d2a79bae79
feat(oauth-provider)!: model OAuth protected resources explicitly ( #9648 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-12 10:08:43 -07:00
48070ada8b
feat(sso): support additionalFields on ssoProvider ( #9445 )
...
Signed-off-by: Gautam Manchandani <manchandanigautam@gmail.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-12 10:00:55 -07:00
34558bc52b
feat(session): support JWKS-backed JWT session cookie cache ( #8931 )
...
Signed-off-by: Gautam Manchandani <manchandanigautam@gmail.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-12 15:03:33 +00:00
Gustavo Valverde and GitHub
e53582ce55
feat(mcp)!: ship MCP as its own package built on the OAuth provider ( #9992 )
2026-06-11 21:34:38 -07:00
Gustavo Valverde
5ce8d4cb55
chore: keep beta Apple docs component available
2026-06-11 20:03:44 -07:00
Gustavo Valverde
d2949a8700
Merge remote-tracking branch 'origin/main' into chore/sync-main-to-next-20260611
2026-06-11 18:45:33 -07:00
Gustavo Valverde
7a55ae4f52
Merge remote-tracking branch 'origin/next' into chore/sync-main-to-next-20260611
...
# Conflicts:
# .changeset/accept-invitation-team-capacity.md
# .changeset/adapters-native-increment-one.md
# .changeset/api-key-atomic-quota.md
# .changeset/delete-account-token-single-use.md
# .changeset/device-code-single-use.md
# .changeset/electron-code-single-use.md
# .changeset/email-otp-attempts-atomic.md
# .changeset/increment-one-primitive.md
# .changeset/memory-adapter-transaction-isolation.md
# .changeset/one-time-token-single-use.md
# .changeset/passkey-ceremony-binding.md
# .changeset/password-reset-token-single-use.md
# .changeset/phone-otp-attempts-atomic.md
# .changeset/rate-limit-atomic-consume.md
# .changeset/redis-increment.md
# .changeset/reserve-verification-value.md
# .changeset/saml-replay-reserve.md
# .changeset/siwe-nonce-single-use.md
# .changeset/two-factor-challenge-single-use.md
# .changeset/twofactor-otp-attempts-atomic.md
# packages/api-key/src/adapter.ts
# packages/api-key/src/api-key.test.ts
# packages/better-auth/src/api/rate-limiter/index.ts
# packages/better-auth/src/api/rate-limiter/rate-limiter.test.ts
# packages/better-auth/src/db/internal-adapter.ts
# packages/better-auth/src/plugins/device-authorization/routes.ts
# packages/better-auth/src/plugins/organization/adapter.ts
# packages/better-auth/src/plugins/organization/routes/crud-invites.ts
# packages/better-auth/src/plugins/organization/routes/crud-members.ts
# packages/better-auth/src/plugins/organization/routes/crud-team.ts
# packages/better-auth/src/plugins/organization/team.test.ts
# packages/better-auth/src/plugins/phone-number/routes.ts
# packages/better-auth/src/plugins/two-factor/two-factor.security.test.ts
# packages/core/src/db/adapter/factory.ts
# packages/core/src/db/adapter/index.ts
# packages/core/src/db/type.ts
# packages/core/src/types/context.ts
# packages/core/src/types/init-options.ts
# packages/drizzle-adapter/src/drizzle-adapter.test.ts
# packages/drizzle-adapter/src/drizzle-adapter.ts
# packages/electron/test/electron.test.ts
# packages/kysely-adapter/src/kysely-adapter.ts
# packages/memory-adapter/src/memory-adapter.ts
# packages/mongo-adapter/src/mongodb-adapter.test.ts
# packages/mongo-adapter/src/mongodb-adapter.ts
# packages/passkey/src/routes.ts
# packages/prisma-adapter/src/prisma-adapter.ts
# packages/redis-storage/src/redis-storage.ts
# packages/redis-storage/test/redis-storage.test.ts
# packages/sso/src/saml.test.ts
2026-06-11 18:45:17 -07:00
Gustavo Valverde
381fc6cfaf
chore: sync main to next
2026-06-11 18:18:13 -07:00
ZerGo0 and GitHub
029cbdc072
docs: update Apple client secret JWT guidance ( #9938 )
2026-06-11 17:54:44 -07:00
Gustavo Valverde and GitHub
86ccb5de91
feat(auth)!: harden atomic state transitions ( #10000 )
2026-06-12 00:46:44 +00:00
Jordan Kahtava and GitHub
44a24ed948
docs: highlighted emailVerified requirement on manually inserted users ( #9999 )
2026-06-11 17:45:37 -07:00
Gautam Manchandani and GitHub
bf39cbf13f
feat(phone-number): add server-side OTP consumption API ( #9766 )
2026-06-11 16:58:16 -07:00
Taesu and GitHub
b36c38f984
feat(captcha)!: support wildcard endpoint matching ( #10004 )
2026-06-11 23:47:25 +00:00
Damien Maspero and GitHub
e468ff37ce
docs: update Node.js built-in SQLite status to Release Candidate ( #9914 )
2026-06-10 23:13:39 -07:00
Taesu and GitHub
3e99e6c77e
fix(admin): create credential account in setUserPassword when missing ( #9482 )
2026-06-11 05:36:55 +00:00
6987c628f1
fix(cli): resolve SvelteKit, Vite asset, and Cloudflare virtual-module imports ( #9834 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-06-11 01:06:43 +00:00
Gustavo Valverde
d7bba8ee33
Merge origin/next into chore/sync-main-to-next
2026-06-10 11:34:38 -07:00
Gustavo Valverde
bf7f2c5b4e
chore: sync main to next
2026-06-10 11:30:38 -07:00
Eric Luce and GitHub
82dbc9b8bf
docs: add ProofKit FileMaker adapter ( #9980 )
2026-06-10 11:26:02 -07:00
Prakash Kumar and GitHub
128bc34572
docs: add horizontal scrolling to landing page code block ( #9975 )
2026-06-09 23:22:24 -07:00
Bereket Engida and GitHub
cb1cbfa4cc
fix: address bug findings across packages ( #9974 )
2026-06-09 19:46:12 -07:00
Gustavo Valverde and GitHub
87e7aa5e0f
fix(api): validate Origin/Referer on cookieless email sign-in and sign-up ( #9973 )
2026-06-10 01:43:41 +00:00
Gustavo Valverde and GitHub
76a33429fc
fix(session): fire session-delete hooks for preserved sessions on secondaryStorage ( #9969 )
2026-06-10 00:40:56 +00:00
Gustavo Valverde and GitHub
3e852a2650
fix(oauth-provider): report unsupported_token_type for JWT access-token revocation ( #9970 )
2026-06-10 00:39:26 +00:00
Gustavo Valverde and GitHub
7abaaed53f
fix(oauth-provider): make private_key_jwt jti single-use atomic across processes ( #9964 )
2026-06-10 00:36:06 +00:00
Gustavo Valverde and GitHub
ec8a38c08f
feat(generic-oauth): verify discovery id_tokens and enable id_token sign-in ( #9966 )
2026-06-10 00:34:26 +00:00
Paola Estefanía de Campos and GitHub
afcb4dd7f3
docs(two-factor): document newSession is null during 2FA challenge ( #9957 )
2026-06-09 13:15:00 -07:00
Taesu and GitHub
6a8dfa4f3e
docs(changelog): show contributor avatars with proper size and styling ( #9956 )
2026-06-09 19:44:32 +00:00
Gustavo Valverde and GitHub
af572166a2
fix(auth)!: harden validateUserInfo source contract ( #9940 )
2026-06-07 22:52:59 -07:00
0cbaf81bed
feat(oauth): server-trusted state channel; fix anonymous cookieless linking ( #9930 )
...
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-06-08 01:00:05 +00:00
91f235f860
feat(auth): add per-provider requireEmailVerification for social sign-in ( #9929 )
...
Co-authored-by: Gautam Manchandani <161146829+GautamBytes@users.noreply.github.com >
2026-06-08 00:31:20 +00:00
e0140297a5
fix(electron)!: enforce S256 PKCE and harden origin checks ( #9645 )
...
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-07 23:43:06 +00:00
d23735b1de
feat(passkey): resolve authenticator name from AAGUID at read time ( #9927 )
...
Co-authored-by: Maxwell Weru <1645026+mburumaxwell@users.noreply.github.com >
2026-06-07 23:22:39 +00:00
ea64709ae6
docs: security update for June 2026 ( #9884 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-06-07 14:41:58 -07:00
41cca606d1
feat(auth): add user.validateUserInfo provisioning gate ( #9864 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-07 14:34:48 -07:00
Gustavo Valverde and GitHub
b32094a46d
docs(oauth-provider): reframe back-channel logout changeset and fill doc gaps ( #9916 )
2026-06-06 07:39:23 -07:00
Gustavo Valverde and GitHub
e0d2b9eb9b
feat(oauth-provider)!: add OIDC back-channel logout ( #9304 )
2026-06-06 07:06:53 -07:00
74c32fe56e
docs: clarify organization-owned api keys also require a user ( #9780 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-06-05 21:09:03 -07:00
7fe0e2b165
feat: add clientAssertion support to the Microsoft Entra ID social provider ( #9898 )
...
Co-authored-by: Bereket Engida <86073083+Bekacru@users.noreply.github.com >
Co-authored-by: Bereket Engida <Bekacru@gmail.com >
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-06-05 20:28:46 -07:00
Suliman Abdulrazzaq and GitHub
f3396987a9
docs: add DBSC plugin documentation ( #9892 )
2026-06-05 18:58:50 -07:00
Gustavo Valverde and GitHub
40b392ae21
feat(oauth)!: accumulate granted scopes as grantedScopes string[] ( #9825 )
2026-06-04 17:54:52 -04:00
Decker and GitHub
3bc7d09083
docs: restore Commet plugin documentation ( #9798 )
2026-06-04 20:46:46 +09:00
17130ec6ef
docs: mention minimal import option in installation guide ( #9891 )
...
Co-authored-by: Parship Chowdhury <parshipchowdhury@gmail.com >
2026-06-03 21:37:23 +00:00
Taesu and GitHub
695753106d
docs: update community adapters ( #9881 )
2026-06-03 09:11:14 +00:00
Gustavo Valverde and GitHub
2d9781a83d
fix(organization): split invitation verification gates ( #9877 )
2026-06-02 16:45:44 -04:00
Taesu and GitHub
840a56a8ce
docs(organization): document clearing logo with null ( #9858 )
2026-06-01 06:12:01 +00:00
Gustavo Valverde and GitHub
b4b086722c
fix(oauth-provider)!: bind RFC 8707 resource indicators to the authorization grant ( #9836 )
2026-05-31 14:14:50 +01:00
Gustavo Valverde and GitHub
a8ea86e25e
fix(scim)!: always bind personal SCIM connections to their creator ( #9840 )
2026-05-31 12:53:18 +00:00
Gustavo Valverde
065f5ad72d
chore: sync main to next
...
Brings the v1.6.13 stable fixes into next: redirect_uri scheme validation in oidc-provider and mcp (#9838 ), clientPrivileges enforcement on dynamic client registration (#9837 ), null organization logo support (#9842 ), the consumeOne non-numeric deleteMany guard (#9831 ), and the db-adapter guide alignment (#9830 ).
Conflicts were limited to release version bumps and CHANGELOG entries; resolved by keeping next's 1.7.0-beta.3 line. The ten changesets consumed by the v1.6.13 release are accepted as deleted, and no external dependencies changed.
2026-05-31 13:02:15 +01:00
Taesu and GitHub
df9e8b2951
docs: align db adapter guide with adapter contract ( #9830 )
2026-05-31 09:01:50 +00:00
ZerGo0andGitHub
Jordan KahtavaandGitHub
TaesuandGitHub
Damien MasperoandGitHub
Eric LuceandGitHub
Prakash KumarandGitHub
Bereket EngidaandGitHub
Paola Estefanía de CamposandGitHub
Suliman AbdulrazzaqandGitHub
DeckerandGitHub
