Sync main (through #9821/#9820/#9822/#9768) into next. Conflicting
package.json files keep next's version and intentional divergences (for
example the cli's c12 v4) while taking main's dependency updates, including
the samlify 2.13.1 and fast-xml-parser security bumps; the lockfile is
regenerated from the reconciled set. The 13 source/doc/test conflicts take
next's refactored architecture as the baseline; main's colliding fixes are
re-applied on top in the following per-domain commits.
Clean main fixes land via this merge, including the auto-restored
account-takeover defenses #9578 and #9577.
The `authorization_code`-grant rotation in `createRefreshToken` and the explicit `revokeRefreshToken` path both updated the parent `oauthRefreshToken` row using an `id`-only predicate, so two concurrent rotations (or a rotation racing a revoke) both pass the `revoked` check and last-write-wins. Each surviving request mints a fresh refresh token, producing a forked family from one parent.
Both call sites now perform a compare-and-swap (`UPDATE ... WHERE id = ? AND revoked IS NULL`) and short-circuit with `invalid_grant` when the row was already consumed. The parent stays marked revoked, so any subsequent replay trips the existing family-invalidation guard in `handleRefreshTokenGrant`. The shared family-delete is centralized in `invalidateRefreshFamily`, which clears child access tokens before refresh rows to honor the schema's foreign-key direction; the `oauthRefreshToken.token` column also gains a `unique` constraint for parity with `oauthAccessToken.token`. Strict family invalidation on contested rotations (RFC 9700 §4.14) is tracked in a FIXME for a follow-up minor that opts into transactional rotation in the adapter contract.
Closes GHSA-392p-2q2v-4372.
Co-authored-by: chdanielmueller <4051999+chdanielmueller@users.noreply.github.com>
- keep next package versions at 1.7.0-beta.1
- keep both changelog streams by inserting the stable 1.6.5, 1.6.6, and 1.6.7 sections below the 1.7.0-beta entries
- keep the cimd and dash deps on demo/nextjs (next-only); regenerate pnpm-lock.yaml
- resolve TODO(sync-from-main-9226) in oauth-provider authorize.ts: findRegisteredRedirectUri now uses isLoopbackIP from @better-auth/core/utils/host to cover the full 127.0.0.0/8 range per RFC 8252 §7.3
- drop the unused saml import that main's #9262 added to sso/src/routes/sso.ts; next already migrated to saml-pipeline
Resolve the main to next sync discrepancies after the v1.6.4 release.
Conflict resolution:
- keep next package versions at 1.7.0-beta.1
- keep both changelog streams by inserting the stable 1.6.4 sections below the 1.7.0-beta entries
- restore the next pre-release accumulator changesets that the stable release deleted on main
Brings main's `chore: release v1.6.3 (#9081)` commit into next after the
stable release. Conflict resolution:
- `packages/*/package.json`: keep next's `1.7.0-beta.0` (per the release
bot's standard rule: next is always ahead of main in version).
- `packages/*/CHANGELOG.md`: keep both version entries side-by-side. Next's
`1.7.0-beta.0` section stays on top; main's new `1.6.3` section slots in
below. Each entry describes its own branch's release.
- `.changeset/*.md`: restore the 14 changesets git auto-deleted. Next is in
pre-release mode (`.changeset/pre.json` `mode: "pre"`), so changesets
accumulate across beta cuts and are only consumed on `exit-pre`. Main's
release deleted them from main; next must keep them for its own pre-release
accumulator.
better-release[bot]andGitHub
Gustavo Valverde
Taesu
better-auth-releases[bot]andgithub-actions[bot] <github-actions[bot]@users.noreply.github.com>
TaesuandGitHub
Jonathan SaminesandGitHub
Bereket Engida
Alex Yang
