  Gustavo ValverdeandGitHub
|
27b5d80227
|
fix(generic-oauth): bind id token nonce in redirect flow (#10095)
|
2026-06-16 21:20:07 +00:00 |
|
|
Gustavo Valverde
|
849f6e8aca
|
chore: sync main to next
|
2026-06-15 18:30:49 -07:00 |
|
|
Gustavo ValverdeandGitHub
|
1e69725027
|
docs: clarify stateless Cognito token refresh (#10092)
|
2026-06-15 17:06:35 -07:00 |
|
 
|
2c8f925c48
|
docs: generate blog cover images from post titles (#10032)
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
|
2026-06-15 09:28:45 -07:00 |
|
|
Gustavo ValverdeandGitHub
|
36f345b1bc
|
revert: fix: allow headerless get session checks (#10053) (#10074)
|
2026-06-15 00:10:22 -07:00 |
|
|
Gustavo ValverdeandGitHub
|
4475f4a39b
|
fix(sso): reject OIDC endpoint redirects portably (#10072)
|
2026-06-15 06:56:55 +00:00 |
|
|
Gustavo ValverdeandGitHub
|
6d97c4754c
|
fix(oauth-provider): challenge invalid userinfo tokens (#10068)
|
2026-06-15 06:27:28 +00:00 |
|
 TusharandGitHub
|
d009daedc7
|
fix: allow headerless get session checks (#10053)
|
2026-06-15 06:14:34 +00:00 |
|
|
Gustavo ValverdeandGitHub
|
3ef3cfecfa
|
fix(oauth-provider)!: bind client authentication to the issuing grant (#10063)
|
2026-06-14 20:46:40 -07:00 |
|
|
Gustavo ValverdeandGitHub
|
aedcb974f0
|
feat(oauth-provider): add DPoP support (#10039)
|
2026-06-14 18:28:21 -07:00 |
|
|
Gustavo ValverdeandGitHub
|
0143d69195
|
feat(oauth-provider): support protected dynamic client registration (#10037)
|
2026-06-14 15:00:17 -07:00 |
|
|
Gustavo ValverdeandGitHub
|
050ef2dfcf
|
feat(oauth-provider): add extension surface (#10030)
|
2026-06-14 11:37:28 -07:00 |
|
|
Gustavo ValverdeandGitHub
|
2fd3d58500
|
feat(oauth-provider): consistent and audience-scoped token introspection (#10045)
|
2026-06-13 12:58:25 -07:00 |
|
 MaxwellandGitHub
|
581f8271fb
|
fix(last-login-method): include domain when clearing cross-subdomain cookies (#9319)
|
2026-06-13 11:52:33 +00:00 |
|
 TaesuandGitHub
|
ad35eadd13
|
fix(one-tap)!: require client id for audience validation (#10036)
|
2026-06-13 01:05:01 +00:00 |
|
|
Gustavo Valverde
|
9dcc0318da
|
chore: sync main to next
|
2026-06-12 17:34:58 -07:00 |
|
 
|
b4b02660c7
|
feat(device-authorization): allow pre-binding device codes to a user (#9995)
Co-authored-by: Taesu <bytaesu@gmail.com>
|
2026-06-12 22:57:37 +00:00 |
|
 
|
c1a8a64c14
|
fix(open-api): generate valid OpenAPI schemas for client generators (#9555)
Co-authored-by: ping-maxwell <maxwell.multinite@gmail.com>
|
2026-06-12 22:24:56 +00:00 |
|
|
Gustavo ValverdeandGitHub
|
6fe9faab65
|
refactor!: remove deprecated oidc-provider plugin (#10031)
|
2026-06-12 21:45:19 +00:00 |
|
|
Gustavo Valverde
|
c40989def2
|
fix: address sync review comments
|
2026-06-12 10:40:36 -07:00 |
|
|
Gustavo Valverde
|
6f5c707459
|
chore: sync main to next
|
2026-06-12 10:25:24 -07:00 |
|
|
d2a79bae79
|
feat(oauth-provider)!: model OAuth protected resources explicitly (#9648)
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com>
|
2026-06-12 10:08:43 -07:00 |
|
|
48070ada8b
|
feat(sso): support additionalFields on ssoProvider (#9445)
Signed-off-by: Gautam Manchandani <manchandanigautam@gmail.com>
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com>
|
2026-06-12 10:00:55 -07:00 |
|
|
|
729fd84034
|
fix(oauth-provider): canonicalize signed OAuth query params (#9941)
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com>
|
2026-06-12 15:17:00 +00:00 |
|
|
|
34558bc52b
|
feat(session): support JWKS-backed JWT session cookie cache (#8931)
Signed-off-by: Gautam Manchandani <manchandanigautam@gmail.com>
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com>
|
2026-06-12 15:03:33 +00:00 |
|
|
TaesuandGitHub
|
def1624a13
|
docs(changelog): avoid false contributor avatars (#10019)
|
2026-06-12 01:18:52 -07:00 |
|
|
Gustavo ValverdeandGitHub
|
e53582ce55
|
feat(mcp)!: ship MCP as its own package built on the OAuth provider (#9992)
|
2026-06-11 21:34:38 -07:00 |
|
|
Gustavo Valverde
|
5ce8d4cb55
|
chore: keep beta Apple docs component available
|
2026-06-11 20:03:44 -07:00 |
|
|
Gustavo Valverde
|
d2949a8700
|
Merge remote-tracking branch 'origin/main' into chore/sync-main-to-next-20260611
|
2026-06-11 18:45:33 -07:00 |
|
|
Gustavo Valverde
|
7a55ae4f52
|
Merge remote-tracking branch 'origin/next' into chore/sync-main-to-next-20260611
# Conflicts:
# .changeset/accept-invitation-team-capacity.md
# .changeset/adapters-native-increment-one.md
# .changeset/api-key-atomic-quota.md
# .changeset/delete-account-token-single-use.md
# .changeset/device-code-single-use.md
# .changeset/electron-code-single-use.md
# .changeset/email-otp-attempts-atomic.md
# .changeset/increment-one-primitive.md
# .changeset/memory-adapter-transaction-isolation.md
# .changeset/one-time-token-single-use.md
# .changeset/passkey-ceremony-binding.md
# .changeset/password-reset-token-single-use.md
# .changeset/phone-otp-attempts-atomic.md
# .changeset/rate-limit-atomic-consume.md
# .changeset/redis-increment.md
# .changeset/reserve-verification-value.md
# .changeset/saml-replay-reserve.md
# .changeset/siwe-nonce-single-use.md
# .changeset/two-factor-challenge-single-use.md
# .changeset/twofactor-otp-attempts-atomic.md
# packages/api-key/src/adapter.ts
# packages/api-key/src/api-key.test.ts
# packages/better-auth/src/api/rate-limiter/index.ts
# packages/better-auth/src/api/rate-limiter/rate-limiter.test.ts
# packages/better-auth/src/db/internal-adapter.ts
# packages/better-auth/src/plugins/device-authorization/routes.ts
# packages/better-auth/src/plugins/organization/adapter.ts
# packages/better-auth/src/plugins/organization/routes/crud-invites.ts
# packages/better-auth/src/plugins/organization/routes/crud-members.ts
# packages/better-auth/src/plugins/organization/routes/crud-team.ts
# packages/better-auth/src/plugins/organization/team.test.ts
# packages/better-auth/src/plugins/phone-number/routes.ts
# packages/better-auth/src/plugins/two-factor/two-factor.security.test.ts
# packages/core/src/db/adapter/factory.ts
# packages/core/src/db/adapter/index.ts
# packages/core/src/db/type.ts
# packages/core/src/types/context.ts
# packages/core/src/types/init-options.ts
# packages/drizzle-adapter/src/drizzle-adapter.test.ts
# packages/drizzle-adapter/src/drizzle-adapter.ts
# packages/electron/test/electron.test.ts
# packages/kysely-adapter/src/kysely-adapter.ts
# packages/memory-adapter/src/memory-adapter.ts
# packages/mongo-adapter/src/mongodb-adapter.test.ts
# packages/mongo-adapter/src/mongodb-adapter.ts
# packages/passkey/src/routes.ts
# packages/prisma-adapter/src/prisma-adapter.ts
# packages/redis-storage/src/redis-storage.ts
# packages/redis-storage/test/redis-storage.test.ts
# packages/sso/src/saml.test.ts
|
2026-06-11 18:45:17 -07:00 |
|
|
Gustavo Valverde
|
381fc6cfaf
|
chore: sync main to next
|
2026-06-11 18:18:13 -07:00 |
|
 ZerGo0andGitHub
|
029cbdc072
|
docs: update Apple client secret JWT guidance (#9938)
|
2026-06-11 17:54:44 -07:00 |
|
|
Gustavo ValverdeandGitHub
|
86ccb5de91
|
feat(auth)!: harden atomic state transitions (#10000)
|
2026-06-12 00:46:44 +00:00 |
|
 Jordan KahtavaandGitHub
|
44a24ed948
|
docs: highlighted emailVerified requirement on manually inserted users (#9999)
|
2026-06-11 17:45:37 -07:00 |
|
|
Gautam ManchandaniandGitHub
|
bf39cbf13f
|
feat(phone-number): add server-side OTP consumption API (#9766)
|
2026-06-11 16:58:16 -07:00 |
|
|
TaesuandGitHub
|
b36c38f984
|
feat(captcha)!: support wildcard endpoint matching (#10004)
|
2026-06-11 23:47:25 +00:00 |
|
 Damien MasperoandGitHub
|
e468ff37ce
|
docs: update Node.js built-in SQLite status to Release Candidate (#9914)
|
2026-06-10 23:13:39 -07:00 |
|
|
TaesuandGitHub
|
3e99e6c77e
|
fix(admin): create credential account in setUserPassword when missing (#9482)
|
2026-06-11 05:36:55 +00:00 |
|
|
|
6987c628f1
|
fix(cli): resolve SvelteKit, Vite asset, and Cloudflare virtual-module imports (#9834)
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com>
|
2026-06-11 01:06:43 +00:00 |
|
|
Gustavo Valverde
|
d7bba8ee33
|
Merge origin/next into chore/sync-main-to-next
|
2026-06-10 11:34:38 -07:00 |
|
|
Gustavo Valverde
|
bf7f2c5b4e
|
chore: sync main to next
|
2026-06-10 11:30:38 -07:00 |
|
 Eric LuceandGitHub
|
82dbc9b8bf
|
docs: add ProofKit FileMaker adapter (#9980)
|
2026-06-10 11:26:02 -07:00 |
|
 Prakash KumarandGitHub
|
128bc34572
|
docs: add horizontal scrolling to landing page code block (#9975)
|
2026-06-09 23:22:24 -07:00 |
|
|
Bereket EngidaandGitHub
|
cb1cbfa4cc
|
fix: address bug findings across packages (#9974)
|
2026-06-09 19:46:12 -07:00 |
|
|
Gustavo ValverdeandGitHub
|
87e7aa5e0f
|
fix(api): validate Origin/Referer on cookieless email sign-in and sign-up (#9973)
|
2026-06-10 01:43:41 +00:00 |
|
|
Gustavo ValverdeandGitHub
|
76a33429fc
|
fix(session): fire session-delete hooks for preserved sessions on secondaryStorage (#9969)
|
2026-06-10 00:40:56 +00:00 |
|
|
Gustavo ValverdeandGitHub
|
3e852a2650
|
fix(oauth-provider): report unsupported_token_type for JWT access-token revocation (#9970)
|
2026-06-10 00:39:26 +00:00 |
|
|
Gustavo ValverdeandGitHub
|
7abaaed53f
|
fix(oauth-provider): make private_key_jwt jti single-use atomic across processes (#9964)
|
2026-06-10 00:36:06 +00:00 |
|
|
Gustavo ValverdeandGitHub
|
ec8a38c08f
|
feat(generic-oauth): verify discovery id_tokens and enable id_token sign-in (#9966)
|
2026-06-10 00:34:26 +00:00 |
|
 Paola Estefanía de CamposandGitHub
|
afcb4dd7f3
|
docs(two-factor): document newSession is null during 2FA challenge (#9957)
|
2026-06-09 13:15:00 -07:00 |
|