better-release[bot] and GitHub
8b1e759c07
chore: release v1.7.0-beta.5 ( #9905 )
2026-06-10 12:34:04 -07:00
Gustavo Valverde and GitHub
0e1770ac75
feat(oauth-provider)!: enforce max_age ( #9936 )
2026-06-09 19:36:30 -07:00
Gustavo Valverde and GitHub
76a33429fc
fix(session): fire session-delete hooks for preserved sessions on secondaryStorage ( #9969 )
2026-06-10 00:40:56 +00:00
Gustavo Valverde and GitHub
3e852a2650
fix(oauth-provider): report unsupported_token_type for JWT access-token revocation ( #9970 )
2026-06-10 00:39:26 +00:00
Gustavo Valverde and GitHub
ec8a38c08f
feat(generic-oauth): verify discovery id_tokens and enable id_token sign-in ( #9966 )
2026-06-10 00:34:26 +00:00
Gustavo Valverde and GitHub
af572166a2
fix(auth)!: harden validateUserInfo source contract ( #9940 )
2026-06-07 22:52:59 -07:00
0cbaf81bed
feat(oauth): server-trusted state channel; fix anonymous cookieless linking ( #9930 )
...
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-06-08 01:00:05 +00:00
91f235f860
feat(auth): add per-provider requireEmailVerification for social sign-in ( #9929 )
...
Co-authored-by: Gautam Manchandani <161146829+GautamBytes@users.noreply.github.com >
2026-06-08 00:31:20 +00:00
e0140297a5
fix(electron)!: enforce S256 PKCE and harden origin checks ( #9645 )
...
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-07 23:43:06 +00:00
41cca606d1
feat(auth): add user.validateUserInfo provisioning gate ( #9864 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-07 14:34:48 -07:00
Gustavo Valverde and GitHub
b32094a46d
docs(oauth-provider): reframe back-channel logout changeset and fill doc gaps ( #9916 )
2026-06-06 07:39:23 -07:00
Gustavo Valverde and GitHub
e0d2b9eb9b
feat(oauth-provider)!: add OIDC back-channel logout ( #9304 )
2026-06-06 07:06:53 -07:00
7fe0e2b165
feat: add clientAssertion support to the Microsoft Entra ID social provider ( #9898 )
...
Co-authored-by: Bereket Engida <86073083+Bekacru@users.noreply.github.com >
Co-authored-by: Bereket Engida <Bekacru@gmail.com >
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-06-05 20:28:46 -07:00
Gustavo Valverde and GitHub
4f53b61f49
refactor(oauth)!: verify provider id_tokens with a single shared verifier ( #9828 )
2026-06-05 08:00:03 -04:00
Gustavo Valverde and GitHub
40b392ae21
feat(oauth)!: accumulate granted scopes as grantedScopes string[] ( #9825 )
2026-06-04 17:54:52 -04:00
better-release[bot] and GitHub
a5e2442e3c
chore: release v1.7.0-beta.4 ( #9534 )
2026-05-31 14:29:39 +01:00
Gustavo Valverde and GitHub
b4b086722c
fix(oauth-provider)!: bind RFC 8707 resource indicators to the authorization grant ( #9836 )
2026-05-31 14:14:50 +01:00
Gustavo Valverde and GitHub
a8ea86e25e
fix(scim)!: always bind personal SCIM connections to their creator ( #9840 )
2026-05-31 12:53:18 +00:00
Gustavo Valverde
1f4ca6e1e4
chore: sync main to next
...
Pull in #9845 (runtime-safe redirect-uri validation and fragment rejection) now that it merged to main, so next gets the corrected validation directly instead of waiting for a later sync.
2026-05-31 13:39:57 +01:00
Gustavo Valverde and GitHub
13abc7922b
fix(core): make redirect-uri validation runtime-safe and reject fragments ( #9845 )
2026-05-31 13:37:39 +01:00
Gustavo Valverde
065f5ad72d
chore: sync main to next
...
Brings the v1.6.13 stable fixes into next: redirect_uri scheme validation in oidc-provider and mcp (#9838 ), clientPrivileges enforcement on dynamic client registration (#9837 ), null organization logo support (#9842 ), the consumeOne non-numeric deleteMany guard (#9831 ), and the db-adapter guide alignment (#9830 ).
Conflicts were limited to release version bumps and CHANGELOG entries; resolved by keeping next's 1.7.0-beta.3 line. The ten changesets consumed by the v1.6.13 release are accepted as deleted, and no external dependencies changed.
2026-05-31 13:02:15 +01:00
better-release[bot] and GitHub
a6f38c72ee
chore: release v1.6.13 ( #9804 )
2026-05-31 12:41:17 +01:00
Gustavo Valverde and GitHub
17ab66c3a4
fix(oauth-provider): enforce clientPrivileges on dynamic client registration ( #9837 )
2026-05-31 11:02:27 +00:00
87c1a0cab2
fix(organization): allow null logo on create and update ( #9842 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-05-31 10:58:24 +00:00
Gustavo Valverde and GitHub
be32012ca3
fix(oauth): validate redirect_uri schemes in oidc-provider and mcp ( #9838 )
2026-05-31 11:38:52 +01:00
Taesu and GitHub
5c3e248cbf
fix(core): throw on non-numeric deleteMany in consumeOne fallback ( #9831 )
2026-05-31 09:00:18 +00:00
Gustavo Valverde
ef4fb0ff95
chore: merge main into next ( #9533 )
...
Sync main (through #9821/#9820/#9822/#9768) into next. Conflicting
package.json files keep next's version and intentional divergences (for
example the cli's c12 v4) while taking main's dependency updates, including
the samlify 2.13.1 and fast-xml-parser security bumps; the lockfile is
regenerated from the reconciled set. The 13 source/doc/test conflicts take
next's refactored architecture as the baseline; main's colliding fixes are
re-applied on top in the following per-domain commits.
Clean main fixes land via this merge, including the auto-restored
account-takeover defenses #9578 and #9577 .
2026-05-31 00:10:16 +01:00
Gustavo Valverde and GitHub
4c3bbc4e56
fix(sso): update samlify to 2.13.1 for signed-assertion XML injection ( #9821 )
2026-05-30 23:58:05 +01:00
Gustavo Valverde and GitHub
9c8ded67b1
docs(two-factor): mark viewBackupCodes as server-only in its API comment ( #9822 )
2026-05-30 23:52:38 +01:00
43c08a2bc7
fix(account): scope OAuth account identity and fix buggy internalAdapter helpers ( #9818 )
...
Co-authored-by: Krish Garg <kgarg@chapman.edu >
2026-05-30 20:48:10 +00:00
23d7cbfa79
fix(oauth): apply updateUserInfoOnLink in OAuth callback link flow ( #8758 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-30 19:48:38 +01:00
Gustavo Valverde and GitHub
e24ddfd13b
fix(expo): persist large account cookies by chunking device storage ( #9815 )
2026-05-30 18:24:14 +01:00
d3919dc1a5
feat(account): support server-side accountInfo calls without session headers ( #9813 )
...
Co-authored-by: Nathan Colosimo <nathancolosimo@gmail.com >
2026-05-30 12:45:40 +01:00
5f282bd382
fix(account): default storeStateStrategy to "database" when using secondaryStorage ( #9591 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-30 11:05:28 +01:00
Taesu and GitHub
e131d3ac5b
fix(api-key): verify non-default keys when configId is omitted ( #9794 )
2026-05-30 03:14:57 +00:00
better-release[bot] and GitHub
c0c574ea50
chore: release v1.6.12 ( #9590 )
2026-05-29 22:28:58 +01:00
Gustavo Valverde and GitHub
c5b9f93498
fix(generic-oauth): add accessTokenExpiresIn for providers that omit expires_in ( #9799 )
2026-05-29 20:49:59 +00:00
17cd433c66
fix(oauth-proxy): missing state-cookie skip for oauth-proxy ( #9385 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-29 15:06:34 +00:00
Gustavo Valverde and GitHub
c92cd74162
fix: URL-encode callbackURL in verify-email links ( #9792 )
2026-05-29 08:08:42 +00:00
Taesu and GitHub
2b7937fc2f
chore: bump @better-auth/utils ( #9791 )
2026-05-28 23:25:57 +00:00
Gustavo Valverde and GitHub
0a7cb70647
fix(oauth): honor per-flow errorCallbackURL when state validation fails ( #9789 )
2026-05-28 23:24:40 +00:00
ac96316af3
fix(oauth): forward specific callback error codes via shared redirectOnError ( #9788 )
...
Co-authored-by: Gautam Manchandani <manchandanigautam@gmail.com >
2026-05-28 21:42:16 +00:00
a3b0c63de9
fix: accept hashed nonces for native iOS sign-in with Apple ( #8870 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-28 12:35:09 +00:00
33a3632731
fix: hotfix passkey handle undefined transports ( #9746 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
Co-authored-by: ping-maxwell <maxwell.multinite@gmail.com >
2026-05-28 01:11:45 +00:00
d64174ec86
fix(oauth-provider): hide DCR endpoint unless enabled ( #9448 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-27 13:18:16 +00:00
8401d11f43
fix(oauth-provider): serve path-prefixed issuer metadata aliases ( #9668 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-27 12:38:27 +00:00
7bf5449b11
fix(oauth2): map jose token verification errors ( #9655 )
...
Co-authored-by: cyphercodes <cyphercodes@users.noreply.github.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-27 09:45:02 +00:00
Maxwell and GitHub
f6bf45123f
fix(api-key): add better-call as peer dependency to fix TS4023 declaration emit ( #9759 )
2026-05-27 00:05:31 +00:00
Maxwell and GitHub
85ca603eec
fix: drizzle mixed and/or ( #9756 )
2026-05-26 14:08:11 +00:00
8907c7df9c
fix(passkey): consume challenge atomically and propagate inner verify errors ( #9622 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-05-24 23:40:52 +00:00
better-release[bot]andGitHub
Gustavo ValverdeandGitHub
