Gustavo Valverde
ef4fb0ff95
chore: merge main into next ( #9533 )
...
Sync main (through #9821/#9820/#9822/#9768) into next. Conflicting
package.json files keep next's version and intentional divergences (for
example the cli's c12 v4) while taking main's dependency updates, including
the samlify 2.13.1 and fast-xml-parser security bumps; the lockfile is
regenerated from the reconciled set. The 13 source/doc/test conflicts take
next's refactored architecture as the baseline; main's colliding fixes are
re-applied on top in the following per-domain commits.
Clean main fixes land via this merge, including the auto-restored
account-takeover defenses #9578 and #9577 .
2026-05-31 00:10:16 +01:00
43c08a2bc7
fix(account): scope OAuth account identity and fix buggy internalAdapter helpers ( #9818 )
...
Co-authored-by: Krish Garg <kgarg@chapman.edu >
2026-05-30 20:48:10 +00:00
23d7cbfa79
fix(oauth): apply updateUserInfoOnLink in OAuth callback link flow ( #8758 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-30 19:48:38 +01:00
5f282bd382
fix(account): default storeStateStrategy to "database" when using secondaryStorage ( #9591 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-30 11:05:28 +01:00
better-release[bot] and GitHub
c0c574ea50
chore: release v1.6.12 ( #9590 )
2026-05-29 22:28:58 +01:00
Gustavo Valverde and GitHub
c5b9f93498
fix(generic-oauth): add accessTokenExpiresIn for providers that omit expires_in ( #9799 )
2026-05-29 20:49:59 +00:00
a3b0c63de9
fix: accept hashed nonces for native iOS sign-in with Apple ( #8870 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-28 12:35:09 +00:00
7bf5449b11
fix(oauth2): map jose token verification errors ( #9655 )
...
Co-authored-by: cyphercodes <cyphercodes@users.noreply.github.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-27 09:45:02 +00:00
Taesu and GitHub
83fa3695e7
feat(core): add string case conversion utilities ( #9727 )
2026-05-24 23:40:22 +00:00
Gustavo Valverde and GitHub
e7eb45b065
feat(oauth): per-request additionalParams and loginHint ( #9305 )
2026-05-19 17:18:43 +00:00
f77060af3a
fix: consumeVerificationValue returns null for expired rows ( #9624 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-05-19 16:37:55 +00:00
03e6c94e96
feat(generic-oauth,sso): support IDP-initiated flows via secure bounce ( #9301 )
...
Co-authored-by: Menachem Hornbacher <mhornbacher@kiddom.co >
2026-05-19 12:29:04 +00:00
Gustavo Valverde and GitHub
1e5b808472
refactor(oauth): single-source Basic credentials + getHttpTestInstance ( #9657 )
2026-05-17 19:23:45 +00:00
aebf66d8e6
feat: add token endpoint client authentication ( #9625 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-16 18:27:15 +00:00
better-release[bot] and GitHub
f41514ef07
chore: release v1.6.11 ( #9532 )
2026-05-12 17:30:34 +01:00
Maxwell and GitHub
b0ef96fd8e
fix: invalid instrumentation import list ( #9582 )
2026-05-12 15:03:15 +00:00
Gustavo Valverde and GitHub
da7e50beee
fix(oauth): block OAuth linking to unverified local accounts ( #9578 )
2026-05-12 14:20:19 +00:00
Gustavo Valverde and GitHub
0cbddb8fa4
refactor(db): rename claimOne adapter primitive to consumeOne ( #9568 )
2026-05-12 07:44:07 +00:00
Taesu and GitHub
62b8793c11
chore(deps): consolidate kysely into pnpm catalog ( #9569 )
2026-05-12 07:38:59 +00:00
3bec284c4f
chore(deps): bump kysely from 0.28.14 to 0.28.17 ( #9567 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-05-12 06:25:23 +00:00
Gustavo Valverde and GitHub
a2c0c9346e
feat(db): add atomic claimOne adapter primitive ( #9560 )
2026-05-11 20:10:29 +00:00
Maxwell and GitHub
ee93485499
fix: add error code to change-email-disabled ( #8948 )
2026-05-11 11:49:38 +00:00
Gustavo Valverde and GitHub
e21d744987
fix(rate-limit): widen ipv6Subnet type and correct default in docs ( #9545 )
2026-05-11 07:04:16 +00:00
4839a2d761
chore: release v1.7.0-beta.3 ( #9323 )
...
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-05-09 19:28:11 +00:00
Taesu
2b83087180
chore: sync main to next
2026-05-10 03:45:29 +09:00
cbb5014cdf
chore: release v1.6.10 ( #9350 )
...
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-05-09 14:31:47 +00:00
Taesu and GitHub
15ff28a957
fix(internal-adapter): rename deleteAccount param from accountId to id ( #9503 )
2026-05-09 13:50:32 +00:00
3a9a2c37ee
chore: expose refreshUserSessions on internal adapter ( #7764 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
Co-authored-by: ping-maxwell <maxwell.multinite@gmail.com >
2026-05-07 10:17:56 +00:00
2220a6d6c2
fix(core): use pure instrumentation entry for workerd ( #9395 )
...
Co-authored-by: cyphercodes <7407177+cyphercodes@users.noreply.github.com >
2026-04-29 12:59:31 -07:00
better-release[bot] and GitHub
f484269228
chore: release v1.6.9 ( #9341 )
2026-04-24 06:25:08 +01:00
815ecf62b6
fix(core): resolve instrumentation via package self-reference in adapter factory ( #9340 )
...
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com >
2026-04-24 05:12:34 +00:00
better-release[bot] and GitHub
b289ac6c4b
chore: release v1.6.8 ( #9316 )
2026-04-23 11:31:03 +01:00
Gustavo Valverde and GitHub
9aa8e63de8
fix(oauth): support mapProfileToUser fallback for providers that may omit email ( #9331 )
2026-04-23 10:15:36 +00:00
better-release[bot] and GitHub
d3bde2d21f
chore: release v1.7.0-beta.2 ( #9207 )
2026-04-22 17:23:06 +01:00
Gustavo Valverde
eb3cd10d50
chore: resolve main-to-next sync conflicts
...
- keep next package versions at 1.7.0-beta.1
- keep both changelog streams by inserting the stable 1.6.5, 1.6.6, and 1.6.7 sections below the 1.7.0-beta entries
- keep the cimd and dash deps on demo/nextjs (next-only); regenerate pnpm-lock.yaml
- resolve TODO(sync-from-main-9226) in oauth-provider authorize.ts: findRegisteredRedirectUri now uses isLoopbackIP from @better-auth/core/utils/host to cover the full 127.0.0.0/8 range per RFC 8252 §7.3
- drop the unused saml import that main's #9262 added to sso/src/routes/sso.ts; next already migrated to saml-pipeline
2026-04-22 14:54:27 +01:00
better-release[bot] and GitHub
f8076d141a
chore: release v1.6.7 ( #9289 )
2026-04-22 12:36:30 +01:00
Gustavo Valverde and GitHub
4f373eed8a
feat(social-providers): accept array of Client IDs for ID token audience ( #9292 )
2026-04-22 09:02:56 +00:00
Ray and GitHub
4a180f0b0c
fix(core): serve noop ./instrumentation on browser and edge conditions ( #9281 )
2026-04-22 08:44:00 +00:00
307196a405
fix(api): preserve response headers when APIError is thrown ( #9211 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com >
2026-04-22 06:47:16 +00:00
better-release[bot] and GitHub
0290077760
chore: release v1.6.6 ( #9222 )
2026-04-21 17:42:18 +01:00
Taesu and GitHub
b5742f9d08
feat(core): add mapConcurrent bounded-concurrency utility ( #9227 )
2026-04-21 15:31:08 +00:00
Gustavo Valverde and GitHub
e64ff720fb
fix: unify host classification and close SSRF gaps across packages ( #9226 )
2026-04-17 23:25:25 +00:00
a844c7dd08
chore(core): update @opentelemetry/api dep declaration to be optional ( #9111 )
...
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-04-17 14:26:40 +00:00
better-release[bot] and GitHub
c8a91f4167
chore: release v1.6.5 ( #9209 )
2026-04-16 11:05:30 +01:00
Gustavo Valverde
225976c7d2
chore: main to next conflict resolution
...
Resolve the main to next sync discrepancies after the v1.6.4 release.
Conflict resolution:
- keep next package versions at 1.7.0-beta.1
- keep both changelog streams by inserting the stable 1.6.4 sections below the 1.7.0-beta entries
- restore the next pre-release accumulator changesets that the stable release deleted on main
2026-04-15 15:40:35 +01:00
better-release[bot] and GitHub
9ec849ff71
chore: release v1.6.4 ( #9175 )
2026-04-15 13:00:42 +01:00
acbd6ef69f
fix: honor forceAllowId UUIDs on postgres adapters ( #9068 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-14 13:05:11 +00:00
better-release[bot] and GitHub
d8dfa515e2
chore: release v1.7.0-beta.1 ( #9120 )
2026-04-14 12:29:23 +01:00
Gustavo Valverde
834841fbc9
chore: sync v1.6.3 release into next
...
Brings main's `chore: release v1.6.3 (#9081 )` commit into next after the
stable release. Conflict resolution:
- `packages/*/package.json`: keep next's `1.7.0-beta.0` (per the release
bot's standard rule: next is always ahead of main in version).
- `packages/*/CHANGELOG.md`: keep both version entries side-by-side. Next's
`1.7.0-beta.0` section stays on top; main's new `1.6.3` section slots in
below. Each entry describes its own branch's release.
- `.changeset/*.md`: restore the 14 changesets git auto-deleted. Next is in
pre-release mode (`.changeset/pre.json` `mode: "pre"`), so changesets
accumulate across beta cuts and are only consumed on `exit-pre`. Main's
release deleted them from main; next must keep them for its own pre-release
accumulator.
2026-04-14 12:10:23 +01:00
better-release[bot] and GitHub
6f17bb3ebd
chore: release v1.6.3 ( #9081 )
2026-04-14 12:04:31 +01:00
Gustavo Valverde
better-release[bot]andGitHub
RayandGitHub
