- keep next package versions at 1.7.0-beta.1
- keep both changelog streams by inserting the stable 1.6.5, 1.6.6, and 1.6.7 sections below the 1.7.0-beta entries
- keep the cimd and dash deps on demo/nextjs (next-only); regenerate pnpm-lock.yaml
- resolve TODO(sync-from-main-9226) in oauth-provider authorize.ts: findRegisteredRedirectUri now uses isLoopbackIP from @better-auth/core/utils/host to cover the full 127.0.0.0/8 range per RFC 8252 §7.3
- drop the unused saml import that main's #9262 added to sso/src/routes/sso.ts; next already migrated to saml-pipeline
Resolve the main to next sync discrepancies after the v1.6.4 release.
Conflict resolution:
- keep next package versions at 1.7.0-beta.1
- keep both changelog streams by inserting the stable 1.6.4 sections below the 1.7.0-beta entries
- restore the next pre-release accumulator changesets that the stable release deleted on main
- packages/oauth-provider/src/types/zod.ts: make `state` optional in
`verificationValueSchema`. Main's PR #9118 hardened authorization code
validation with a required `state`, but CIMD (next, PR #9159) doesn't send
state in test flows. Per OAuth 2.0 §4.1.1 state is RECOMMENDED, not
REQUIRED. Fixes CIMD token exchange (`401 !== 200`) in ci test and smoke.
- docs/content/docs/plugins/sso.mdx: replace remaining `/sso/saml2/callback/`
references with `/sso/saml2/sp/acs/` to match the endpoint rename from
next's PR #9117. The merge took main verbatim here, regressing docs that
next had already updated.
Resolves conflicts in PR #9115 which the release bot cannot auto-merge.
Conflict resolutions:
- .github/workflows/release.yml: take main's hardened grep fallback (92256a2d0)
- docs/content/docs/plugins/sso.mdx: take main's named-exports refactor verbatim (#9144)
- packages/oauth-provider/src/token.ts: keep next's at_hash sequencing (#9079),
add main's customTokenResponseFields spread and credential helper rename (#9118)
- packages/oauth-provider/src/token.test.ts: keep both new describe blocks
(at_hash in id tokens from next, customTokenResponseFields from main)
Semantic fixes on auto-merged files where git silently dropped main's changes
around next's discriminated-response refactor:
- two-factor/index.ts: restore skipVerificationOnEnable handling in the totp
enablement path
- two-factor/types.ts: restore the skipVerificationOnEnable type field
- two-factor/two-factor.test.ts: narrow the discriminated enable response via
method === "totp" guard
Taesu
Muzzaiyyan HussainandGitHub
Jonathan SaminesandGitHub
TaesuandGitHub
Gautam ManchandaniandGitHub
Gustavo ValverdeandGitHub
Dylan VanmaliandGitHub