4839a2d761
chore: release v1.7.0-beta.3 ( #9323 )
...
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-05-09 19:28:11 +00:00
Taesu
2b83087180
chore: sync main to next
2026-05-10 03:45:29 +09:00
cbb5014cdf
chore: release v1.6.10 ( #9350 )
...
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-05-09 14:31:47 +00:00
Taesu and GitHub
09f1327acb
fix(api): prevent duplicate set-cookie on redirect ( #9497 )
2026-05-09 13:50:46 +00:00
Taesu and GitHub
15ff28a957
fix(internal-adapter): rename deleteAccount param from accountId to id ( #9503 )
2026-05-09 13:50:32 +00:00
fde043207e
fix: improve link accessibility issues ( #9521 )
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
Co-authored-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
2026-05-09 11:31:27 +00:00
Maxwell and GitHub
cf591360e7
fix(organization): re-export field types to prevent TS2742 with additionalFields ( #9349 )
2026-05-08 06:47:33 +00:00
Taesu and GitHub
36464de646
test: assert auth.fetch is the same reference as auth.handler ( #9495 )
2026-05-08 05:17:51 +00:00
Maxwell and GitHub
8c1e91757d
fix: warn for cookie-plugin being last in array ( #9484 )
2026-05-08 02:55:33 +00:00
Pooya Parsa and GitHub
523f95c10d
feat: make Auth instance fetchable ( #9431 )
2026-05-07 13:55:03 -07:00
3a9a2c37ee
chore: expose refreshUserSessions on internal adapter ( #7764 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
Co-authored-by: ping-maxwell <maxwell.multinite@gmail.com >
2026-05-07 10:17:56 +00:00
e9c978e2af
fix(username): respect callbackURL on sign-in ( #9475 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-05-07 05:56:00 +00:00
729c00d74c
feat(username): add immutable username option ( #9240 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-05-06 20:58:46 +00:00
Maxwell and GitHub
36ef808c6c
fix: incorrect email casing across one-tap, email-otp & email-verification ( #9369 )
2026-05-06 18:42:13 +00:00
9a7b51d0d3
fix(credential): apply enumeration protection when autoSignIn is false ( #8839 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-05-06 18:17:46 +00:00
e71aad3b6d
fix(organization): refresh active role on sign out ( #9440 )
...
Co-authored-by: cyphercodes <cyphercodes@users.noreply.github.com >
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-05-06 18:08:22 +00:00
fc02cedb70
fix(oauth): reject callbacks missing provider account id ( #9456 )
...
Co-authored-by: cyphercodes <cyphercodes@users.noreply.github.com >
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-05-06 17:57:15 +00:00
9f1ef1f7e5
fix(siwe): add getNonce client alias ( #9461 )
...
Co-authored-by: cyphercodes <cyphercodes@users.noreply.github.com >
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-05-06 17:36:35 +00:00
Taesu and GitHub
8d71f42421
test(types): regression for plugin types through factory and indirection ( #9466 )
2026-05-06 14:16:21 +00:00
Taesu and GitHub
93fd0524e9
test(generic-oauth): cover first-time signin with storeAccountCookie + JWE ( #9470 )
2026-05-06 14:16:05 +00:00
Maxwell and GitHub
1b259024dc
fix(generic-oauth): non-ASCII error_description causes TypeError on redirect ( #9065 )
2026-05-06 11:25:56 +00:00
b2d655c77c
fix: allow dynamic organization invitation roles ( #9437 )
...
Co-authored-by: cyphercodes <cyphercodes@users.noreply.github.com >
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-05-06 08:15:02 +00:00
80a655d271
fix(admin): revalidate useSession after impersonation ( #9402 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-05-06 05:19:54 +00:00
a597ee01ed
fix(organization): cancelPendingInvitationsOnReInvite is unreachable — re-invite returns 400 ( #9452 ) ( #9453 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-05-06 03:13:32 +00:00
Taesu and GitHub
906b7b34a7
fix(bearer): write one entry per cookie name when merging session token ( #9387 )
2026-05-01 02:13:16 +00:00
Taesu and GitHub
fe64413cef
chore: bump vitest ( #9413 )
2026-05-01 01:40:28 +00:00
Taesu and GitHub
d17ee3e534
test: add regression tests for public type exports from better-auth/types ( #9419 )
2026-05-01 01:16:02 +00:00
Maxwell and GitHub
88a7c678f4
fix: openAPI schema for POST /sign-in/social mis-declares required fields ( #9268 )
2026-04-25 07:18:10 +00:00
Maxwell and GitHub
1e0f26d4c8
fix(captcha): breaks email-otp flow ( #8339 )
2026-04-25 00:28:55 +00:00
c1336c563d
fix(organization): scope setActiveTeam to active organization ( #9239 )
...
Signed-off-by: Gautam Manchandani <manchandanigautam@gmail.com >
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-24 23:48:16 +00:00
skalkii and GitHub
ca57b001b9
docs(test): cross-reference #8897 on cookie-strategy OAuth state CSRF test ( #9334 )
2026-04-24 16:25:18 +09:00
better-release[bot] and GitHub
f484269228
chore: release v1.6.9 ( #9341 )
2026-04-24 06:25:08 +01:00
fef7dd6df5
chore: update readme ( #9330 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-04-23 19:50:25 +00:00
better-release[bot] and GitHub
b289ac6c4b
chore: release v1.6.8 ( #9316 )
2026-04-23 11:31:03 +01:00
Gustavo Valverde and GitHub
9aa8e63de8
fix(oauth): support mapProfileToUser fallback for providers that may omit email ( #9331 )
2026-04-23 10:15:36 +00:00
Taesu and GitHub
4e8e4c7fc5
feat(client): add hydrateSession for SSR session hydration ( #8733 )
2026-04-22 21:09:45 +00:00
856ab2426c
fix(organization): allow passing id through beforeCreateTeam and beforeCreateInvitation ( #9253 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com >
2026-04-22 16:56:50 +00:00
better-release[bot] and GitHub
d3bde2d21f
chore: release v1.7.0-beta.2 ( #9207 )
2026-04-22 17:23:06 +01:00
Gustavo Valverde
888b1fc90e
test(generic-oauth): align GET-callback-without-state test with rewritten plugin contract
...
Caught during the main-to-next sync in #9312 . The test was imported from main
in #9293 , which targeted the legacy /oauth2/callback/:providerId endpoint that
the generic-oauth rewrite (#9069 ) removed on next; callbacks now flow through
the core /callback/:id route. That route preserves the security contract (GET
without state redirects to the error page, never crashes) via an early state
guard that emits `state_not_found` instead of `please_restart_the_process`.
2026-04-22 16:19:42 +01:00
Gustavo Valverde
eb3cd10d50
chore: resolve main-to-next sync conflicts
...
- keep next package versions at 1.7.0-beta.1
- keep both changelog streams by inserting the stable 1.6.5, 1.6.6, and 1.6.7 sections below the 1.7.0-beta entries
- keep the cimd and dash deps on demo/nextjs (next-only); regenerate pnpm-lock.yaml
- resolve TODO(sync-from-main-9226) in oauth-provider authorize.ts: findRegisteredRedirectUri now uses isLoopbackIP from @better-auth/core/utils/host to cover the full 127.0.0.0/8 range per RFC 8252 §7.3
- drop the unused saml import that main's #9262 added to sso/src/routes/sso.ts; next already migrated to saml-pipeline
2026-04-22 14:54:27 +01:00
better-release[bot] and GitHub
f8076d141a
chore: release v1.6.7 ( #9289 )
2026-04-22 12:36:30 +01:00
Gustavo Valverde and GitHub
4f373eed8a
feat(social-providers): accept array of Client IDs for ID token audience ( #9292 )
2026-04-22 09:02:56 +00:00
e1b1cfc7a2
fix(oauth2): guard against undefined body when parsing state ( #9293 )
...
Co-authored-by: Menachem Hornbacher <mhornbacher@kiddom.co >
2026-04-22 08:23:13 +00:00
d053a4583e
fix(phone-number): call callbackOnVerification when updatePhoneNumber is enabled ( #4894 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-04-22 08:11:42 +00:00
307196a405
fix(api): preserve response headers when APIError is thrown ( #9211 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com >
2026-04-22 06:47:16 +00:00
better-release[bot] and GitHub
0290077760
chore: release v1.6.6 ( #9222 )
2026-04-21 17:42:18 +01:00
9ea7eb1eab
fix(cookies): preserve partitioned attribute on set-cookie round-trip ( #9235 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-21 16:11:29 +00:00
Maxwell and GitHub
4debfb600f
fix(custom-session): use coerced boolean for disableRefresh query param validation ( #9214 )
2026-04-21 10:22:32 +00:00
Maxwell and GitHub
ab4c10fbc0
fix(organization): infer team additional fields correctly ( #9266 )
2026-04-21 08:16:39 +00:00
954b664f4f
feat(org): allow passing userId and organizationId to listUserTeams API ( #8977 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-21 08:15:16 +00:00
Taesu
TaesuandGitHub
Pooya ParsaandGitHub
skalkiiandGitHub
Gustavo ValverdeandGitHub
