better-release[bot]
85bb710edc
chore: version packages ( #9018 )
...
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-04-08 19:22:59 +00:00
Taesu
7495830659
fix(api): restore getSession accessibility in generic Auth<O> context ( #9017 )
2026-04-08 17:34:12 +00:00
dependabot[bot]
8ad1995077
chore(deps): bump drizzle-orm from 0.45.1 to 0.45.2 ( #9033 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-08 07:40:52 +00:00
Jonathan Samines
2e537df5f7
fix: endpoint instrumentation to always use route template ( #9023 )
2026-04-08 08:41:31 +10:00
Maxwell
f61ad1cab7
fix: use INVALID_PASSWORD for all checkPassword failures ( #8902 )
2026-04-07 18:17:10 +00:00
Gustavo Valverde
d9b16d2551
chore: sync main to next
...
chore: sync main to next
2026-04-06 16:47:42 +01:00
Taesu
141781d6fc
fix: generate session id when using secondary storage without database ( #8927 )
2026-04-06 14:43:47 +00:00
better-release[bot]
d666a03372
chore: exit pre-release mode for v1.6.0
2026-04-06 14:41:56 +00:00
Gustavo Valverde
29d197e688
chore: sync main to next ( #8976 )
...
chore: sync main to next
2026-04-06 15:31:29 +01:00
Gustavo Valverde
e5091ee1e6
fix(oauth-provider): scope loss on PAR, loopback redirect matching, DCR skip_consent ( #8632 )
2026-04-06 14:14:39 +00:00
Gustavo Valverde
bd9bd58f87
fix(security): enforce authorization on SCIM management endpoints and normalize passkey ownership ( #8843 )
2026-04-06 13:47:24 +00:00
Gustavo Valverde
ee8b40d502
fix(deps): patch Dependabot security issues ( #8838 )
...
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-04-06 13:16:45 +00:00
Taesu
560230f751
fix(types): prevent any from collapsing base type and client inference ( #8981 )
2026-04-06 12:18:58 +00:00
Gustavo Valverde
dd537cbdeb
chore(oidc-provider): deprecate plugin in favor of @better-auth/oauth-provider ( #8985 )
2026-04-06 12:13:35 +00:00
Taesu
469eee6d84
fix(oauth): prevent double-hashing of state when storeIdentifier is hashed ( #8980 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-04-06 11:14:55 +00:00
Taesu
475d512376
chore: revert better-call v2 migration, downgrade to v1.3.5 ( #8973 )
2026-04-05 23:18:54 +00:00
better-auth-releases[bot]
73beda26f9
chore: version packages (beta) ( #8945 )
...
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-04-04 15:52:24 +00:00
Gustavo Valverde
1eec2e8090
chore: use caret ranges for internal peerDependencies ( #8937 )
2026-04-03 19:05:37 +00:00
Yanick J.S.
5970053e6a
docs: improve descriptions for appName, trustedOrigins, useSecureCookies ( #8935 )
...
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
2026-04-03 18:31:00 +00:00
Gustavo Valverde
77ead28455
chore: reset package versions to 1.5.6 ( #8930 )
2026-04-03 10:57:28 +00:00
Gustavo Valverde
e089ce127d
chore(knip): fix CI blind spots and remove dead code ( #8888 )
2026-04-02 19:28:30 +00:00
Taesu
4742f349dc
fix(oauth-proxy): read callback params from body for form_post ( #8895 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-02 10:24:31 +00:00
Gautam Manchandani
c83a6c22ea
fix(oauth-provider): enforce DB-backed sessions with secondary storage ( #8894 )
...
Signed-off-by: Gautam Manchandani <manchandanigautam@gmail.com >
2026-04-02 10:20:48 +00:00
dependabot[bot]
6a3044e50e
chore(deps-dev): bump happy-dom from 20.7.0 to 20.8.9 ( #8830 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-04-02 08:13:55 +00:00
Gustavo Valverde
e80cc38b0d
fix: turbo caching, enforce lockfile integrity, expand pre-commit hooks ( #8892 )
2026-04-02 07:35:24 +00:00
Gustavo Valverde
04e91d1643
perf(build): reduce published package sizes ( #8884 )
2026-04-01 15:55:03 +00:00
Kyle Gray
31d5e88b88
fix(instrumentation): don't mark redirect APIErrors as span errors ( #8850 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-01 22:49:49 +10:00
Taesu
d638b7b571
perf(core): use non-blocking scrypt from @better-auth/utils ( #8685 )
2026-04-01 02:31:01 +00:00
Jonathan Samines
cd01a42e60
feat: expose plugin version ( #8750 )
2026-03-31 16:08:21 +00:00
Gautam Manchandani
cbd554d2aa
fix: rethrow phone sendOTP failures ( #8842 )
...
Signed-off-by: Gautam Manchandani <manchandanigautam@gmail.com >
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-03-31 15:00:54 +00:00
Ruban S
75133eb478
chore: remove duplicate export for linkedin ( #8859 )
2026-03-31 12:54:46 +00:00
Taesu
ce8141a21c
fix(api): align fresh age with session creation time ( #8762 )
2026-03-31 10:00:13 +00:00
Gustavo Valverde
3860c09d9f
fix(two-factor): allow passwordless 2FA management ( #7243 )
2026-03-30 07:43:18 +00:00
Gustavo Valverde
7c2ce8a371
feat(passkey): add pre-auth registration and extensions ( #7154 )
2026-03-30 06:43:10 +00:00
Taesu
23bad5139f
feat(sso): enable InResponseTo validation by default for SAML flows ( #8736 )
2026-03-30 06:20:27 +00:00
Martin Rädlinger
e16b184b0b
fix(sso): provisionUser inconsistency and option to run on every login ( #8818 )
2026-03-30 06:18:11 +00:00
Taesu
db26161113
fix: compare account cookie by provider accountId instead of internal id ( #8786 )
2026-03-30 05:25:05 +00:00
Maxwell
6f30fd65a4
fix(email-otp): trigger sessionSignal on req-email-change ( #8816 )
2026-03-30 05:17:26 +00:00
David Frankel
e9f49bd7c8
chore: fix type inference for future TS compatibility ( #8820 )
2026-03-30 05:00:05 +00:00
Taesu
03d2df6603
fix(stripe): return correct priceId for annual subscriptions in list ( #8810 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-03-29 06:10:40 +10:00
Gustavo Valverde
8afe2a7cea
fix(oauth-provider): return JSON redirects from post-login OAuth continuation ( #8815 )
2026-03-28 19:05:29 +00:00
Gustavo Valverde
5dc004a177
fix(oauth-provider): let customIdTokenClaims override acr and auth_time ( #8633 )
2026-03-28 09:36:47 +00:00
Alex Yang
221103bce7
fix(oauth-provider): handle dynamic baseURL config in init ( #8649 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-03-27 20:33:35 +00:00
Taesu
5b7a5811e1
fix(kysely-adapter): remove deprecated numUpdatedOrDeletedRows from D1 dialect ( #8798 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-03-27 16:35:00 +00:00
Taesu
183be977f0
Revert "fix(oauth-provider): only require storeSessionInDatabase when secondaryStorage is configured"
...
This reverts commit cd835f6a58 .
2026-03-27 05:49:35 +09:00
Gustavo Valverde
cd835f6a58
fix(oauth-provider): only require storeSessionInDatabase when secondaryStorage is configured
...
The init guard checked for `session` options broadly, which caused a
false error when users set any session config (e.g., `expiresIn`) without
secondaryStorage. Without secondaryStorage, sessions always persist to
the database, making the constraint irrelevant.
2026-03-26 16:13:55 +00:00
Alex Yang
4be065c505
fix(magic-link): return additional fields in /magic-link/verify ( #7223 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-03-26 18:33:06 +10:00
Taesu
14347d2627
chore: centralize to use catalog and bump @better-auth/utils, better-call ( #8684 )
2026-03-26 04:09:49 +00:00
Gustavo Valverde
2d56c6af68
fix(oauth-provider): normalize auth_time timestamps ( #8761 )
2026-03-24 15:22:35 -07:00
Maxwell
ed269e93a6
fix(test-utils): remove using keyword ( #8756 )
2026-03-24 14:36:55 +00:00