github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-22 22:32:01 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #7072] [MERGED] v1.4.10 #15304

New Issue
Closed
opened 2026-04-13 09:57:16 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-13 09:57:16 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/7072
Author: @himself65
Created: 12/31/2025
Status: ✅ Merged
Merged: 12/31/2025
Merged by: @himself65

Base: main ← Head: v1.4.x-staging

📝 Commits (10+)

  • 4e250f4 chore: BETTER_AUTH_SECRET length check shouldn't throw error (#6954)
  • 5466f1e Revert "feat(multi-session): allow to infer additional fields (#6585)"
  • e2519cb docs: improve set active organization guide (#7010)
  • 63492c8 docs: add payments section (#7030)
  • 81d2a10 docs: improve community plugins page (#7031)
  • c4c5f96 docs: add gradient mask image for TOCScrollArea (#7032)
  • 2fc2ec1 fix(stripe): add 'subscription/restore' to pathMethods (#6959)
  • 601ea54 chore: clean up lint warning (#6960)
  • 147dec3 ci: remove auto cherry pick (#6976)
  • 2d9753c feat(saml): add XML parser hardening with configurable size limits (#6805)

📊 Changes

97 files changed (+5086 additions, -2542 deletions)

View changed files

➖ .github/workflows/auto-cherry-pick-to-main.yml (+0 -337)
➖ .github/workflows/cherry-pick-to-main.yml (+0 -325)
📝 biome.json (+2 -1)
📝 demo/nextjs/package.json (+1 -1)
📝 demo/stateless/package.json (+1 -1)
📝 docs/components/community-plugins-table.tsx (+8 -10)
📝 docs/components/docs/layout/toc.tsx (+53 -0)
📝 docs/components/sidebar-content.tsx (+21 -15)
📝 docs/content/docs/introduction.mdx (+2 -2)
📝 docs/content/docs/plugins/community-plugins.mdx (+4 -2)
📝 docs/content/docs/plugins/multi-session.mdx (+1 -59)
📝 docs/content/docs/plugins/oauth-provider.mdx (+3 -3)
📝 docs/content/docs/plugins/organization.mdx (+4 -3)
📝 docs/content/docs/plugins/sso.mdx (+34 -0)
📝 docs/content/docs/plugins/stripe.mdx (+97 -43)
📝 docs/content/docs/reference/options.mdx (+1 -1)
📝 docs/content/docs/reference/security.mdx (+21 -2)
📝 docs/package.json (+5 -5)
📝 e2e/integration/solid-vinxi/src/lib/auth.ts (+3 -0)
📝 e2e/integration/vanilla-node/e2e/app.ts (+5 -0)

...and 77 more files

📄 Description

Summary by cubic

Switch secret validation to warn instead of throw, and revert the multi-session client’s schema inference API. Add Fetch Metadata CSRF checks and form-encoded support for email sign-in/sign-up, fix plugin onRequest chaining, SAML hardening (parser safeguards, size limits), fix anonymous hook matching, custom JWKS paths, and require DB-backed sessions for the OAuth provider; adapters now support array fields. Also sync session updates to secondary storage and active-session lists, improve Expo (webBrowserOptions, sturdier cookie parsing), and enhance Stripe (cancellation/termination fields, handle subscription.created, disableRedirect for subscription/billing, trial-abuse prevention); enable account linking by default.

  • Refactors

    • Secret check now logs a warning when BETTER_AUTH_SECRET is shorter than 32 chars.
    • Removed schema inference options from multiSessionClient; docs updated to drop “Additional Fields”.

  • Migration

    • Replace multiSessionClient({ schema: ... }) with multiSessionClient().
    • Extend the core schema for extra fields; do not rely on plugin-side type inference.
    • If using the OAuth provider, enable session.storeSessionInDatabase.
    • If using the Stripe plugin, add cancelAt, canceledAt, and endedAt to the subscription schema.

Written for commit 7d00367d43. Summary will update on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/7072 **Author:** [@himself65](https://github.com/himself65) **Created:** 12/31/2025 **Status:** ✅ Merged **Merged:** 12/31/2025 **Merged by:** [@himself65](https://github.com/himself65) **Base:** `main` ← **Head:** `v1.4.x-staging` --- ### 📝 Commits (10+) - [`4e250f4`](https://github.com/better-auth/better-auth/commit/4e250f47ded67288bfa35d13a17bfe2a8e8ed6b4) chore: BETTER_AUTH_SECRET length check shouldn't throw error (#6954) - [`5466f1e`](https://github.com/better-auth/better-auth/commit/5466f1e99bdb3c66ca90988409154b76246b3c6e) Revert "feat(multi-session): allow to infer additional fields (#6585)" - [`e2519cb`](https://github.com/better-auth/better-auth/commit/e2519cb3ce9fb27610dd006d00537705419ef454) docs: improve set active organization guide (#7010) - [`63492c8`](https://github.com/better-auth/better-auth/commit/63492c854c210fadbe94b98b71c91fd73466710c) docs: add payments section (#7030) - [`81d2a10`](https://github.com/better-auth/better-auth/commit/81d2a10da4ff0217d9fce779a11712dcc67dfd00) docs: improve community plugins page (#7031) - [`c4c5f96`](https://github.com/better-auth/better-auth/commit/c4c5f963a0073f02f97ee7437c04a5fa562e98af) docs: add gradient mask image for `TOCScrollArea` (#7032) - [`2fc2ec1`](https://github.com/better-auth/better-auth/commit/2fc2ec12f20afee2dbb51a0ff8828e9e29edc3bb) fix(stripe): add 'subscription/restore' to pathMethods (#6959) - [`601ea54`](https://github.com/better-auth/better-auth/commit/601ea542e63056162c20b545dab5b8852ee7440f) chore: clean up lint warning (#6960) - [`147dec3`](https://github.com/better-auth/better-auth/commit/147dec3d0a8df37c01ae99b64ae100ecf7d09bbc) ci: remove auto cherry pick (#6976) - [`2d9753c`](https://github.com/better-auth/better-auth/commit/2d9753c92a61521197c37cf31c8352d659ba8287) feat(saml): add XML parser hardening with configurable size limits (#6805) ### 📊 Changes **97 files changed** (+5086 additions, -2542 deletions) <details> <summary>View changed files</summary> ➖ `.github/workflows/auto-cherry-pick-to-main.yml` (+0 -337) ➖ `.github/workflows/cherry-pick-to-main.yml` (+0 -325) 📝 `biome.json` (+2 -1) 📝 `demo/nextjs/package.json` (+1 -1) 📝 `demo/stateless/package.json` (+1 -1) 📝 `docs/components/community-plugins-table.tsx` (+8 -10) 📝 `docs/components/docs/layout/toc.tsx` (+53 -0) 📝 `docs/components/sidebar-content.tsx` (+21 -15) 📝 `docs/content/docs/introduction.mdx` (+2 -2) 📝 `docs/content/docs/plugins/community-plugins.mdx` (+4 -2) 📝 `docs/content/docs/plugins/multi-session.mdx` (+1 -59) 📝 `docs/content/docs/plugins/oauth-provider.mdx` (+3 -3) 📝 `docs/content/docs/plugins/organization.mdx` (+4 -3) 📝 `docs/content/docs/plugins/sso.mdx` (+34 -0) 📝 `docs/content/docs/plugins/stripe.mdx` (+97 -43) 📝 `docs/content/docs/reference/options.mdx` (+1 -1) 📝 `docs/content/docs/reference/security.mdx` (+21 -2) 📝 `docs/package.json` (+5 -5) 📝 `e2e/integration/solid-vinxi/src/lib/auth.ts` (+3 -0) 📝 `e2e/integration/vanilla-node/e2e/app.ts` (+5 -0) _...and 77 more files_ </details> ### 📄 Description <!-- This is an auto-generated description by cubic. --> ## Summary by cubic Switch secret validation to warn instead of throw, and revert the multi-session client’s schema inference API. Add Fetch Metadata CSRF checks and form-encoded support for email sign-in/sign-up, fix plugin onRequest chaining, SAML hardening (parser safeguards, size limits), fix anonymous hook matching, custom JWKS paths, and require DB-backed sessions for the OAuth provider; adapters now support array fields. Also sync session updates to secondary storage and active-session lists, improve Expo (webBrowserOptions, sturdier cookie parsing), and enhance Stripe (cancellation/termination fields, handle subscription.created, disableRedirect for subscription/billing, trial-abuse prevention); enable account linking by default. - **Refactors** - Secret check now logs a warning when BETTER_AUTH_SECRET is shorter than 32 chars. - Removed schema inference options from multiSessionClient; docs updated to drop “Additional Fields”. - **Migration** - Replace multiSessionClient({ schema: ... }) with multiSessionClient(). - Extend the core schema for extra fields; do not rely on plugin-side type inference. - If using the OAuth provider, enable session.storeSessionInDatabase. - If using the Stripe plugin, add cancelAt, canceledAt, and endedAt to the subscription schema. <sup>Written for commit 7d00367d4352fd1d5dfecab9b44e69d9056288b9. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-13 09:57:16 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#15304
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?