copilot-swe-agent[bot] and GitHub
cce041b08d
test(jwt): tighten HS256 verification assertions
2026-06-12 19:07:05 +00:00
copilot-swe-agent[bot] and GitHub
206cf8ec0b
fix(jwt): verify encrypted HS256 keys
2026-06-12 19:04:19 +00:00
Claude and Gustavo Valverde
5370d0367c
feat(jwt): add HS256 symmetric key algorithm support
...
Adds support for HS256 (HMAC with SHA-256) symmetric key signing to the
JWT plugin. This enables users to use symmetric key JWTs for internal
service-to-service communication.
Changes:
- Add HS256 to JWKOptions type
- Generate symmetric secret keys for HS256 using jose's generateSecret
- Handle HS256 signing with the secret key
- Handle HS256 verification using the secret key (with decryption)
- Disable JWKS endpoint for HS256 (symmetric keys should not be exposed)
- Add comprehensive tests for HS256 functionality
Closes #7245
2026-04-09 15:33:18 +01:00
Gustavo Valverde and GitHub
3d9ea81232
chore: sync main to next
...
chore: sync main to next
2026-04-09 15:25:00 +01:00
better-release[bot] and GitHub
700d298e1e
chore: version packages ( #9052 )
2026-04-09 15:19:07 +01:00
Gustavo Valverde and GitHub
ef7cd5ba79
ci: restructure release notes to group by npm package ( #9011 )
2026-04-09 15:15:58 +01:00
7ac092ec52
docs: fix missing secret param in getSignedCookie example ( #8827 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-09 13:57:45 +00:00
809da03968
docs: add paragraph specifying need for cookie passage for server methods ( #6546 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-09 13:26:13 +00:00
31fd092896
docs: clarify that the redirectURI must include providerId parameter in generic oauth ( #6021 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-09 13:23:33 +00:00
cf25761bc1
docs: clarify credential account requirement for phone number plugin ( #6401 )
...
Signed-off-by: GautamBytes <manchandanigautam@gmail.com >
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-09 13:19:50 +00:00
b834782e2b
docs: add 'better-auth-audit-logs' plugin to community table ( #9051 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-09 13:14:25 +00:00
Gustavo Valverde and GitHub
4c829bf289
fix(oauth-provider): preserve multi-valued query params through prompt redirects ( #9060 )
2026-04-09 13:13:39 +00:00
b20fa424c3
fix(next-js): replace cookie probe with header-based RSC detection in nextCookies ( #9059 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-09 12:41:10 +00:00
Gustavo Valverde and GitHub
608d8c3082
fix(sso): include RelayState in signed SAML AuthnRequests ( #9058 )
2026-04-09 12:05:02 +00:00
Dylan Vanmali and GitHub
c6922dce8e
refactor(oauth-provider): reject skip_consent at schema level in DCR ( #8998 )
2026-04-09 11:56:29 +00:00
5e5d3f62fc
fix(sso): normalize SAMLResponse whitespace at request boundary ( #8968 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-04-09 11:04:10 +00:00
2cbcb9baac
fix(oauth2): prevent cross-provider account collision in link-social callback ( #8983 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-04-09 10:17:42 +00:00
9deb7936ab
fix: cookie store strategy should verify oauth state ( #8949 )
...
Co-authored-by: Bereket Engida <86073083+Bekacru@users.noreply.github.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-04-09 09:26:36 +00:00
84098432ad
feat(two-factor): include enabled 2fa methods in sign-in redirect response ( #8772 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-04-09 09:25:49 +00:00
e78a7b120d
fix(two-factor): prevent unverified TOTP enrollment from gating sign-in ( #8711 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-04-09 08:48:10 +00:00
Gustavo Valverde and GitHub
4e6136516c
chore: optimize pre-commit hooks for faster commits ( #9044 )
2026-04-09 06:53:36 +00:00
Taesu and GitHub
01f85ce807
chore: rewrite CONTRIBUTING.md ( #9048 )
2026-04-08 23:32:31 +00:00
Taesu and GitHub
438d10d22e
docs: scale inline code size inside changelog headings ( #9047 )
2026-04-08 22:50:40 +00:00
Gustavo Valverde and GitHub
b5497dcc90
fix(ci): make lint:dependencies script cross-platform ( #9042 )
2026-04-08 20:55:38 +01:00
85bb710edc
chore: version packages ( #9018 )
...
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-04-08 19:22:59 +00:00
Taesu and GitHub
7495830659
fix(api): restore getSession accessibility in generic Auth<O> context ( #9017 )
2026-04-08 17:34:12 +00:00
Taesu and GitHub
54713e2fad
docs: fix sidebar SVG icon colors and clean up New tags ( #9041 )
2026-04-08 17:14:40 +00:00
Taesu and GitHub
0a09441200
chore: fix lockfiles and cspell pre-commit hook ( #9039 )
2026-04-08 14:03:24 +00:00
514a3062ec
chore(deps-dev): bump vite from 7.3.1 to 7.3.2 ( #9001 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-04-08 08:02:56 +00:00
8ad1995077
chore(deps): bump drizzle-orm from 0.45.1 to 0.45.2 ( #9033 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-08 07:40:52 +00:00
Taesu and GitHub
538e949eb3
docs: switch npm download stats to weekly ( #9035 )
2026-04-08 07:16:13 +00:00
Taesu and GitHub
b24fd23790
docs: remove commet plugin from sidebar ( #9034 )
2026-04-08 07:11:21 +00:00
e2df67cf0d
docs: add v1.6 release blog post ( #9009 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-04-08 06:50:50 +00:00
63bf778ea4
chore(deps): bump hono from 4.12.7 to 4.12.12 ( #9029 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-08 06:49:06 +00:00
c665898953
docs(email): document beforeEmailVerification and onExistingUserSignUp callbacks ( #8914 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-08 02:15:29 +00:00
Allan Delmare and GitHub
fcd25d5057
docs: move @delmaredigital/payload-better-auth from plugins to adapters ( #9027 )
2026-04-08 02:04:00 +00:00
Maxwell and GitHub
fe6b72b675
docs: improve state-mismatch documentation ( #9026 )
2026-04-08 09:29:13 +10:00
a7e359d870
docs: add expo sentinel docs ( #9025 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-04-07 23:08:15 +00:00
5e7fd61da0
docs: hide fumadocs toc scroll indicator dot ( #9021 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-08 08:49:35 +10:00
Jonathan Samines and GitHub
2e537df5f7
fix: endpoint instrumentation to always use route template ( #9023 )
2026-04-08 08:41:31 +10:00
Gustavo Valverde and GitHub
465c1dccf6
ci: add one-click changeset commit and unify bot identity ( #9019 )
2026-04-07 19:54:34 +00:00
Maxwell and GitHub
f61ad1cab7
fix: use INVALID_PASSWORD for all checkPassword failures ( #8902 )
2026-04-07 18:17:10 +00:00
47dc887d58
docs: add @delmaredigital/payload-better-auth to community plugins ( #8375 )
...
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-04-07 16:39:03 +00:00
Sandy and GitHub
3b95d70d04
docs: change community plugin name ( #8961 )
2026-04-07 16:26:55 +00:00
Taesu and GitHub
374985e340
docs: update community adapters and plugins pages ( #9014 )
2026-04-07 15:43:55 +00:00
Taesu and GitHub
3baf0294c2
chore(docs): add remark-frontmatter ( #9015 )
2026-04-07 15:35:57 +00:00
60123da09c
docs: add missing secret to getSignedCookie and remove misleading comments ( #9008 )
...
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-04-07 15:26:25 +00:00
Gustavo Valverde and GitHub
4da3b1e51d
chore: re-enter beta pre-release mode ( #9000 )
2026-04-06 22:06:54 +01:00
Gustavo Valverde and GitHub
3f85809ddb
chore: sync main to next ( #8995 )
...
chore: sync main to next
2026-04-06 22:03:10 +01:00
Gustavo Valverde and GitHub
0e3f188020
chore: release v1.6.0
...
chore: promote v1.6.0 to stable
2026-04-06 17:23:12 +01:00
copilot-swe-agent[bot]andGitHub
ClaudeandGustavo Valverde
better-release[bot]andGitHub
Dylan VanmaliandGitHub
TaesuandGitHub
Allan DelmareandGitHub
SandyandGitHub
