better-release[bot] and GitHub
c8cf0f7c1a
chore: release v1.7.0-beta.0 ( #9073 )
2026-04-10 21:29:25 +01:00
Gustavo Valverde
ca5d303607
fix(sso): guard toLowerCase against falsy email and use safe redirect
...
- Add empty string fallback before .toLowerCase() to prevent TypeError
when both mapped email attribute and extract.nameID are falsy
- Use validated samlRedirectUrl instead of raw callbackUrl in error
redirect to maintain open-redirect and loop-protection guarantees
2026-04-10 21:06:47 +01:00
Gustavo Valverde
97fca6a1cf
refactor(sso): adopt saml-pipeline and port security fixes
...
Use main's saml-pipeline.ts for SAML response processing, replacing
~1000 lines of duplicated inline code in sso.ts. Port the four
security fixes from #9055 into the pipeline:
- Fix InResponseTo field path (extract.response?.inResponseTo)
- Add Audience Restriction validation
- Fix SessionIndex stored as string, not object
- Fix allowIdpInitiated default to false
Delegate to validateInResponseTo/validateAudience from
response-validation.ts instead of reimplementing inline.
Graft private_key_jwt (RFC 7523) support from #8836 onto main's
pipeline-based sso.ts.
2026-04-10 20:25:41 +01:00
Gustavo Valverde
28ccc8cda9
chore: resolve main-to-next sync conflicts
...
Conflicts resolved:
- docs/content/docs/plugins/2fa.mdx: kept next's OTP feature, applied main's exported const pattern
- docs/content/docs/plugins/oauth-provider.mdx: kept main's formatting, added back private_key_jwt docs
- docs/content/docs/plugins/sso.mdx: kept next's version with private_key_jwt and SAML options
- packages/sso/src/routes/sso.ts: kept next's version (has security fixes and private_key_jwt)
2026-04-10 19:11:05 +01:00
Taesu and GitHub
4673c6d83c
fix(cli): handle extends and mid-path wildcards in tsconfig paths ( #9032 )
2026-04-10 16:26:53 +00:00
Gustavo Valverde and GitHub
52c47517a2
fix(sso): unify SAML response processing and fix bugs ( #9097 )
2026-04-10 15:00:26 +00:00
Gustavo Valverde and GitHub
544f1c63c9
feat(two-factor)!: add OTP enablement and discriminated response ( #9057 )
2026-04-10 14:23:20 +00:00
c5066fe5d6
fix(stripe): omit quantity for metered prices in checkout and upgrades ( #8926 )
...
Co-authored-by: better-release[bot] <273320539+better-release[bot]@users.noreply.github.com>
2026-04-10 12:55:44 +00:00
684154d3d1
chore: replace z.union with z.xor for permission schemas in admin plugin ( #8982 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
Co-authored-by: Taesu <bytaesu@gmail.com >
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-04-10 12:47:23 +00:00
Gustavo Valverde and GitHub
93d3871bd2
feat(oauth): add private_key_jwt client authentication (RFC 7523) ( #8836 )
2026-04-10 08:22:05 +00:00
5f84335815
feat(stripe): support Stripe SDK v21 and v22 ( #9084 )
...
Co-authored-by: leonardo2204 <1509421+leonardo2204@users.noreply.github.com >
Co-authored-by: better-release[bot] <273320539+better-release[bot]@users.noreply.github.com>
2026-04-10 06:19:34 +00:00
f6428d02fc
fix(open-api): correct get-session nullable schema for OAS 3.1 ( #8389 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
Co-authored-by: ping-maxwell <maxwell.multinite@gmail.com >
2026-04-09 20:44:35 +00:00
6ce30cf138
fix: incorrect operationId in password reset callback endpoint ( #9072 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-09 20:13:06 +00:00
Gustavo Valverde and GitHub
b790144a2e
fix(sso)!: harden SAML response validation (InResponseTo, Audience, SessionIndex) ( #9055 )
2026-04-09 17:30:01 +00:00
better-release[bot] and GitHub
700d298e1e
chore: version packages ( #9052 )
2026-04-09 15:19:07 +01:00
Gustavo Valverde and GitHub
4c829bf289
fix(oauth-provider): preserve multi-valued query params through prompt redirects ( #9060 )
2026-04-09 13:13:39 +00:00
b20fa424c3
fix(next-js): replace cookie probe with header-based RSC detection in nextCookies ( #9059 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-09 12:41:10 +00:00
Gustavo Valverde and GitHub
608d8c3082
fix(sso): include RelayState in signed SAML AuthnRequests ( #9058 )
2026-04-09 12:05:02 +00:00
Dylan Vanmali and GitHub
c6922dce8e
refactor(oauth-provider): reject skip_consent at schema level in DCR ( #8998 )
2026-04-09 11:56:29 +00:00
5e5d3f62fc
fix(sso): normalize SAMLResponse whitespace at request boundary ( #8968 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-04-09 11:04:10 +00:00
2cbcb9baac
fix(oauth2): prevent cross-provider account collision in link-social callback ( #8983 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-04-09 10:17:42 +00:00
9deb7936ab
fix: cookie store strategy should verify oauth state ( #8949 )
...
Co-authored-by: Bereket Engida <86073083+Bekacru@users.noreply.github.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-04-09 09:26:36 +00:00
84098432ad
feat(two-factor): include enabled 2fa methods in sign-in redirect response ( #8772 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-04-09 09:25:49 +00:00
e78a7b120d
fix(two-factor): prevent unverified TOTP enrollment from gating sign-in ( #8711 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-04-09 08:48:10 +00:00
85bb710edc
chore: version packages ( #9018 )
...
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-04-08 19:22:59 +00:00
Taesu and GitHub
7495830659
fix(api): restore getSession accessibility in generic Auth<O> context ( #9017 )
2026-04-08 17:34:12 +00:00
8ad1995077
chore(deps): bump drizzle-orm from 0.45.1 to 0.45.2 ( #9033 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-08 07:40:52 +00:00
Jonathan Samines and GitHub
2e537df5f7
fix: endpoint instrumentation to always use route template ( #9023 )
2026-04-08 08:41:31 +10:00
Maxwell and GitHub
f61ad1cab7
fix: use INVALID_PASSWORD for all checkPassword failures ( #8902 )
2026-04-07 18:17:10 +00:00
Gustavo Valverde and GitHub
d9b16d2551
chore: sync main to next
...
chore: sync main to next
2026-04-06 16:47:42 +01:00
Taesu and GitHub
141781d6fc
fix: generate session id when using secondary storage without database ( #8927 )
2026-04-06 14:43:47 +00:00
better-release[bot]
d666a03372
chore: exit pre-release mode for v1.6.0
2026-04-06 14:41:56 +00:00
Gustavo Valverde and GitHub
29d197e688
chore: sync main to next ( #8976 )
...
chore: sync main to next
2026-04-06 15:31:29 +01:00
Gustavo Valverde and GitHub
e5091ee1e6
fix(oauth-provider): scope loss on PAR, loopback redirect matching, DCR skip_consent ( #8632 )
2026-04-06 14:14:39 +00:00
Gustavo Valverde and GitHub
bd9bd58f87
fix(security): enforce authorization on SCIM management endpoints and normalize passkey ownership ( #8843 )
2026-04-06 13:47:24 +00:00
ee8b40d502
fix(deps): patch Dependabot security issues ( #8838 )
...
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-04-06 13:16:45 +00:00
Taesu and GitHub
560230f751
fix(types): prevent any from collapsing base type and client inference ( #8981 )
2026-04-06 12:18:58 +00:00
Gustavo Valverde and GitHub
dd537cbdeb
chore(oidc-provider): deprecate plugin in favor of @better-auth/oauth-provider ( #8985 )
2026-04-06 12:13:35 +00:00
469eee6d84
fix(oauth): prevent double-hashing of state when storeIdentifier is hashed ( #8980 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-04-06 11:14:55 +00:00
Taesu and GitHub
475d512376
chore: revert better-call v2 migration, downgrade to v1.3.5 ( #8973 )
2026-04-05 23:18:54 +00:00
better-auth-releases[bot] and github-actions[bot] <github-actions[bot]@users.noreply.github.com>
73beda26f9
chore: version packages (beta) ( #8945 )
...
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-04-04 15:52:24 +00:00
Gustavo Valverde and GitHub
1eec2e8090
chore: use caret ranges for internal peerDependencies ( #8937 )
2026-04-03 19:05:37 +00:00
5970053e6a
docs: improve descriptions for appName, trustedOrigins, useSecureCookies ( #8935 )
...
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
2026-04-03 18:31:00 +00:00
Gustavo Valverde and GitHub
77ead28455
chore: reset package versions to 1.5.6 ( #8930 )
2026-04-03 10:57:28 +00:00
Gustavo Valverde and GitHub
e089ce127d
chore(knip): fix CI blind spots and remove dead code ( #8888 )
2026-04-02 19:28:30 +00:00
4742f349dc
fix(oauth-proxy): read callback params from body for form_post ( #8895 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-02 10:24:31 +00:00
Gautam Manchandani and GitHub
c83a6c22ea
fix(oauth-provider): enforce DB-backed sessions with secondary storage ( #8894 )
...
Signed-off-by: Gautam Manchandani <manchandanigautam@gmail.com >
2026-04-02 10:20:48 +00:00
6a3044e50e
chore(deps-dev): bump happy-dom from 20.7.0 to 20.8.9 ( #8830 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-04-02 08:13:55 +00:00
Gustavo Valverde and GitHub
e80cc38b0d
fix: turbo caching, enforce lockfile integrity, expand pre-commit hooks ( #8892 )
2026-04-02 07:35:24 +00:00
Gustavo Valverde and GitHub
04e91d1643
perf(build): reduce published package sizes ( #8884 )
2026-04-01 15:55:03 +00:00
better-release[bot]andGitHub
Gustavo Valverde
TaesuandGitHub
Dylan VanmaliandGitHub
Jonathan SaminesandGitHub
better-auth-releases[bot]andgithub-actions[bot] <github-actions[bot]@users.noreply.github.com>
Gautam ManchandaniandGitHub