github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-22 14:21:55 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #8976] [MERGED] chore: sync main to next #16586

New Issue
Closed
opened 2026-04-13 10:35:40 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-13 10:35:40 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/8976
Author: @better-release[bot]
Created: 4/5/2026
Status: ✅ Merged
Merged: 4/6/2026
Merged by: @gustavovalverde

Base: next ← Head: main

📝 Commits (9)

  • 475d512 chore: revert better-call v2 migration, downgrade to v1.3.5 (#8973)
  • eb090df fix(ci): skip changeset verification on sync PRs (main → next) (#8979)
  • b0a6da2 ci: add release notes pipeline with AI rewriting (#8975)
  • 469eee6 fix(oauth): prevent double-hashing of state when storeIdentifier is hashed (#8980)
  • dd537cb chore(oidc-provider): deprecate plugin in favor of @better-auth/oauth-provider (#8985)
  • 560230f fix(types): prevent any from collapsing base type and client inference (#8981)
  • ee8b40d fix(deps): patch Dependabot security issues (#8838)
  • bd9bd58 fix(security): enforce authorization on SCIM management endpoints and normalize passkey ownership (#8843)
  • e5091ee fix(oauth-provider): scope loss on PAR, loopback redirect matching, DCR skip_consent (#8632)

📊 Changes

69 files changed (+3541 additions, -866 deletions)

View changed files

➕ .changeset/deprecate-oidc-provider.md (+7 -0)
➕ .changeset/fix-deps-security-overrides.md (+5 -0)
➕ .changeset/fix-idor-authorization-scim-passkey.md (+5 -0)
➕ .changeset/fix-oauth-provider-par-loopback-dcr.md (+10 -0)
➕ .changeset/pr-8980.md (+5 -0)
➕ .changeset/violet-papayas-see.md (+5 -0)
➕ .github/prompts/release-notes-rewrite.md (+71 -0)
📝 .github/scripts/auto-changeset.ts (+2 -74)
➕ .github/scripts/lib/github.ts (+36 -0)
➕ .github/scripts/lib/pr-analyzer.ts (+246 -0)
➕ .github/scripts/release-notes.ts (+714 -0)
📝 .github/workflows/release.yml (+226 -2)
📝 .github/workflows/verify-changesets.yml (+1 -0)
📝 docs/content/docs/concepts/plugins.mdx (+80 -0)
📝 docs/content/docs/plugins/scim.mdx (+47 -20)
📝 docs/package.json (+1 -1)
📝 packages/better-auth/src/api/index.test.ts (+2 -3)
➕ packages/better-auth/src/api/middlewares/authorization.test.ts (+116 -0)
➕ packages/better-auth/src/api/middlewares/authorization.ts (+156 -0)
📝 packages/better-auth/src/api/middlewares/index.ts (+1 -0)

...and 49 more files

📄 Description

Brings stable fixes from main into the next branch.

This PR must be merged by a maintainer using 'Create a merge commit' (not squash, not rebase). This preserves individual fix commits and their verified signatures.

If there are conflicts, resolve them by keeping next's versions for package.json files (next is always ahead of main in version numbers).

Summary by cubic

Syncs main into next, completes the rollback to better-call@1.3.5, and adds a two-stage release notes pipeline with preview support. Fixes OAuth state double-hashing and adds PAR request_uri support, loopback redirect matching, and safer DCR in @better-auth/oauth-provider; enforces org-role checks for SCIM and normalizes passkey ownership.

  • Migration

    • Replace EndpointRuntimeOptions with EndpointOptions; createAuthEndpoint now returns a StrictEndpoint and uses (ctx: EndpointContext<Path, Options, AuthContext>) => Promise<R>.
    • Simplify types to EndpointContext<string, any> and InputContext<string, any> across API, core context, and plugin hooks.
    • Client: infer routes from Endpoint["options"]["metadata"]; error types read from StandardSchemaV1; InferCtx preserves fetchOptions and query typing when body is any; prevent any from collapsing auth.$Infer and auth.$ERROR_CODES even with untyped plugins.
    • OpenAPI generator expects EndpointOptions and reads parameters/request body from metadata.openapi.
    • Organization: hasPermission body enforces mutually exclusive permission vs permissions; additional fields inference ignores schema keys without additionalFields.
    • Anonymous plugin updates endpoint method typing to { method: "POST" }.
    • New authorization middlewares: requireResourceOwnership and requireOrgRole. SCIM management endpoints now require org roles (default: admin or the organization creator role; configurable via scim({ requiredRole: [...] })). Passkey deletion uses ownership checks.
    • Deprecate oidc-provider plugin (one-time runtime warning and TS @deprecated); migrate to @better-auth/oauth-provider.
    • @better-auth/oauth-provider: authorize resolves request_uri (PAR), loopback redirect URIs match regardless of port for localhost, dynamic registration rejects skip_consent, and state/query serialization is fixed.

  • Dependencies

    • Downgraded better-call to 1.3.5 across the workspace.
    • Security: pin samlify to ~2.10.2 in @better-auth/sso; add workspace overrides to patch transitive vulnerabilities (e.g., node-forge, path-to-regexp, dompurify, etc.).
    • Release workflow: added two-stage release notes generation (.github/scripts/release-notes.ts + rewrite via anthropics/claude-code-action) with preview mode, and GitHub Releases created from the rewritten notes; changeset verification is skipped on main ↔ next sync PRs.

Written for commit e5091ee1e6. Summary will update on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/8976 **Author:** [@better-release[bot]](https://github.com/apps/better-release) **Created:** 4/5/2026 **Status:** ✅ Merged **Merged:** 4/6/2026 **Merged by:** [@gustavovalverde](https://github.com/gustavovalverde) **Base:** `next` ← **Head:** `main` --- ### 📝 Commits (9) - [`475d512`](https://github.com/better-auth/better-auth/commit/475d512376b2f7d95dafb1f52652dd6e52e482ce) chore: revert `better-call` v2 migration, downgrade to v1.3.5 (#8973) - [`eb090df`](https://github.com/better-auth/better-auth/commit/eb090dfc13b2b70354626e87e002074d9ddce96f) fix(ci): skip changeset verification on sync PRs (main → next) (#8979) - [`b0a6da2`](https://github.com/better-auth/better-auth/commit/b0a6da2d0d803a8f54ac11f5b5e4dde13a7bbe72) ci: add release notes pipeline with AI rewriting (#8975) - [`469eee6`](https://github.com/better-auth/better-auth/commit/469eee6d846b32a43f36b418868e6a4c916382dc) fix(oauth): prevent double-hashing of state when storeIdentifier is hashed (#8980) - [`dd537cb`](https://github.com/better-auth/better-auth/commit/dd537cbdeb618abe9e274129f1670d0c03e89ae5) chore(oidc-provider): deprecate plugin in favor of @better-auth/oauth-provider (#8985) - [`560230f`](https://github.com/better-auth/better-auth/commit/560230f751dfc5d6efc8f7f3f12e5970c9ba09ea) fix(types): prevent `any` from collapsing base type and client inference (#8981) - [`ee8b40d`](https://github.com/better-auth/better-auth/commit/ee8b40d502bb392bd56748ac48aadf0e6c71e929) fix(deps): patch Dependabot security issues (#8838) - [`bd9bd58`](https://github.com/better-auth/better-auth/commit/bd9bd58f8768b2512f211c98c227148769d533c5) fix(security): enforce authorization on SCIM management endpoints and normalize passkey ownership (#8843) - [`e5091ee`](https://github.com/better-auth/better-auth/commit/e5091ee1e64fcbe69bdeb4ed86e774e32ca85d7d) fix(oauth-provider): scope loss on PAR, loopback redirect matching, DCR skip_consent (#8632) ### 📊 Changes **69 files changed** (+3541 additions, -866 deletions) <details> <summary>View changed files</summary> ➕ `.changeset/deprecate-oidc-provider.md` (+7 -0) ➕ `.changeset/fix-deps-security-overrides.md` (+5 -0) ➕ `.changeset/fix-idor-authorization-scim-passkey.md` (+5 -0) ➕ `.changeset/fix-oauth-provider-par-loopback-dcr.md` (+10 -0) ➕ `.changeset/pr-8980.md` (+5 -0) ➕ `.changeset/violet-papayas-see.md` (+5 -0) ➕ `.github/prompts/release-notes-rewrite.md` (+71 -0) 📝 `.github/scripts/auto-changeset.ts` (+2 -74) ➕ `.github/scripts/lib/github.ts` (+36 -0) ➕ `.github/scripts/lib/pr-analyzer.ts` (+246 -0) ➕ `.github/scripts/release-notes.ts` (+714 -0) 📝 `.github/workflows/release.yml` (+226 -2) 📝 `.github/workflows/verify-changesets.yml` (+1 -0) 📝 `docs/content/docs/concepts/plugins.mdx` (+80 -0) 📝 `docs/content/docs/plugins/scim.mdx` (+47 -20) 📝 `docs/package.json` (+1 -1) 📝 `packages/better-auth/src/api/index.test.ts` (+2 -3) ➕ `packages/better-auth/src/api/middlewares/authorization.test.ts` (+116 -0) ➕ `packages/better-auth/src/api/middlewares/authorization.ts` (+156 -0) 📝 `packages/better-auth/src/api/middlewares/index.ts` (+1 -0) _...and 49 more files_ </details> ### 📄 Description Brings stable fixes from main into the next branch. **This PR must be merged by a maintainer using 'Create a merge commit'** (not squash, not rebase). This preserves individual fix commits and their verified signatures. If there are conflicts, resolve them by keeping next's versions for `package.json` files (next is always ahead of main in version numbers). <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Syncs main into next, completes the rollback to `better-call@1.3.5`, and adds a two-stage release notes pipeline with preview support. Fixes OAuth state double-hashing and adds PAR `request_uri` support, loopback redirect matching, and safer DCR in `@better-auth/oauth-provider`; enforces org-role checks for SCIM and normalizes passkey ownership. - **Migration** - Replace `EndpointRuntimeOptions` with `EndpointOptions`; `createAuthEndpoint` now returns a `StrictEndpoint` and uses `(ctx: EndpointContext<Path, Options, AuthContext>) => Promise<R>`. - Simplify types to `EndpointContext<string, any>` and `InputContext<string, any>` across API, core context, and plugin hooks. - Client: infer routes from `Endpoint["options"]["metadata"]`; error types read from `StandardSchemaV1`; `InferCtx` preserves `fetchOptions` and query typing when `body` is `any`; prevent `any` from collapsing `auth.$Infer` and `auth.$ERROR_CODES` even with untyped plugins. - OpenAPI generator expects `EndpointOptions` and reads parameters/request body from `metadata.openapi`. - Organization: `hasPermission` body enforces mutually exclusive `permission` vs `permissions`; additional fields inference ignores schema keys without `additionalFields`. - Anonymous plugin updates endpoint method typing to `{ method: "POST" }`. - New authorization middlewares: `requireResourceOwnership` and `requireOrgRole`. SCIM management endpoints now require org roles (default: `admin` or the organization creator role; configurable via `scim({ requiredRole: [...] })`). Passkey deletion uses ownership checks. - Deprecate `oidc-provider` plugin (one-time runtime warning and TS `@deprecated`); migrate to `@better-auth/oauth-provider`. - `@better-auth/oauth-provider`: authorize resolves `request_uri` (PAR), loopback redirect URIs match regardless of port for localhost, dynamic registration rejects `skip_consent`, and state/query serialization is fixed. - **Dependencies** - Downgraded `better-call` to `1.3.5` across the workspace. - Security: pin `samlify` to `~2.10.2` in `@better-auth/sso`; add workspace overrides to patch transitive vulnerabilities (e.g., `node-forge`, `path-to-regexp`, `dompurify`, etc.). - Release workflow: added two-stage release notes generation (`.github/scripts/release-notes.ts` + rewrite via `anthropics/claude-code-action`) with preview mode, and GitHub Releases created from the rewritten notes; changeset verification is skipped on `main` ↔ `next` sync PRs. <sup>Written for commit e5091ee1e64fcbe69bdeb4ed86e774e32ca85d7d. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-13 10:35:40 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#16586
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?