better-release[bot] and GitHub
d8dfa515e2
chore: release v1.7.0-beta.1 ( #9120 )
2026-04-14 12:29:23 +01:00
Gustavo Valverde
834841fbc9
chore: sync v1.6.3 release into next
...
Brings main's `chore: release v1.6.3 (#9081 )` commit into next after the
stable release. Conflict resolution:
- `packages/*/package.json`: keep next's `1.7.0-beta.0` (per the release
bot's standard rule: next is always ahead of main in version).
- `packages/*/CHANGELOG.md`: keep both version entries side-by-side. Next's
`1.7.0-beta.0` section stays on top; main's new `1.6.3` section slots in
below. Each entry describes its own branch's release.
- `.changeset/*.md`: restore the 14 changesets git auto-deleted. Next is in
pre-release mode (`.changeset/pre.json` `mode: "pre"`), so changesets
accumulate across beta cuts and are only consumed on `exit-pre`. Main's
release deleted them from main; next must keep them for its own pre-release
accumulator.
2026-04-14 12:10:23 +01:00
better-release[bot] and GitHub
6f17bb3ebd
chore: release v1.6.3 ( #9081 )
2026-04-14 12:04:31 +01:00
Gustavo Valverde and GitHub
960304354a
fix(sso): upgrade samlify to 2.12.0 with XPath injection and XXE fixes ( #9121 )
2026-04-11 10:46:50 +00:00
Gustavo Valverde and GitHub
b70f025bfa
refactor(sso)!: remove callbackUrl, consolidate ACS endpoint, fix SLO ( #9117 )
2026-04-11 10:03:56 +00:00
better-release[bot] and GitHub
c8cf0f7c1a
chore: release v1.7.0-beta.0 ( #9073 )
2026-04-10 21:29:25 +01:00
Gustavo Valverde
ca5d303607
fix(sso): guard toLowerCase against falsy email and use safe redirect
...
- Add empty string fallback before .toLowerCase() to prevent TypeError
when both mapped email attribute and extract.nameID are falsy
- Use validated samlRedirectUrl instead of raw callbackUrl in error
redirect to maintain open-redirect and loop-protection guarantees
2026-04-10 21:06:47 +01:00
Gustavo Valverde
97fca6a1cf
refactor(sso): adopt saml-pipeline and port security fixes
...
Use main's saml-pipeline.ts for SAML response processing, replacing
~1000 lines of duplicated inline code in sso.ts. Port the four
security fixes from #9055 into the pipeline:
- Fix InResponseTo field path (extract.response?.inResponseTo)
- Add Audience Restriction validation
- Fix SessionIndex stored as string, not object
- Fix allowIdpInitiated default to false
Delegate to validateInResponseTo/validateAudience from
response-validation.ts instead of reimplementing inline.
Graft private_key_jwt (RFC 7523) support from #8836 onto main's
pipeline-based sso.ts.
2026-04-10 20:25:41 +01:00
Gustavo Valverde
28ccc8cda9
chore: resolve main-to-next sync conflicts
...
Conflicts resolved:
- docs/content/docs/plugins/2fa.mdx: kept next's OTP feature, applied main's exported const pattern
- docs/content/docs/plugins/oauth-provider.mdx: kept main's formatting, added back private_key_jwt docs
- docs/content/docs/plugins/sso.mdx: kept next's version with private_key_jwt and SAML options
- packages/sso/src/routes/sso.ts: kept next's version (has security fixes and private_key_jwt)
2026-04-10 19:11:05 +01:00
Gustavo Valverde and GitHub
52c47517a2
fix(sso): unify SAML response processing and fix bugs ( #9097 )
2026-04-10 15:00:26 +00:00
Gustavo Valverde and GitHub
93d3871bd2
feat(oauth): add private_key_jwt client authentication (RFC 7523) ( #8836 )
2026-04-10 08:22:05 +00:00
Gustavo Valverde and GitHub
b790144a2e
fix(sso)!: harden SAML response validation (InResponseTo, Audience, SessionIndex) ( #9055 )
2026-04-09 17:30:01 +00:00
better-release[bot] and GitHub
700d298e1e
chore: version packages ( #9052 )
2026-04-09 15:19:07 +01:00
Gustavo Valverde and GitHub
608d8c3082
fix(sso): include RelayState in signed SAML AuthnRequests ( #9058 )
2026-04-09 12:05:02 +00:00
5e5d3f62fc
fix(sso): normalize SAMLResponse whitespace at request boundary ( #8968 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-04-09 11:04:10 +00:00
85bb710edc
chore: version packages ( #9018 )
...
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-04-08 19:22:59 +00:00
better-release[bot]
d666a03372
chore: exit pre-release mode for v1.6.0
2026-04-06 14:41:56 +00:00
Gustavo Valverde and GitHub
29d197e688
chore: sync main to next ( #8976 )
...
chore: sync main to next
2026-04-06 15:31:29 +01:00
ee8b40d502
fix(deps): patch Dependabot security issues ( #8838 )
...
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-04-06 13:16:45 +00:00
better-auth-releases[bot] and github-actions[bot] <github-actions[bot]@users.noreply.github.com>
73beda26f9
chore: version packages (beta) ( #8945 )
...
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-04-04 15:52:24 +00:00
Gustavo Valverde and GitHub
1eec2e8090
chore: use caret ranges for internal peerDependencies ( #8937 )
2026-04-03 19:05:37 +00:00
Gustavo Valverde and GitHub
77ead28455
chore: reset package versions to 1.5.6 ( #8930 )
2026-04-03 10:57:28 +00:00
Gustavo Valverde and GitHub
e089ce127d
chore(knip): fix CI blind spots and remove dead code ( #8888 )
2026-04-02 19:28:30 +00:00
Gustavo Valverde and GitHub
e80cc38b0d
fix: turbo caching, enforce lockfile integrity, expand pre-commit hooks ( #8892 )
2026-04-02 07:35:24 +00:00
Gustavo Valverde and GitHub
04e91d1643
perf(build): reduce published package sizes ( #8884 )
2026-04-01 15:55:03 +00:00
Jonathan Samines and GitHub
cd01a42e60
feat: expose plugin version ( #8750 )
2026-03-31 16:08:21 +00:00
Taesu and GitHub
23bad5139f
feat(sso): enable InResponseTo validation by default for SAML flows ( #8736 )
2026-03-30 06:20:27 +00:00
Martin Rädlinger and GitHub
e16b184b0b
fix(sso): provisionUser inconsistency and option to run on every login ( #8818 )
2026-03-30 06:18:11 +00:00
David Frankel and GitHub
e9f49bd7c8
chore: fix type inference for future TS compatibility ( #8820 )
2026-03-30 05:00:05 +00:00
Bereket Engida
841410031a
chore: release v1.5.7-beta.1
2026-03-22 21:09:52 -07:00
Bereket Engida
c527d4e4cc
chore: release v1.5.1-beta.4
2026-03-22 21:04:04 -07:00
Taesu and GitHub
b647ef3488
fix(sso): skip state cookie check for SAML ACS cross-site POST ( #8735 )
2026-03-22 14:27:55 -07:00
5c7bc4b434
chore(deps): bump fast-xml-parser from 5.5.6 to 5.5.7 ( #8698 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-20 22:26:50 +00:00
Alex Yang and GitHub
a67630edb4
fix(sso): use namespace import for samlify to fix ESM compatibility ( #8697 )
2026-03-19 19:31:11 +00:00
Oscar Cornish and GitHub
ac9541a846
feat(sso): Add logging for when code validation fails in oidc callback ( #8693 )
2026-03-19 18:23:35 +00:00
40b5e23b3b
chore(deps): bump fast-xml-parser from 5.4.1 to 5.5.6 ( #8665 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-18 16:55:02 +00:00
Alex Yang and GitHub
71c3a85d2f
fix(sso): handle bare domains in domain verification ( #8369 )
2026-03-06 08:03:20 +00:00
Alex Yang and GitHub
bd980f8c5b
fix(sso): use internalAdapter for verification operations ( #8353 )
2026-03-04 03:55:26 +00:00
Alex Yang
ab6b14cb19
chore: release v1.5.1-beta.3
2026-03-03 12:14:56 +09:00
Alex Yang
3ee808a48c
chore: release v1.5.1-beta.2
2026-03-03 06:49:28 +09:00
Alex Yang and GitHub
b73b0440a2
chore: align zod imports to use namespace import from "zod" ( #8300 )
2026-03-02 20:37:38 +00:00
e32bad12ea
fix(sso): prefer UserInfo endpoint over ID token and map sub claim correctly ( #8276 )
...
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-03-02 07:15:41 +00:00
Alex Yang
425c6abf6e
chore: release v1.5.1-beta.1
2026-03-02 02:05:39 +09:00
Alex Yang and GitHub
d341824a96
fix(db): support verification operations with secondary storage ( #8247 )
2026-03-01 12:40:02 +00:00
Cyrus Ho and GitHub
293c6b6953
fix(sso): ensure consistent OIDC discovery across APIs ( #8118 )
2026-02-28 13:46:48 -08:00
Alex Yang and GitHub
2bd462cf22
fix(ci): increase test timeout for sso, api-key, oauth-provider and add CI job timeout ( #8210 )
2026-02-28 06:04:59 +00:00
Alex Yang
2fd1ef38e7
chore: release v1.5.0-beta.20
2026-02-28 02:20:43 +09:00
Alex Yang and GitHub
8048a1d367
chore: upgrade dependencies ( #8183 )
2026-02-27 08:11:46 +00:00
fd964c23e9
chore(deps): bump fast-xml-parser from 5.3.6 to 5.3.8 ( #8180 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-27 02:37:25 +00:00
Bereket Engida
554f0ef7e1
chore: release v1.5.0-beta.19
2026-02-25 16:21:37 -08:00
better-release[bot]andGitHub
Gustavo Valverde
better-auth-releases[bot]andgithub-actions[bot] <github-actions[bot]@users.noreply.github.com>
Jonathan SaminesandGitHub
TaesuandGitHub
Martin RädlingerandGitHub
David FrankelandGitHub
Bereket Engida
Alex YangandGitHub
Oscar CornishandGitHub
Cyrus HoandGitHub