Gustavo Valverde
7a55ae4f52
Merge remote-tracking branch 'origin/next' into chore/sync-main-to-next-20260611
...
# Conflicts:
# .changeset/accept-invitation-team-capacity.md
# .changeset/adapters-native-increment-one.md
# .changeset/api-key-atomic-quota.md
# .changeset/delete-account-token-single-use.md
# .changeset/device-code-single-use.md
# .changeset/electron-code-single-use.md
# .changeset/email-otp-attempts-atomic.md
# .changeset/increment-one-primitive.md
# .changeset/memory-adapter-transaction-isolation.md
# .changeset/one-time-token-single-use.md
# .changeset/passkey-ceremony-binding.md
# .changeset/password-reset-token-single-use.md
# .changeset/phone-otp-attempts-atomic.md
# .changeset/rate-limit-atomic-consume.md
# .changeset/redis-increment.md
# .changeset/reserve-verification-value.md
# .changeset/saml-replay-reserve.md
# .changeset/siwe-nonce-single-use.md
# .changeset/two-factor-challenge-single-use.md
# .changeset/twofactor-otp-attempts-atomic.md
# packages/api-key/src/adapter.ts
# packages/api-key/src/api-key.test.ts
# packages/better-auth/src/api/rate-limiter/index.ts
# packages/better-auth/src/api/rate-limiter/rate-limiter.test.ts
# packages/better-auth/src/db/internal-adapter.ts
# packages/better-auth/src/plugins/device-authorization/routes.ts
# packages/better-auth/src/plugins/organization/adapter.ts
# packages/better-auth/src/plugins/organization/routes/crud-invites.ts
# packages/better-auth/src/plugins/organization/routes/crud-members.ts
# packages/better-auth/src/plugins/organization/routes/crud-team.ts
# packages/better-auth/src/plugins/organization/team.test.ts
# packages/better-auth/src/plugins/phone-number/routes.ts
# packages/better-auth/src/plugins/two-factor/two-factor.security.test.ts
# packages/core/src/db/adapter/factory.ts
# packages/core/src/db/adapter/index.ts
# packages/core/src/db/type.ts
# packages/core/src/types/context.ts
# packages/core/src/types/init-options.ts
# packages/drizzle-adapter/src/drizzle-adapter.test.ts
# packages/drizzle-adapter/src/drizzle-adapter.ts
# packages/electron/test/electron.test.ts
# packages/kysely-adapter/src/kysely-adapter.ts
# packages/memory-adapter/src/memory-adapter.ts
# packages/mongo-adapter/src/mongodb-adapter.test.ts
# packages/mongo-adapter/src/mongodb-adapter.ts
# packages/passkey/src/routes.ts
# packages/prisma-adapter/src/prisma-adapter.ts
# packages/redis-storage/src/redis-storage.ts
# packages/redis-storage/test/redis-storage.test.ts
# packages/sso/src/saml.test.ts
2026-06-11 18:45:17 -07:00
Gustavo Valverde
381fc6cfaf
chore: sync main to next
2026-06-11 18:18:13 -07:00
Gustavo Valverde and GitHub
86ccb5de91
feat(auth)!: harden atomic state transitions ( #10000 )
2026-06-12 00:46:44 +00:00
Gustavo Valverde and GitHub
7faddd4a1d
refactor(core): prevent accidental HTTP exposure of server-only endpoints ( #9835 )
2026-06-11 20:37:51 +00:00
Gustavo Valverde and GitHub
0c3856f098
fix: harden session authority against stale cookie cache and unverified selectors ( #9991 )
2026-06-11 13:31:13 +00:00
Gustavo Valverde and GitHub
baeaa00bc2
fix: make single-use credentials, counters, and replay markers atomic ( #9993 )
2026-06-11 05:11:26 +00:00
better-release[bot] and GitHub
8b1e759c07
chore: release v1.7.0-beta.5 ( #9905 )
2026-06-10 12:34:04 -07:00
Gustavo Valverde
bf7f2c5b4e
chore: sync main to next
2026-06-10 11:30:38 -07:00
better-release[bot] and GitHub
1a3c8c478a
chore: release v1.6.16 ( #9958 )
2026-06-09 22:32:25 -07:00
Bereket Engida and GitHub
cb1cbfa4cc
fix: address bug findings across packages ( #9974 )
2026-06-09 19:46:12 -07:00
better-release[bot] and GitHub
03e0e36a98
chore: release v1.6.15 ( #9886 )
2026-06-08 06:57:06 -07:00
better-release[bot] and GitHub
5038d41ca2
chore: release v1.6.14 ( #9846 )
2026-06-02 16:56:28 -04:00
better-release[bot] and GitHub
a5e2442e3c
chore: release v1.7.0-beta.4 ( #9534 )
2026-05-31 14:29:39 +01:00
better-release[bot] and GitHub
a6f38c72ee
chore: release v1.6.13 ( #9804 )
2026-05-31 12:41:17 +01:00
Gustavo Valverde
ef4fb0ff95
chore: merge main into next ( #9533 )
...
Sync main (through #9821/#9820/#9822/#9768) into next. Conflicting
package.json files keep next's version and intentional divergences (for
example the cli's c12 v4) while taking main's dependency updates, including
the samlify 2.13.1 and fast-xml-parser security bumps; the lockfile is
regenerated from the reconciled set. The 13 source/doc/test conflicts take
next's refactored architecture as the baseline; main's colliding fixes are
re-applied on top in the following per-domain commits.
Clean main fixes land via this merge, including the auto-restored
account-takeover defenses #9578 and #9577 .
2026-05-31 00:10:16 +01:00
Taesu and GitHub
e131d3ac5b
fix(api-key): verify non-default keys when configId is omitted ( #9794 )
2026-05-30 03:14:57 +00:00
better-release[bot] and GitHub
c0c574ea50
chore: release v1.6.12 ( #9590 )
2026-05-29 22:28:58 +01:00
Maxwell and GitHub
f6bf45123f
fix(api-key): add better-call as peer dependency to fix TS4023 declaration emit ( #9759 )
2026-05-27 00:05:31 +00:00
better-release[bot] and GitHub
f41514ef07
chore: release v1.6.11 ( #9532 )
2026-05-12 17:30:34 +01:00
Gustavo Valverde and GitHub
23094a628f
fix(organization): default-on requireEmailVerificationOnInvitation & extend gate to get/list ( #9577 )
2026-05-12 13:12:03 +00:00
Gustavo Valverde and GitHub
a2c0c9346e
feat(db): add atomic claimOne adapter primitive ( #9560 )
2026-05-11 20:10:29 +00:00
b03998586a
fix(api-key): return 429 instead of 401 when API key is rate limited ( #9505 )
...
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com >
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-05-09 20:09:43 +00:00
4839a2d761
chore: release v1.7.0-beta.3 ( #9323 )
...
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-05-09 19:28:11 +00:00
Taesu
2b83087180
chore: sync main to next
2026-05-10 03:45:29 +09:00
cbb5014cdf
chore: release v1.6.10 ( #9350 )
...
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-05-09 14:31:47 +00:00
62c4050850
fix(api-keys): api.verifyApiKey does not check against the configId ( #9393 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-05-06 18:22:10 +00:00
Taesu and GitHub
75524d61b1
test(api-key): add regression test for listApiKeys with integer user.id ( #9343 )
2026-04-24 06:44:25 +00:00
better-release[bot] and GitHub
f484269228
chore: release v1.6.9 ( #9341 )
2026-04-24 06:25:08 +01:00
better-release[bot] and GitHub
b289ac6c4b
chore: release v1.6.8 ( #9316 )
2026-04-23 11:31:03 +01:00
better-release[bot] and GitHub
d3bde2d21f
chore: release v1.7.0-beta.2 ( #9207 )
2026-04-22 17:23:06 +01:00
Gustavo Valverde
eb3cd10d50
chore: resolve main-to-next sync conflicts
...
- keep next package versions at 1.7.0-beta.1
- keep both changelog streams by inserting the stable 1.6.5, 1.6.6, and 1.6.7 sections below the 1.7.0-beta entries
- keep the cimd and dash deps on demo/nextjs (next-only); regenerate pnpm-lock.yaml
- resolve TODO(sync-from-main-9226) in oauth-provider authorize.ts: findRegisteredRedirectUri now uses isLoopbackIP from @better-auth/core/utils/host to cover the full 127.0.0.0/8 range per RFC 8252 §7.3
- drop the unused saml import that main's #9262 added to sso/src/routes/sso.ts; next already migrated to saml-pipeline
2026-04-22 14:54:27 +01:00
better-release[bot] and GitHub
f8076d141a
chore: release v1.6.7 ( #9289 )
2026-04-22 12:36:30 +01:00
better-release[bot] and GitHub
0290077760
chore: release v1.6.6 ( #9222 )
2026-04-21 17:42:18 +01:00
Taesu and GitHub
b5742f9d08
feat(core): add mapConcurrent bounded-concurrency utility ( #9227 )
2026-04-21 15:31:08 +00:00
3728518d1c
fix(api-key): run secondary-storage api-key executions in parallel ( #9187 )
...
Co-authored-by: Taesu <bytaesu@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-04-17 12:43:30 +00:00
better-release[bot] and GitHub
c8a91f4167
chore: release v1.6.5 ( #9209 )
2026-04-16 11:05:30 +01:00
Gustavo Valverde
225976c7d2
chore: main to next conflict resolution
...
Resolve the main to next sync discrepancies after the v1.6.4 release.
Conflict resolution:
- keep next package versions at 1.7.0-beta.1
- keep both changelog streams by inserting the stable 1.6.4 sections below the 1.7.0-beta entries
- restore the next pre-release accumulator changesets that the stable release deleted on main
2026-04-15 15:40:35 +01:00
better-release[bot] and GitHub
9ec849ff71
chore: release v1.6.4 ( #9175 )
2026-04-15 13:00:42 +01:00
better-release[bot] and GitHub
d8dfa515e2
chore: release v1.7.0-beta.1 ( #9120 )
2026-04-14 12:29:23 +01:00
Gustavo Valverde
834841fbc9
chore: sync v1.6.3 release into next
...
Brings main's `chore: release v1.6.3 (#9081 )` commit into next after the
stable release. Conflict resolution:
- `packages/*/package.json`: keep next's `1.7.0-beta.0` (per the release
bot's standard rule: next is always ahead of main in version).
- `packages/*/CHANGELOG.md`: keep both version entries side-by-side. Next's
`1.7.0-beta.0` section stays on top; main's new `1.6.3` section slots in
below. Each entry describes its own branch's release.
- `.changeset/*.md`: restore the 14 changesets git auto-deleted. Next is in
pre-release mode (`.changeset/pre.json` `mode: "pre"`), so changesets
accumulate across beta cuts and are only consumed on `exit-pre`. Main's
release deleted them from main; next must keep them for its own pre-release
accumulator.
2026-04-14 12:10:23 +01:00
better-release[bot] and GitHub
6f17bb3ebd
chore: release v1.6.3 ( #9081 )
2026-04-14 12:04:31 +01:00
better-release[bot] and GitHub
c8cf0f7c1a
chore: release v1.7.0-beta.0 ( #9073 )
2026-04-10 21:29:25 +01:00
better-release[bot] and GitHub
700d298e1e
chore: version packages ( #9052 )
2026-04-09 15:19:07 +01:00
85bb710edc
chore: version packages ( #9018 )
...
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-04-08 19:22:59 +00:00
better-release[bot]
d666a03372
chore: exit pre-release mode for v1.6.0
2026-04-06 14:41:56 +00:00
better-auth-releases[bot] and github-actions[bot] <github-actions[bot]@users.noreply.github.com>
73beda26f9
chore: version packages (beta) ( #8945 )
...
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-04-04 15:52:24 +00:00
Gustavo Valverde and GitHub
1eec2e8090
chore: use caret ranges for internal peerDependencies ( #8937 )
2026-04-03 19:05:37 +00:00
Gustavo Valverde and GitHub
77ead28455
chore: reset package versions to 1.5.6 ( #8930 )
2026-04-03 10:57:28 +00:00
Gustavo Valverde and GitHub
e80cc38b0d
fix: turbo caching, enforce lockfile integrity, expand pre-commit hooks ( #8892 )
2026-04-02 07:35:24 +00:00
Gustavo Valverde and GitHub
04e91d1643
perf(build): reduce published package sizes ( #8884 )
2026-04-01 15:55:03 +00:00
Gustavo Valverde
better-release[bot]andGitHub
Bereket EngidaandGitHub
TaesuandGitHub
MaxwellandGitHub
better-auth-releases[bot]andgithub-actions[bot] <github-actions[bot]@users.noreply.github.com>