github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-07-27 10:55:09 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity
6,741 Commits 139 Branches 1,417 Tags
@better-auth/api-key@1.7.0-beta.2
Commit Graph
104 Commits
Author SHA1 Message Date
better-release[bot]andGitHub d3bde2d21f chore: release v1.7.0-beta.2 (#9207) 2026-04-22 17:23:06 +01:00
Gustavo ValverdeandGitHub 5c6de4ed26 fix(oauth-provider)!: return RFC-compliant error envelopes from validation failures (#9277) 2026-04-22 06:48:34 +00:00
Ruban SGitHubMaxwell
 		954b664f4f feat(org): allow passing userId and organizationId to listUserTeams API (#8977) 
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com>
 2026-04-21 08:15:16 +00:00
Dylan VanmaliandGitHub 0b52dfcc23 docs(cimd): recommend removal of allowUnauthenticatedClientRegistration for client deduplication (#9191) 2026-04-15 20:57:19 +00:00
Gustavo Valverde 225976c7d2 chore: main to next conflict resolution 
Resolve the main to next sync discrepancies after the v1.6.4 release.

Conflict resolution:
- keep next package versions at 1.7.0-beta.1
- keep both changelog streams by inserting the stable 1.6.4 sections below the 1.7.0-beta entries
- restore the next pre-release accumulator changesets that the stable release deleted on main
 2026-04-15 15:40:35 +01:00
better-release[bot]andGitHub 9ec849ff71 chore: release v1.6.4 (#9175) 2026-04-15 13:00:42 +01:00
Gustavo ValverdeGitHubMaxwell
 		39d6af2a39 chore(adapters): require patched drizzle-orm and kysely peer versions (#9165) 
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com>
 2026-04-15 11:37:50 +00:00
Gustavo ValverdeandGitHub 9aed910499 fix(two-factor): revert enforcement broadening from #9122 (#9205) 2026-04-15 10:59:53 +00:00
Gustavo ValverdeandGitHub d2a1ec091f chore(cimd): add to fixed version group and align at 1.7.0-beta.1 (#9200) 2026-04-15 07:53:04 +01:00
Gautam ManchandaniGitHubMaxwell
 		acbd6ef69f fix: honor forceAllowId UUIDs on postgres adapters (#9068) 
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com>
 2026-04-14 13:05:11 +00:00
better-release[bot]andGitHub d8dfa515e2 chore: release v1.7.0-beta.1 (#9120) 2026-04-14 12:29:23 +01:00
better-release[bot]andGitHub 6f17bb3ebd chore: release v1.6.3 (#9081) 2026-04-14 12:04:31 +01:00
Gustavo Valverde 3fbab44068 chore: sync main to next 
Resolves conflicts in PR #9115 which the release bot cannot auto-merge.

Conflict resolutions:
- .github/workflows/release.yml: take main's hardened grep fallback (92256a2d0)
- docs/content/docs/plugins/sso.mdx: take main's named-exports refactor verbatim (#9144)
- packages/oauth-provider/src/token.ts: keep next's at_hash sequencing (#9079),
  add main's customTokenResponseFields spread and credential helper rename (#9118)
- packages/oauth-provider/src/token.test.ts: keep both new describe blocks
  (at_hash in id tokens from next, customTokenResponseFields from main)

Semantic fixes on auto-merged files where git silently dropped main's changes
around next's discriminated-response refactor:
- two-factor/index.ts: restore skipVerificationOnEnable handling in the totp
  enablement path
- two-factor/types.ts: restore the skipVerificationOnEnable type field
- two-factor/two-factor.test.ts: narrow the discriminated enable response via
  method === "totp" guard
 2026-04-14 11:30:13 +01:00
MaxwellGitHubTaesuGustavo Valverde
 		9a6d4759cd fix(client): prevent isMounted race condition causing many rps (#9078) 
Co-authored-by: Taesu <bytaesu@gmail.com>
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com>
 2026-04-14 09:36:59 +00:00
Gustavo ValverdeandGitHub 390a03190c fix(stripe): prevent prototype pollution via user-supplied metadata (#9164) 2026-04-14 08:05:31 +00:00
Gustavo ValverdeandGitHub 5142e9cec5 fix(auth): harden dynamic baseURL resolution (#9131) 2026-04-14 08:01:13 +00:00
TaesuandGitHub 513dabb132 fix: resolve dynamic baseURL for direct auth.api calls (#9113) 2026-04-14 06:16:53 +00:00
Gustavo ValverdeGitHubDylan Vanmali
 		cd8313ba00 feat(cimd): add Client ID Metadata Document plugin (#9159) 
Co-authored-by: Dylan Vanmali <dylanvanmali@yahoo.com>
 2026-04-13 20:52:34 +00:00
Gustavo ValverdeandGitHub c7d22539ec refactor(generic-oauth)!: rewrite as first-class social provider with RFC compliance (#9069) 2026-04-13 12:02:16 +00:00
Gustavo ValverdeandGitHub e2e25a4954 fix(oauth-provider): graceful DCR override for unauthenticated confidential clients (#9123) 2026-04-11 15:25:06 +00:00
Byte-BiscuitGitHubGustavo Valverde
 		f8758975ae fix(two-factor): updated backup codes respect storeBackupCodes option (#7231) 
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com>
 2026-04-11 13:19:46 +00:00
Gustavo ValverdeandGitHub 484ce6a262 fix(two-factor): enforce 2FA on all sign-in paths (#9122) 2026-04-11 12:33:58 +00:00
Gustavo ValverdeandGitHub 960304354a fix(sso): upgrade samlify to 2.12.0 with XPath injection and XXE fixes (#9121) 2026-04-11 10:46:50 +00:00
Gustavo ValverdeandGitHub 6f2948e87b feat(oauth-provider): compute at_hash in id tokens per OIDC Core §3.1.3.6 (#9079) 2026-04-11 10:29:20 +00:00
Gustavo ValverdeandGitHub b70f025bfa refactor(sso)!: remove callbackUrl, consolidate ACS endpoint, fix SLO (#9117) 2026-04-11 10:03:56 +00:00
Gustavo ValverdeandGitHub 314e06f0fd feat(oauth-provider): add customTokenResponseFields and harden authorization code validation (#9118) 2026-04-11 09:54:48 +00:00
better-release[bot]andGitHub c8cf0f7c1a chore: release v1.7.0-beta.0 (#9073) 2026-04-10 21:29:25 +01:00
Gustavo Valverde 28ccc8cda9 chore: resolve main-to-next sync conflicts 
Conflicts resolved:
- docs/content/docs/plugins/2fa.mdx: kept next's OTP feature, applied main's exported const pattern
- docs/content/docs/plugins/oauth-provider.mdx: kept main's formatting, added back private_key_jwt docs
- docs/content/docs/plugins/sso.mdx: kept next's version with private_key_jwt and SAML options
- packages/sso/src/routes/sso.ts: kept next's version (has security fixes and private_key_jwt)
 2026-04-10 19:11:05 +01:00
TaesuandGitHub 4673c6d83c fix(cli): handle extends and mid-path wildcards in tsconfig paths (#9032) 2026-04-10 16:26:53 +00:00
Gustavo ValverdeandGitHub 52c47517a2 fix(sso): unify SAML response processing and fix bugs (#9097) 2026-04-10 15:00:26 +00:00
Gustavo ValverdeandGitHub 544f1c63c9 feat(two-factor)!: add OTP enablement and discriminated response (#9057) 2026-04-10 14:23:20 +00:00
TaesuGitHubbetter-release[bot] <273320539+better-release[bot]@users.noreply.github.com>
 		c5066fe5d6 fix(stripe): omit quantity for metered prices in checkout and upgrades (#8926) 
Co-authored-by: better-release[bot] <273320539+better-release[bot]@users.noreply.github.com>
 2026-04-10 12:55:44 +00:00
Gustavo ValverdeandGitHub 93d3871bd2 feat(oauth): add private_key_jwt client authentication (RFC 7523) (#8836) 2026-04-10 08:22:05 +00:00
TaesuGitHubleonardo2204better-release[bot] <273320539+better-release[bot]@users.noreply.github.com>
 		5f84335815 feat(stripe): support Stripe SDK v21 and v22 (#9084) 
Co-authored-by: leonardo2204 <1509421+leonardo2204@users.noreply.github.com>
Co-authored-by: better-release[bot] <273320539+better-release[bot]@users.noreply.github.com>
 2026-04-10 06:19:34 +00:00
Oluwatobi MustaphaGitHubMaxwellping-maxwell
 		f6428d02fc fix(open-api): correct get-session nullable schema for OAS 3.1 (#8389) 
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com>
Co-authored-by: ping-maxwell <maxwell.multinite@gmail.com>
 2026-04-09 20:44:35 +00:00
RayGitHubMaxwell
 		6ce30cf138 fix: incorrect operationId in password reset callback endpoint (#9072) 
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com>
 2026-04-09 20:13:06 +00:00
Gustavo ValverdeandGitHub b790144a2e fix(sso)!: harden SAML response validation (InResponseTo, Audience, SessionIndex) (#9055) 2026-04-09 17:30:01 +00:00
better-release[bot]andGitHub 700d298e1e chore: version packages (#9052) 2026-04-09 15:19:07 +01:00
Gustavo ValverdeandGitHub 4c829bf289 fix(oauth-provider): preserve multi-valued query params through prompt redirects (#9060) 2026-04-09 13:13:39 +00:00
Gustavo ValverdeGitHubMaxwell
 		b20fa424c3 fix(next-js): replace cookie probe with header-based RSC detection in nextCookies (#9059) 
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com>
 2026-04-09 12:41:10 +00:00
Gustavo ValverdeandGitHub 608d8c3082 fix(sso): include RelayState in signed SAML AuthnRequests (#9058) 2026-04-09 12:05:02 +00:00
Dylan VanmaliandGitHub c6922dce8e refactor(oauth-provider): reject skip_consent at schema level in DCR (#8998) 2026-04-09 11:56:29 +00:00
Rayan SalhabGitHubGustavo Valverde
 		5e5d3f62fc fix(sso): normalize SAMLResponse whitespace at request boundary (#8968) 
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com>
 2026-04-09 11:04:10 +00:00
Jaydeep pipaliyaGitHubGustavo Valverde
 		2cbcb9baac fix(oauth2): prevent cross-provider account collision in link-social callback (#8983) 
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com>
 2026-04-09 10:17:42 +00:00
MaxwellGitHubBereket EngidaGustavo Valverde
 		9deb7936ab fix: cookie store strategy should verify oauth state (#8949) 
Co-authored-by: Bereket Engida <86073083+Bekacru@users.noreply.github.com>
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com>
 2026-04-09 09:26:36 +00:00
armfulGitHubGustavo Valverde
 		84098432ad feat(two-factor): include enabled 2fa methods in sign-in redirect response (#8772) 
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com>
 2026-04-09 09:25:49 +00:00
armfulGitHubGustavo Valverde
 		e78a7b120d fix(two-factor): prevent unverified TOTP enrollment from gating sign-in (#8711) 
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com>
 2026-04-09 08:48:10 +00:00
better-release[bot]GitHubgithub-actions[bot] <github-actions[bot]@users.noreply.github.com>
 		85bb710edc chore: version packages (#9018) 
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
 2026-04-08 19:22:59 +00:00
TaesuandGitHub 7495830659 fix(api): restore getSession accessibility in generic Auth<O> context (#9017) 2026-04-08 17:34:12 +00:00
Jonathan SaminesandGitHub 2e537df5f7 fix: endpoint instrumentation to always use route template (#9023) 2026-04-08 08:41:31 +10:00