility in generic Auth<O> context (#9017)
|
2026-04-08 17:34:12 +00:00 |
|
|
|
8ad1995077
|
chore(deps): bump drizzle-orm from 0.45.1 to 0.45.2 (#9033)
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
|
2026-04-08 07:40:52 +00:00 |
|
 Jonathan SaminesandGitHub
|
2e537df5f7
|
fix: endpoint instrumentation to always use route template (#9023)
|
2026-04-08 08:41:31 +10:00 |
|
|
MaxwellandGitHub
|
f61ad1cab7
|
fix: use INVALID_PASSWORD for all checkPassword failures (#8902)
|
2026-04-07 18:17:10 +00:00 |
|
|
Gustavo ValverdeandGitHub
|
d9b16d2551
|
chore: sync main to next
chore: sync main to next
|
2026-04-06 16:47:42 +01:00 |
|
|
TaesuandGitHub
|
141781d6fc
|
fix: generate session id when using secondary storage without database (#8927)
|
2026-04-06 14:43:47 +00:00 |
|
|
better-release[bot]
|
d666a03372
|
chore: exit pre-release mode for v1.6.0
|
2026-04-06 14:41:56 +00:00 |
|
|
Gustavo ValverdeandGitHub
|
29d197e688
|
chore: sync main to next (#8976)
chore: sync main to next
|
2026-04-06 15:31:29 +01:00 |
|
|
Gustavo ValverdeandGitHub
|
e5091ee1e6
|
fix(oauth-provider): scope loss on PAR, loopback redirect matching, DCR skip_consent (#8632)
|
2026-04-06 14:14:39 +00:00 |
|
|
Gustavo ValverdeandGitHub
|
bd9bd58f87
|
fix(security): enforce authorization on SCIM management endpoints and normalize passkey ownership (#8843)
|
2026-04-06 13:47:24 +00:00 |
|
|
ee8b40d502
|
fix(deps): patch Dependabot security issues (#8838)
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
|
2026-04-06 13:16:45 +00:00 |
|
|
TaesuandGitHub
|
560230f751
|
fix(types): prevent any from collapsing base type and client inference (#8981)
|
2026-04-06 12:18:58 +00:00 |
|
|
Gustavo ValverdeandGitHub
|
dd537cbdeb
|
chore(oidc-provider): deprecate plugin in favor of @better-auth/oauth-provider (#8985)
|
2026-04-06 12:13:35 +00:00 |
|
|
|
469eee6d84
|
fix(oauth): prevent double-hashing of state when storeIdentifier is hashed (#8980)
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com>
|
2026-04-06 11:14:55 +00:00 |
|
|
TaesuandGitHub
|
475d512376
|
chore: revert better-call v2 migration, downgrade to v1.3.5 (#8973)
|
2026-04-05 23:18:54 +00:00 |
|
 better-auth-releases[bot]andgithub-actions[bot] <github-actions[bot]@users.noreply.github.com>
|
73beda26f9
|
chore: version packages (beta) (#8945)
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
|
2026-04-04 15:52:24 +00:00 |
|
|
Gustavo ValverdeandGitHub
|
1eec2e8090
|
chore: use caret ranges for internal peerDependencies (#8937)
|
2026-04-03 19:05:37 +00:00 |
|
 
|
5970053e6a
|
docs: improve descriptions for appName, trustedOrigins, useSecureCookies (#8935)
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
2026-04-03 18:31:00 +00:00 |
|
|
Gustavo ValverdeandGitHub
|
77ead28455
|
chore: reset package versions to 1.5.6 (#8930)
|
2026-04-03 10:57:28 +00:00 |
|
|
Gustavo ValverdeandGitHub
|
e089ce127d
|
chore(knip): fix CI blind spots and remove dead code (#8888)
|
2026-04-02 19:28:30 +00:00 |
|
|
|
4742f349dc
|
fix(oauth-proxy): read callback params from body for form_post (#8895)
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com>
|
2026-04-02 10:24:31 +00:00 |
|
 Gautam ManchandaniandGitHub
|
c83a6c22ea
|
fix(oauth-provider): enforce DB-backed sessions with secondary storage (#8894)
Signed-off-by: Gautam Manchandani <manchandanigautam@gmail.com>
|
2026-04-02 10:20:48 +00:00 |
|
|
|
6a3044e50e
|
chore(deps-dev): bump happy-dom from 20.7.0 to 20.8.9 (#8830)
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com>
|
2026-04-02 08:13:55 +00:00 |
|
|
Gustavo ValverdeandGitHub
|
e80cc38b0d
|
fix: turbo caching, enforce lockfile integrity, expand pre-commit hooks (#8892)
|
2026-04-02 07:35:24 +00:00 |
|
|
Gustavo ValverdeandGitHub
|
04e91d1643
|
perf(build): reduce published package sizes (#8884)
|
2026-04-01 15:55:03 +00:00 |
|
|
31d5e88b88
|
fix(instrumentation): don't mark redirect APIErrors as span errors (#8850)
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com>
|
2026-04-01 22:49:49 +10:00 |
|