Gustavo Valverde
79b698cbae
chore: resolve main to next sync validation
2026-06-11 19:27:46 -07:00
Gustavo Valverde
7a55ae4f52
Merge remote-tracking branch 'origin/next' into chore/sync-main-to-next-20260611
...
# Conflicts:
# .changeset/accept-invitation-team-capacity.md
# .changeset/adapters-native-increment-one.md
# .changeset/api-key-atomic-quota.md
# .changeset/delete-account-token-single-use.md
# .changeset/device-code-single-use.md
# .changeset/electron-code-single-use.md
# .changeset/email-otp-attempts-atomic.md
# .changeset/increment-one-primitive.md
# .changeset/memory-adapter-transaction-isolation.md
# .changeset/one-time-token-single-use.md
# .changeset/passkey-ceremony-binding.md
# .changeset/password-reset-token-single-use.md
# .changeset/phone-otp-attempts-atomic.md
# .changeset/rate-limit-atomic-consume.md
# .changeset/redis-increment.md
# .changeset/reserve-verification-value.md
# .changeset/saml-replay-reserve.md
# .changeset/siwe-nonce-single-use.md
# .changeset/two-factor-challenge-single-use.md
# .changeset/twofactor-otp-attempts-atomic.md
# packages/api-key/src/adapter.ts
# packages/api-key/src/api-key.test.ts
# packages/better-auth/src/api/rate-limiter/index.ts
# packages/better-auth/src/api/rate-limiter/rate-limiter.test.ts
# packages/better-auth/src/db/internal-adapter.ts
# packages/better-auth/src/plugins/device-authorization/routes.ts
# packages/better-auth/src/plugins/organization/adapter.ts
# packages/better-auth/src/plugins/organization/routes/crud-invites.ts
# packages/better-auth/src/plugins/organization/routes/crud-members.ts
# packages/better-auth/src/plugins/organization/routes/crud-team.ts
# packages/better-auth/src/plugins/organization/team.test.ts
# packages/better-auth/src/plugins/phone-number/routes.ts
# packages/better-auth/src/plugins/two-factor/two-factor.security.test.ts
# packages/core/src/db/adapter/factory.ts
# packages/core/src/db/adapter/index.ts
# packages/core/src/db/type.ts
# packages/core/src/types/context.ts
# packages/core/src/types/init-options.ts
# packages/drizzle-adapter/src/drizzle-adapter.test.ts
# packages/drizzle-adapter/src/drizzle-adapter.ts
# packages/electron/test/electron.test.ts
# packages/kysely-adapter/src/kysely-adapter.ts
# packages/memory-adapter/src/memory-adapter.ts
# packages/mongo-adapter/src/mongodb-adapter.test.ts
# packages/mongo-adapter/src/mongodb-adapter.ts
# packages/passkey/src/routes.ts
# packages/prisma-adapter/src/prisma-adapter.ts
# packages/redis-storage/src/redis-storage.ts
# packages/redis-storage/test/redis-storage.test.ts
# packages/sso/src/saml.test.ts
2026-06-11 18:45:17 -07:00
Gustavo Valverde
381fc6cfaf
chore: sync main to next
2026-06-11 18:18:13 -07:00
Gustavo Valverde and GitHub
86ccb5de91
feat(auth)!: harden atomic state transitions ( #10000 )
2026-06-12 00:46:44 +00:00
Taesu and GitHub
ac69e81a29
fix(cli): skip Unsupported() fields when regenerating prisma schema ( #10011 )
2026-06-11 17:19:17 -07:00
Gautam Manchandani and GitHub
e0a768c973
refactor(access): flatten access plugin role authorization logic ( #9677 )
2026-06-11 17:04:07 -07:00
Gautam Manchandani and GitHub
3310ebc4a0
fix(open-api): mark model ids as required ( #9704 )
2026-06-11 17:01:24 -07:00
108aadd251
fix(cli): update existing prisma field types ( #9729 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-06-11 16:59:14 -07:00
Gautam Manchandani and GitHub
bf39cbf13f
feat(phone-number): add server-side OTP consumption API ( #9766 )
2026-06-11 16:58:16 -07:00
59e0ccbedc
fix(client): updateSession should infer session additional fields ( #9777 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-06-11 16:56:45 -07:00
Gautam Manchandani and Bereket Engida
96c78c3e98
fix(logger): downgrade validation logs level to warn
2026-06-11 16:50:14 -07:00
Taesu and GitHub
b36c38f984
feat(captcha)!: support wildcard endpoint matching ( #10004 )
2026-06-11 23:47:25 +00:00
Arnav Sharma and GitHub
d3758fb2a3
fix(expo): on /linkSocial include cookie for id token ( #9953 )
2026-06-11 16:45:19 -07:00
5c289b52bc
fix(account): resolve stateless account cookies across instances ( #9979 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-11 16:44:11 -07:00
Gustavo Valverde and GitHub
8960f5f3bd
fix(client): restructure session fetch architecture ( #8760 )
2026-06-11 22:49:34 +00:00
Gustavo Valverde and GitHub
7faddd4a1d
refactor(core): prevent accidental HTTP exposure of server-only endpoints ( #9835 )
2026-06-11 20:37:51 +00:00
Gustavo Valverde and GitHub
ed7b6c9ac0
fix: enforce team capacity, constant-time SCIM tokens, and org-admin SSO domain verification ( #10002 )
2026-06-11 19:21:34 +00:00
Gustavo Valverde and GitHub
fdef997eb9
fix: harden provider identity validation (One Tap, Microsoft, SSO, WeChat, Reddit) ( #10003 )
2026-06-11 19:10:55 +00:00
7343284149
fix: jwks caching, oauth id mapping, team invitations, account cookie, and scim deprovision bugs ( #9987 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-11 08:25:19 -07:00
Gustavo Valverde and GitHub
0c3856f098
fix: harden session authority against stale cookie cache and unverified selectors ( #9991 )
2026-06-11 13:31:13 +00:00
Taesu and GitHub
d9c526b2a5
feat(oauth-popup): add popup-based OAuth sign-in ( #9890 )
2026-06-11 05:38:22 +00:00
Taesu and GitHub
3e99e6c77e
fix(admin): create credential account in setUserPassword when missing ( #9482 )
2026-06-11 05:36:55 +00:00
Gustavo Valverde and GitHub
baeaa00bc2
fix: make single-use credentials, counters, and replay markers atomic ( #9993 )
2026-06-11 05:11:26 +00:00
Gustavo Valverde and GitHub
1dbf5bb59d
fix: harden trusted request context ( #9990 )
2026-06-11 03:50:35 +00:00
6987c628f1
fix(cli): resolve SvelteKit, Vite asset, and Cloudflare virtual-module imports ( #9834 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-06-11 01:06:43 +00:00
b803c61fdc
fix(organization): reject setting unknown or empty roles on updateMemberRole ( #9962 )
...
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com >
2026-06-10 16:57:24 -07:00
better-release[bot] and GitHub
8b1e759c07
chore: release v1.7.0-beta.5 ( #9905 )
2026-06-10 12:34:04 -07:00
Taesu and GitHub
a11a706ff2
fix(stripe): correct subscription handling and customer linking ( #9971 )
2026-06-10 18:58:40 +00:00
Gustavo Valverde
bf7f2c5b4e
chore: sync main to next
2026-06-10 11:30:38 -07:00
better-release[bot] and GitHub
1a3c8c478a
chore: release v1.6.16 ( #9958 )
2026-06-09 22:32:25 -07:00
Bereket Engida and GitHub
cb1cbfa4cc
fix: address bug findings across packages ( #9974 )
2026-06-09 19:46:12 -07:00
Gustavo Valverde and GitHub
0e1770ac75
feat(oauth-provider)!: enforce max_age ( #9936 )
2026-06-09 19:36:30 -07:00
Gustavo Valverde and GitHub
a6b0295df3
fix(sso): consume SAML AuthnRequest atomically ( #9972 )
2026-06-10 01:58:45 +00:00
Gustavo Valverde and GitHub
87e7aa5e0f
fix(api): validate Origin/Referer on cookieless email sign-in and sign-up ( #9973 )
2026-06-10 01:43:41 +00:00
Gustavo Valverde and GitHub
893cf6cb3f
fix(session): honor server-side session deletion in update-session and token routes ( #9967 )
2026-06-10 00:42:45 +00:00
Gustavo Valverde and GitHub
76a33429fc
fix(session): fire session-delete hooks for preserved sessions on secondaryStorage ( #9969 )
2026-06-10 00:40:56 +00:00
Gustavo Valverde and GitHub
3e852a2650
fix(oauth-provider): report unsupported_token_type for JWT access-token revocation ( #9970 )
2026-06-10 00:39:26 +00:00
Gustavo Valverde and GitHub
7abaaed53f
fix(oauth-provider): make private_key_jwt jti single-use atomic across processes ( #9964 )
2026-06-10 00:36:06 +00:00
Gustavo Valverde and GitHub
ec8a38c08f
feat(generic-oauth): verify discovery id_tokens and enable id_token sign-in ( #9966 )
2026-06-10 00:34:26 +00:00
Gustavo Valverde and GitHub
5e49c56a9e
fix(auth): mark plugin-owned session fields as non-input ( #9965 )
2026-06-09 23:59:09 +00:00
Paola Estefanía de Campos and GitHub
afcb4dd7f3
docs(two-factor): document newSession is null during 2FA challenge ( #9957 )
2026-06-09 13:15:00 -07:00
better-release[bot] and GitHub
03e0e36a98
chore: release v1.6.15 ( #9886 )
2026-06-08 06:57:06 -07:00
ef4e131b85
fix(kysely-adapter): inline migration-table constants to fix Turbopack build ( #9933 )
...
Co-authored-by: bytaesu <166604494+bytaesu@users.noreply.github.com >
2026-06-08 12:20:53 +00:00
Gustavo Valverde and GitHub
af572166a2
fix(auth)!: harden validateUserInfo source contract ( #9940 )
2026-06-07 22:52:59 -07:00
Gustavo Valverde and GitHub
fe9600bc07
feat(oauth-provider): accept POST on the userinfo endpoint ( #9937 )
2026-06-07 21:09:27 -07:00
0cbaf81bed
feat(oauth): server-trusted state channel; fix anonymous cookieless linking ( #9930 )
...
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-06-08 01:00:05 +00:00
91f235f860
feat(auth): add per-provider requireEmailVerification for social sign-in ( #9929 )
...
Co-authored-by: Gautam Manchandani <161146829+GautamBytes@users.noreply.github.com >
2026-06-08 00:31:20 +00:00
e0140297a5
fix(electron)!: enforce S256 PKCE and harden origin checks ( #9645 )
...
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-07 23:43:06 +00:00
d23735b1de
feat(passkey): resolve authenticator name from AAGUID at read time ( #9927 )
...
Co-authored-by: Maxwell Weru <1645026+mburumaxwell@users.noreply.github.com >
2026-06-07 23:22:39 +00:00
b0ddfd3433
fix(oauth-provider): run configured hooks when authorize resumes ( #9919 )
...
Co-authored-by: Gautam Manchandani <manchandanigautam@gmail.com >
2026-06-07 14:43:47 -07:00
Gustavo Valverde
TaesuandGitHub
Gautam ManchandaniandGitHub
Arnav SharmaandGitHub
better-release[bot]andGitHub
Paola Estefanía de CamposandGitHub
