Gustavo Valverde
ee8b50e9c8
Merge branch 'main' of github.com:better-auth/better-auth into feat/oauth-provider-client-key-rotation
...
# Conflicts:
# packages/oauth-provider/src/private-key-jwt.test.ts
2026-10-14 22:08:51 +01:00
Taesu and GitHub
c03ced528a
chore: bump @biomejs/biome ( #11760 )
2026-10-14 21:01:10 +00:00
0a1a87e388
fix(oauth-provider): distinguish post-login continuation from initial selection ( #11185 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-14 18:32:15 +00:00
54a09948e8
fix(oauth-provider): validate DPoP against public URL ( #10799 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-14 18:27:25 +00:00
e78f15aa31
fix(core): allow 30s of clock skew when verifying ID tokens ( #11749 )
...
Co-authored-by: Lohith <ssvlohith@gmail.com >
2026-10-14 17:06:19 +01:00
e9d9921217
fix(generic-oauth): retry discovery for providers skipped at startup ( #11750 )
...
Co-authored-by: mangomac <mangomac@users.noreply.github.com >
2026-10-14 16:53:53 +01:00
916ef5c530
fix(mongo-adapter): retry a transaction aborted with a transient error ( #11515 )
...
Co-authored-by: Maxwell Afamefuna Nzekwe <70326615+maxnze1@users.noreply.github.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-14 16:30:50 +01:00
aaf0d7da3e
fix(oauth-provider): keep auth working when startup resource seeding fails ( #11726 )
...
Co-authored-by: Panagiotis Plytas <34184381+pplytas@users.noreply.github.com >
Co-authored-by: Arjun Vijay Prakash <137415649+ArjunCodess@users.noreply.github.com >
Co-authored-by: Tushar <192458782+Tushar-Khandelwal-2004@users.noreply.github.com >
Co-authored-by: zoom-dustin-moriarty <221604897+zoom-dustin-moriarty@users.noreply.github.com >
2026-10-14 12:33:21 +01:00
f0ce580fbd
fix(phone-number): use custom verifyOTP when resetting the password ( #10698 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-14 11:37:54 +01:00
c3f11cc1a1
docs(sso): clarify SAML callbackUrl vs ACS endpoint in 1.7 ( #11703 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-14 10:18:24 +01:00
182e92bd8a
fix(sso): allow rotating SAML IdP signing certificate with linked accounts ( #11687 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-14 10:16:38 +01:00
a878f9ab47
fix(sso): support array of emails in OIDC claim resolution ( #11640 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-14 10:16:10 +01:00
0cfe07dccd
fix(drizzle-adapter): support dates in string columns ( #11731 )
...
Co-authored-by: ping-maxwell <maxwell.multinite@gmail.com >
2026-10-14 08:50:41 +01:00
1d95ebf3fe
fix(session): fall back to database for bulk session lookups ( #11718 )
...
Co-authored-by: choksi2212 <choksi2212@users.noreply.github.com >
2026-10-13 03:15:11 +00:00
Remco and GitHub
a2a74e1524
docs: open header dropdowns on activation instead of focus ( #11678 )
2026-10-13 08:39:01 +09:00
Menachem Hornbacher and GitHub
6700372896
docs: update JWT docs to list all fields ( #11339 )
2026-10-13 08:28:39 +09:00
Deepanshu Pal and GitHub
7393f6350e
docs: fix Electron and Polar example syntax ( #11587 )
2026-10-13 08:25:54 +09:00
23ee48ad9a
docs: add good-webhooks to community plugins ( #11697 )
...
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-13 08:16:17 +09:00
Gustavo Valverde
3390792bbe
feat(oauth-provider): let private_key_jwt clients rotate their own keys
...
A confidential client with inline `jwks` can now replace its keys at
`POST /oauth2/client/rotate-keys` without a user session. The request
carries the complete new JWK Set and a client assertion signed by a
current key, addressed to the rotation endpoint itself, so an assertion
minted for the token endpoint or the issuer cannot be redirected here.
Enabled with `allowClientKeyRotation`.
Keys left out of the new set stop verifying at once. A client rolls a
key in two steps, the way a jwks_uri client does: it sends the old and
new keys together, then drops the old key once every instance signs with
the new one. Only current keys can authorize a rotation, matching
RFC 7592, node-oidc-provider, Ory Hydra, and Keycloak, where only the
current management credential can change a client.
The write is guarded on the exact key set the assertion was verified
against, so a concurrent rotation fails with 409 instead of overwriting.
No schema change is needed.
2026-10-12 14:15:06 +01:00
Gustavo Valverde and GitHub
fe2559b7a0
docs(oauth-provider): show client-aware access token claims ( #11656 )
2026-10-11 18:29:53 +00:00
Gustavo Valverde and GitHub
847acd02bb
feat(oauth-provider): pass client ID to privilege checks ( #11658 )
2026-10-11 18:29:52 +00:00
Gustavo Valverde and GitHub
38f3bb34af
feat(oauth-provider): link resources during managed client registration ( #11655 )
2026-10-11 18:29:51 +00:00
Gustavo Valverde and GitHub
1a9be41d18
feat(oauth-provider): allow client disable through admin update ( #11654 )
2026-10-10 14:52:35 +01:00
Talat Mahmud and GitHub
ef5c12c696
docs: add @octopi-ai/better-enrollment to community plugins ( #11653 )
2026-10-10 17:06:56 +09:00
e15625ff38
fix(better-auth): allow SvelteKit 3 as a peer dependency ( #11488 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-09 16:33:41 +00:00
Taesu and GitHub
53307a7c60
docs(integrations): add Effect integration guide ( #11566 )
2026-10-09 09:41:45 +00:00
62146108c7
fix(oauth-provider): accept host-bearing custom-scheme native redirects ( #10956 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-09 08:59:37 +01:00
07a09389ef
fix(password): consume the reset token inside the reset transaction ( #11646 )
...
Co-authored-by: edenbuilds <279970382+edenbuilds@users.noreply.github.com >
Co-authored-by: omkar1work <omkar1work@gmail.com >
2026-10-09 06:44:53 +00:00
Gustavo Valverde and GitHub
67743ed6e8
fix(password): revoke sessions and write the new password atomically ( #11626 )
2026-10-09 06:44:52 +00:00
Gustavo Valverde and GitHub
a9f455d586
fix(core): run after-commit hooks when the transaction fallback rolls nothing back ( #11645 )
2026-10-09 06:44:51 +00:00
Gustavo Valverde and GitHub
f556970135
fix(scim): match attribute names case-insensitively ( #11644 )
2026-10-08 19:25:50 +01:00
39f09800b7
fix(scim): treat JSON null as unassigned in SCIM requests ( #11638 )
...
Co-authored-by: Jonathan Samines <jn.samines@gmail.com >
Co-authored-by: sufiyan733 <kanekigaming786@gmail.com >
2026-10-08 18:33:14 +01:00
666e1def97
chore(scim): ensure inactive SCIM user resources can be reactivated ( #11167 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-08 16:59:55 +00:00
369176e7f6
fix(db): keep derived replay-marker ids under uuid and serial ids ( #11625 )
...
Co-authored-by: Chandan P <95340276+NoiceHax@users.noreply.github.com >
Co-authored-by: onmax <22072217+onmax@users.noreply.github.com >
2026-10-08 14:31:59 +00:00
Taesu and GitHub
733f7934a1
docs(mongo-adapter): clarify transaction setup ( #11550 )
2026-10-03 10:07:35 +09:00
Jonathan Samines and GitHub
7eb961f4af
docs: add documentation for new dash/sentinel options ( #11526 )
2026-10-02 11:34:47 -06:00
Taesu and GitHub
9b104a22e7
docs(captcha): clarify protected endpoints ( #11511 )
2026-10-01 23:48:23 +09:00
4738fef731
docs(rate-limit): correct default window ( #11492 )
...
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-10-01 16:17:38 +09:00
12cf61b3ce
docs(email-password): correct APIMethod contracts ( #11499 )
...
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-10-01 15:56:12 +09:00
55b67da016
docs(magic-link): correct APIMethod contract and document rateLimit ( #11497 )
...
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-10-01 15:53:51 +09:00
Gustavo Valverde and GitHub
ac54bfd678
fix(auth): isolate verification records and encryption purposes ( #11494 )
2026-09-30 20:56:11 +00:00
683ac1ddc3
feat(oauth-provider): add validateRedirectUri option for custom redirect validation ( #8686 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-09-29 08:26:56 +00:00
Emmanuel Odii and GitHub
8817e98429
docs: add @stellartools/betterauth-adapter to community plugins ( #11451 )
2026-09-29 08:30:26 +09:00
Md Sufiyan and GitHub
ce373da451
docs: update test helper import in contributing guide ( #11454 )
2026-09-29 08:18:54 +09:00
129d54a9dc
docs(chargebee): fix cli command and update migration guidance ( #11456 )
...
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-09-29 08:03:19 +09:00
Md Sufiyan and GitHub
200bc6a7cc
docs: update CLI command in drizzle adapter guide ( #11453 )
2026-09-29 07:57:13 +09:00
Jonathan Samines and GitHub
74f68176b7
docs: update enterprise pricing details ( #11369 )
2026-09-28 14:03:25 -06:00
Sivert Bjørnerås and GitHub
266e2bc2be
docs: add eusend to the email provider list ( #11446 )
2026-09-29 01:02:28 +09:00
Sivert Bjørnerås and GitHub
eb62f535f6
docs: add @eusend_dev/better-auth to community plugins ( #11447 )
2026-09-29 01:02:16 +09:00
Bereket Engida and GitHub
5e6c8bcade
docs: prefetch homepage media after load on fast connections to stop scroll pop-in ( #11431 )
2026-09-27 08:16:47 +00:00
Gustavo Valverde
TaesuandGitHub
RemcoandGitHub
Menachem HornbacherandGitHub
Deepanshu PalandGitHub
Talat MahmudandGitHub
Emmanuel OdiiandGitHub
Md SufiyanandGitHub
Sivert BjørneråsandGitHub