Gustavo Valverde
79b698cbae
chore: resolve main to next sync validation
2026-06-11 19:27:46 -07:00
Gustavo Valverde
7a55ae4f52
Merge remote-tracking branch 'origin/next' into chore/sync-main-to-next-20260611
...
# Conflicts:
# .changeset/accept-invitation-team-capacity.md
# .changeset/adapters-native-increment-one.md
# .changeset/api-key-atomic-quota.md
# .changeset/delete-account-token-single-use.md
# .changeset/device-code-single-use.md
# .changeset/electron-code-single-use.md
# .changeset/email-otp-attempts-atomic.md
# .changeset/increment-one-primitive.md
# .changeset/memory-adapter-transaction-isolation.md
# .changeset/one-time-token-single-use.md
# .changeset/passkey-ceremony-binding.md
# .changeset/password-reset-token-single-use.md
# .changeset/phone-otp-attempts-atomic.md
# .changeset/rate-limit-atomic-consume.md
# .changeset/redis-increment.md
# .changeset/reserve-verification-value.md
# .changeset/saml-replay-reserve.md
# .changeset/siwe-nonce-single-use.md
# .changeset/two-factor-challenge-single-use.md
# .changeset/twofactor-otp-attempts-atomic.md
# packages/api-key/src/adapter.ts
# packages/api-key/src/api-key.test.ts
# packages/better-auth/src/api/rate-limiter/index.ts
# packages/better-auth/src/api/rate-limiter/rate-limiter.test.ts
# packages/better-auth/src/db/internal-adapter.ts
# packages/better-auth/src/plugins/device-authorization/routes.ts
# packages/better-auth/src/plugins/organization/adapter.ts
# packages/better-auth/src/plugins/organization/routes/crud-invites.ts
# packages/better-auth/src/plugins/organization/routes/crud-members.ts
# packages/better-auth/src/plugins/organization/routes/crud-team.ts
# packages/better-auth/src/plugins/organization/team.test.ts
# packages/better-auth/src/plugins/phone-number/routes.ts
# packages/better-auth/src/plugins/two-factor/two-factor.security.test.ts
# packages/core/src/db/adapter/factory.ts
# packages/core/src/db/adapter/index.ts
# packages/core/src/db/type.ts
# packages/core/src/types/context.ts
# packages/core/src/types/init-options.ts
# packages/drizzle-adapter/src/drizzle-adapter.test.ts
# packages/drizzle-adapter/src/drizzle-adapter.ts
# packages/electron/test/electron.test.ts
# packages/kysely-adapter/src/kysely-adapter.ts
# packages/memory-adapter/src/memory-adapter.ts
# packages/mongo-adapter/src/mongodb-adapter.test.ts
# packages/mongo-adapter/src/mongodb-adapter.ts
# packages/passkey/src/routes.ts
# packages/prisma-adapter/src/prisma-adapter.ts
# packages/redis-storage/src/redis-storage.ts
# packages/redis-storage/test/redis-storage.test.ts
# packages/sso/src/saml.test.ts
2026-06-11 18:45:17 -07:00
Gustavo Valverde
381fc6cfaf
chore: sync main to next
2026-06-11 18:18:13 -07:00
Gustavo Valverde and GitHub
86ccb5de91
feat(auth)!: harden atomic state transitions ( #10000 )
2026-06-12 00:46:44 +00:00
Gustavo Valverde and GitHub
7faddd4a1d
refactor(core): prevent accidental HTTP exposure of server-only endpoints ( #9835 )
2026-06-11 20:37:51 +00:00
Gustavo Valverde and GitHub
fdef997eb9
fix: harden provider identity validation (One Tap, Microsoft, SSO, WeChat, Reddit) ( #10003 )
2026-06-11 19:10:55 +00:00
7343284149
fix: jwks caching, oauth id mapping, team invitations, account cookie, and scim deprovision bugs ( #9987 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-11 08:25:19 -07:00
Gustavo Valverde and GitHub
baeaa00bc2
fix: make single-use credentials, counters, and replay markers atomic ( #9993 )
2026-06-11 05:11:26 +00:00
Gustavo Valverde and GitHub
1dbf5bb59d
fix: harden trusted request context ( #9990 )
2026-06-11 03:50:35 +00:00
better-release[bot] and GitHub
8b1e759c07
chore: release v1.7.0-beta.5 ( #9905 )
2026-06-10 12:34:04 -07:00
Gustavo Valverde
bf7f2c5b4e
chore: sync main to next
2026-06-10 11:30:38 -07:00
better-release[bot] and GitHub
1a3c8c478a
chore: release v1.6.16 ( #9958 )
2026-06-09 22:32:25 -07:00
Bereket Engida and GitHub
cb1cbfa4cc
fix: address bug findings across packages ( #9974 )
2026-06-09 19:46:12 -07:00
better-release[bot] and GitHub
03e0e36a98
chore: release v1.6.15 ( #9886 )
2026-06-08 06:57:06 -07:00
Gustavo Valverde and GitHub
af572166a2
fix(auth)!: harden validateUserInfo source contract ( #9940 )
2026-06-07 22:52:59 -07:00
91f235f860
feat(auth): add per-provider requireEmailVerification for social sign-in ( #9929 )
...
Co-authored-by: Gautam Manchandani <161146829+GautamBytes@users.noreply.github.com >
2026-06-08 00:31:20 +00:00
41cca606d1
feat(auth): add user.validateUserInfo provisioning gate ( #9864 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-07 14:34:48 -07:00
7fe0e2b165
feat: add clientAssertion support to the Microsoft Entra ID social provider ( #9898 )
...
Co-authored-by: Bereket Engida <86073083+Bekacru@users.noreply.github.com >
Co-authored-by: Bereket Engida <Bekacru@gmail.com >
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-06-05 20:28:46 -07:00
Gustavo Valverde and GitHub
4f53b61f49
refactor(oauth)!: verify provider id_tokens with a single shared verifier ( #9828 )
2026-06-05 08:00:03 -04:00
Gustavo Valverde and GitHub
40b392ae21
feat(oauth)!: accumulate granted scopes as grantedScopes string[] ( #9825 )
2026-06-04 17:54:52 -04:00
better-release[bot] and GitHub
5038d41ca2
chore: release v1.6.14 ( #9846 )
2026-06-02 16:56:28 -04:00
better-release[bot] and GitHub
a5e2442e3c
chore: release v1.7.0-beta.4 ( #9534 )
2026-05-31 14:29:39 +01:00
Gustavo Valverde
1f4ca6e1e4
chore: sync main to next
...
Pull in #9845 (runtime-safe redirect-uri validation and fragment rejection) now that it merged to main, so next gets the corrected validation directly instead of waiting for a later sync.
2026-05-31 13:39:57 +01:00
Gustavo Valverde and GitHub
13abc7922b
fix(core): make redirect-uri validation runtime-safe and reject fragments ( #9845 )
2026-05-31 13:37:39 +01:00
Gustavo Valverde
065f5ad72d
chore: sync main to next
...
Brings the v1.6.13 stable fixes into next: redirect_uri scheme validation in oidc-provider and mcp (#9838 ), clientPrivileges enforcement on dynamic client registration (#9837 ), null organization logo support (#9842 ), the consumeOne non-numeric deleteMany guard (#9831 ), and the db-adapter guide alignment (#9830 ).
Conflicts were limited to release version bumps and CHANGELOG entries; resolved by keeping next's 1.7.0-beta.3 line. The ten changesets consumed by the v1.6.13 release are accepted as deleted, and no external dependencies changed.
2026-05-31 13:02:15 +01:00
better-release[bot] and GitHub
a6f38c72ee
chore: release v1.6.13 ( #9804 )
2026-05-31 12:41:17 +01:00
Gustavo Valverde and GitHub
be32012ca3
fix(oauth): validate redirect_uri schemes in oidc-provider and mcp ( #9838 )
2026-05-31 11:38:52 +01:00
Taesu and GitHub
5c3e248cbf
fix(core): throw on non-numeric deleteMany in consumeOne fallback ( #9831 )
2026-05-31 09:00:18 +00:00
Gustavo Valverde
ef4fb0ff95
chore: merge main into next ( #9533 )
...
Sync main (through #9821/#9820/#9822/#9768) into next. Conflicting
package.json files keep next's version and intentional divergences (for
example the cli's c12 v4) while taking main's dependency updates, including
the samlify 2.13.1 and fast-xml-parser security bumps; the lockfile is
regenerated from the reconciled set. The 13 source/doc/test conflicts take
next's refactored architecture as the baseline; main's colliding fixes are
re-applied on top in the following per-domain commits.
Clean main fixes land via this merge, including the auto-restored
account-takeover defenses #9578 and #9577 .
2026-05-31 00:10:16 +01:00
43c08a2bc7
fix(account): scope OAuth account identity and fix buggy internalAdapter helpers ( #9818 )
...
Co-authored-by: Krish Garg <kgarg@chapman.edu >
2026-05-30 20:48:10 +00:00
23d7cbfa79
fix(oauth): apply updateUserInfoOnLink in OAuth callback link flow ( #8758 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-30 19:48:38 +01:00
5f282bd382
fix(account): default storeStateStrategy to "database" when using secondaryStorage ( #9591 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-30 11:05:28 +01:00
better-release[bot] and GitHub
c0c574ea50
chore: release v1.6.12 ( #9590 )
2026-05-29 22:28:58 +01:00
Gustavo Valverde and GitHub
c5b9f93498
fix(generic-oauth): add accessTokenExpiresIn for providers that omit expires_in ( #9799 )
2026-05-29 20:49:59 +00:00
a3b0c63de9
fix: accept hashed nonces for native iOS sign-in with Apple ( #8870 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-28 12:35:09 +00:00
7bf5449b11
fix(oauth2): map jose token verification errors ( #9655 )
...
Co-authored-by: cyphercodes <cyphercodes@users.noreply.github.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-27 09:45:02 +00:00
Taesu and GitHub
83fa3695e7
feat(core): add string case conversion utilities ( #9727 )
2026-05-24 23:40:22 +00:00
Gustavo Valverde and GitHub
e7eb45b065
feat(oauth): per-request additionalParams and loginHint ( #9305 )
2026-05-19 17:18:43 +00:00
f77060af3a
fix: consumeVerificationValue returns null for expired rows ( #9624 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-05-19 16:37:55 +00:00
03e6c94e96
feat(generic-oauth,sso): support IDP-initiated flows via secure bounce ( #9301 )
...
Co-authored-by: Menachem Hornbacher <mhornbacher@kiddom.co >
2026-05-19 12:29:04 +00:00
Gustavo Valverde and GitHub
1e5b808472
refactor(oauth): single-source Basic credentials + getHttpTestInstance ( #9657 )
2026-05-17 19:23:45 +00:00
aebf66d8e6
feat: add token endpoint client authentication ( #9625 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-16 18:27:15 +00:00
better-release[bot] and GitHub
f41514ef07
chore: release v1.6.11 ( #9532 )
2026-05-12 17:30:34 +01:00
Maxwell and GitHub
b0ef96fd8e
fix: invalid instrumentation import list ( #9582 )
2026-05-12 15:03:15 +00:00
Gustavo Valverde and GitHub
da7e50beee
fix(oauth): block OAuth linking to unverified local accounts ( #9578 )
2026-05-12 14:20:19 +00:00
Gustavo Valverde and GitHub
0cbddb8fa4
refactor(db): rename claimOne adapter primitive to consumeOne ( #9568 )
2026-05-12 07:44:07 +00:00
Taesu and GitHub
62b8793c11
chore(deps): consolidate kysely into pnpm catalog ( #9569 )
2026-05-12 07:38:59 +00:00
3bec284c4f
chore(deps): bump kysely from 0.28.14 to 0.28.17 ( #9567 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-05-12 06:25:23 +00:00
Gustavo Valverde and GitHub
a2c0c9346e
feat(db): add atomic claimOne adapter primitive ( #9560 )
2026-05-11 20:10:29 +00:00
Maxwell and GitHub
ee93485499
fix: add error code to change-email-disabled ( #8948 )
2026-05-11 11:49:38 +00:00
Gustavo Valverde
better-release[bot]andGitHub
Bereket EngidaandGitHub
