- keep next package versions at 1.7.0-beta.1
- keep both changelog streams by inserting the stable 1.6.5, 1.6.6, and 1.6.7 sections below the 1.7.0-beta entries
- keep the cimd and dash deps on demo/nextjs (next-only); regenerate pnpm-lock.yaml
- resolve TODO(sync-from-main-9226) in oauth-provider authorize.ts: findRegisteredRedirectUri now uses isLoopbackIP from @better-auth/core/utils/host to cover the full 127.0.0.0/8 range per RFC 8252 §7.3
- drop the unused saml import that main's #9262 added to sso/src/routes/sso.ts; next already migrated to saml-pipeline
Resolve the main to next sync discrepancies after the v1.6.4 release.
Conflict resolution:
- keep next package versions at 1.7.0-beta.1
- keep both changelog streams by inserting the stable 1.6.4 sections below the 1.7.0-beta entries
- restore the next pre-release accumulator changesets that the stable release deleted on main
Brings main's `chore: release v1.6.3 (#9081)` commit into next after the
stable release. Conflict resolution:
- `packages/*/package.json`: keep next's `1.7.0-beta.0` (per the release
bot's standard rule: next is always ahead of main in version).
- `packages/*/CHANGELOG.md`: keep both version entries side-by-side. Next's
`1.7.0-beta.0` section stays on top; main's new `1.6.3` section slots in
below. Each entry describes its own branch's release.
- `.changeset/*.md`: restore the 14 changesets git auto-deleted. Next is in
pre-release mode (`.changeset/pre.json` `mode: "pre"`), so changesets
accumulate across beta cuts and are only consumed on `exit-pre`. Main's
release deleted them from main; next must keep them for its own pre-release
accumulator.
- Add empty string fallback before .toLowerCase() to prevent TypeError
when both mapped email attribute and extract.nameID are falsy
- Use validated samlRedirectUrl instead of raw callbackUrl in error
redirect to maintain open-redirect and loop-protection guarantees
Use main's saml-pipeline.ts for SAML response processing, replacing
~1000 lines of duplicated inline code in sso.ts. Port the four
security fixes from #9055 into the pipeline:
- Fix InResponseTo field path (extract.response?.inResponseTo)
- Add Audience Restriction validation
- Fix SessionIndex stored as string, not object
- Fix allowIdpInitiated default to false
Delegate to validateInResponseTo/validateAudience from
response-validation.ts instead of reimplementing inline.
Graft private_key_jwt (RFC 7523) support from #8836 onto main's
pipeline-based sso.ts.
Taesu
Craig (Michael) ThompsonandGitHub
Gustavo Valverde
Jonathan SaminesandGitHub
better-auth-releases[bot]andgithub-actions[bot] <github-actions[bot]@users.noreply.github.com>
TaesuandGitHub
Martin RädlingerandGitHub
David FrankelandGitHub
Bereket Engida
Alex YangandGitHub
Oscar CornishandGitHub