better-release[bot] and GitHub
d3bde2d21f
chore: release v1.7.0-beta.2 ( #9207 )
2026-04-22 17:23:06 +01:00
Gustavo Valverde and GitHub
402ca23ad9
chore: sync main to next
...
chore: sync main to next
2026-04-22 16:28:45 +01:00
Gustavo Valverde
888b1fc90e
test(generic-oauth): align GET-callback-without-state test with rewritten plugin contract
...
Caught during the main-to-next sync in #9312 . The test was imported from main
in #9293 , which targeted the legacy /oauth2/callback/:providerId endpoint that
the generic-oauth rewrite (#9069 ) removed on next; callbacks now flow through
the core /callback/:id route. That route preserves the security contract (GET
without state redirects to the error page, never crashes) via an early state
guard that emits `state_not_found` instead of `please_restart_the_process`.
2026-04-22 16:19:42 +01:00
Gustavo Valverde
827aeede1b
chore: sync dependabot bumps from main
...
Catches the electron (38.8.6 -> 41.2.2) and @hono/node-server (1.19.11 -> 1.19.14) dep bumps that landed on main after the previous sync commit. Auto-merged without conflicts.
2026-04-22 15:52:52 +01:00
Gustavo Valverde
eb3cd10d50
chore: resolve main-to-next sync conflicts
...
- keep next package versions at 1.7.0-beta.1
- keep both changelog streams by inserting the stable 1.6.5, 1.6.6, and 1.6.7 sections below the 1.7.0-beta entries
- keep the cimd and dash deps on demo/nextjs (next-only); regenerate pnpm-lock.yaml
- resolve TODO(sync-from-main-9226) in oauth-provider authorize.ts: findRegisteredRedirectUri now uses isLoopbackIP from @better-auth/core/utils/host to cover the full 127.0.0.0/8 range per RFC 8252 §7.3
- drop the unused saml import that main's #9262 added to sso/src/routes/sso.ts; next already migrated to saml-pipeline
2026-04-22 14:54:27 +01:00
Taesu and GitHub
b828c54698
chore(deps-dev): bump electron from 38.8.6 to 41.2.2 ( #9310 )
2026-04-22 12:19:47 +00:00
88d4a0507e
chore(deps): bump @hono/node-server from 1.19.11 to 1.19.14 ( #9306 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Taesu <bytaesu@gmail.com >
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-04-22 12:00:49 +00:00
Taesu and GitHub
7fc966942c
docs: fix arrow indicator persisting on inactive legal nav item ( #9307 )
2026-04-22 11:42:42 +00:00
better-release[bot] and GitHub
f8076d141a
chore: release v1.6.7 ( #9289 )
2026-04-22 12:36:30 +01:00
Gustavo Valverde and GitHub
19a3dfa63a
chore(deps): add pnpm overrides for vulnerable transitive dependencies ( #9167 )
2026-04-22 11:06:37 +00:00
Taesu and GitHub
3d39e63cd2
test: remove dead stripe option from fixture ( #9303 )
2026-04-22 10:30:50 +00:00
Taesu and GitHub
d1b27d7af6
chore(demo): update deps, imports, tsconfig to fix build ( #9302 )
2026-04-22 10:24:48 +00:00
ec20325173
fix(passkey): verify passkey authentication isnt returning the user ( #5209 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-04-22 10:10:48 +00:00
4e0e6e1fd3
fix(oauth-provider): userinfo Authorization from ctx.headers for auth.api ( #9244 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-04-22 09:20:54 +00:00
Taesu and GitHub
f4750f634f
chore(docs): relax typesense sync build ( #9300 )
2026-04-22 09:19:21 +00:00
Gustavo Valverde and GitHub
4f373eed8a
feat(social-providers): accept array of Client IDs for ID token audience ( #9292 )
2026-04-22 09:02:56 +00:00
Ray and GitHub
4a180f0b0c
fix(core): serve noop ./instrumentation on browser and edge conditions ( #9281 )
2026-04-22 08:44:00 +00:00
e1b1cfc7a2
fix(oauth2): guard against undefined body when parsing state ( #9293 )
...
Co-authored-by: Menachem Hornbacher <mhornbacher@kiddom.co >
2026-04-22 08:23:13 +00:00
d053a4583e
fix(phone-number): call callbackOnVerification when updatePhoneNumber is enabled ( #4894 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-04-22 08:11:42 +00:00
Gustavo Valverde and GitHub
5c6de4ed26
fix(oauth-provider)!: return RFC-compliant error envelopes from validation failures ( #9277 )
2026-04-22 06:48:34 +00:00
307196a405
fix(api): preserve response headers when APIError is thrown ( #9211 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com >
2026-04-22 06:47:16 +00:00
9ab0346dae
docs: add subsection for advanced database configuration options ( #9149 )
...
Co-authored-by: Morgan PEYRE <morgan.peyre@brickcode.tech >
2026-04-22 05:29:41 +00:00
better-release[bot] and GitHub
0290077760
chore: release v1.6.6 ( #9222 )
2026-04-21 17:42:18 +01:00
9ea7eb1eab
fix(cookies): preserve partitioned attribute on set-cookie round-trip ( #9235 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-21 16:11:29 +00:00
Jonathan Samines and GitHub
fe5f36c7e3
chore(sso): fix samlify ESM/CJS loading compat issue ( #9262 )
2026-04-21 16:06:04 +00:00
Taesu and GitHub
b5742f9d08
feat(core): add mapConcurrent bounded-concurrency utility ( #9227 )
2026-04-21 15:31:08 +00:00
26d0cec9bd
docs: improve Nuxt integration guide ( #9232 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-21 15:30:22 +00:00
Maxwell and GitHub
4debfb600f
fix(custom-session): use coerced boolean for disableRefresh query param validation ( #9214 )
2026-04-21 10:22:32 +00:00
Maxwell and GitHub
ab4c10fbc0
fix(organization): infer team additional fields correctly ( #9266 )
2026-04-21 08:16:39 +00:00
954b664f4f
feat(org): allow passing userId and organizationId to listUserTeams API ( #8977 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-21 08:15:16 +00:00
4677601429
fix(expo): read cached session data from SecureStore on app startup ( #8953 )
...
Co-authored-by: Taesu <bytaesu@gmail.com >
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-04-21 06:49:49 +00:00
Taesu and GitHub
2ee50c581f
docs: add stable/beta versioning with build-time content sync ( #9258 )
2026-04-21 03:49:33 +00:00
35e9f9f6e4
docs: landing improvements ( #9169 )
...
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-04-18 23:04:27 -07:00
Gustavo Valverde and GitHub
e64ff720fb
fix: unify host classification and close SSRF gaps across packages ( #9226 )
2026-04-17 23:25:25 +00:00
Jonathan Samines and GitHub
e37167aaf5
docs: fix fastify integration docs to avoid race conditions ( #9230 )
2026-04-17 17:51:21 +00:00
a844c7dd08
chore(core): update @opentelemetry/api dep declaration to be optional ( #9111 )
...
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-04-17 14:26:40 +00:00
Maxwell and GitHub
d69d888b78
docs: add please_restart_the_process error page ( #9224 )
2026-04-17 13:01:31 +00:00
3728518d1c
fix(api-key): run secondary-storage api-key executions in parallel ( #9187 )
...
Co-authored-by: Taesu <bytaesu@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-04-17 12:43:30 +00:00
Gustavo Valverde and GitHub
2c1b1994d5
ci(verify-changesets): always run and report pass/fail ( #9223 )
2026-04-17 09:52:37 +00:00
Taesu and GitHub
a61083e023
fix(phone-number): allow removing phone number via updateUser ( #9219 )
2026-04-17 04:19:26 +00:00
better-release[bot] and GitHub
c8a91f4167
chore: release v1.6.5 ( #9209 )
2026-04-16 11:05:30 +01:00
5b900a2b43
Merge commit from fork
...
* Add tests reproducing GHSA-xr8f-h2gw-9xh6
* Fix GHSA-xr8f-h2gw-9xh6
* Move clientPrivilege assertion to shared helper
* chore: add oauth-provider changeset for GHSA-xr8f-h2gw-9xh6
---------
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-04-16 10:52:33 +01:00
938dd80e2d
docs(test-utils): clarify production usage ( #9119 )
...
Signed-off-by: Gautam Manchandani <manchandanigautam@gmail.com >
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-16 01:20:34 +00:00
25c8f59069
docs: fix wrong AutumnProvider usage in docs ( #9176 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-16 01:18:35 +00:00
09005a974d
docs: add mention to self service directory sync ( #9194 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-16 01:15:52 +00:00
Dylan Vanmali and GitHub
0b52dfcc23
docs(cimd): recommend removal of allowUnauthenticatedClientRegistration for client deduplication ( #9191 )
2026-04-15 20:57:19 +00:00
Ray and GitHub
05386271ca
fix(client): trigger $sessionSignal for session-rotating endpoints ( #9087 )
2026-04-15 15:27:48 +00:00
Gustavo Valverde and GitHub
779993a9de
chore: sync main to next
...
chore: sync main to next
2026-04-15 15:48:00 +01:00
Gustavo Valverde
225976c7d2
chore: main to next conflict resolution
...
Resolve the main to next sync discrepancies after the v1.6.4 release.
Conflict resolution:
- keep next package versions at 1.7.0-beta.1
- keep both changelog streams by inserting the stable 1.6.4 sections below the 1.7.0-beta entries
- restore the next pre-release accumulator changesets that the stable release deleted on main
2026-04-15 15:40:35 +01:00
better-release[bot] and GitHub
9ec849ff71
chore: release v1.6.4 ( #9175 )
2026-04-15 13:00:42 +01:00
better-release[bot]andGitHub
Gustavo ValverdeandGitHub
TaesuandGitHub
RayandGitHub
Jonathan SaminesandGitHub
Dylan VanmaliandGitHub