github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-22 06:16:18 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #9016] [MERGED] chore: sync main to next #16618

New Issue
Closed
opened 2026-04-13 10:36:42 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-13 10:36:42 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/9016
Author: @better-release[bot]
Created: 4/7/2026
Status: ✅ Merged
Merged: 4/9/2026
Merged by: @gustavovalverde

Base: next ← Head: main

📝 Commits (10+)

  • 60123da docs: add missing secret to getSignedCookie and remove misleading comments (#9008)
  • 3baf029 chore(docs): add remark-frontmatter (#9015)
  • 374985e docs: update community adapters and plugins pages (#9014)
  • 3b95d70 docs: change community plugin name (#8961)
  • 47dc887 docs: add @delmaredigital/payload-better-auth to community plugins (#8375)
  • f61ad1c fix: use INVALID_PASSWORD for all checkPassword failures (#8902)
  • 465c1dc ci: add one-click changeset commit and unify bot identity (#9019)
  • 2e537df fix: endpoint instrumentation to always use route template (#9023)
  • 5e7fd61 docs: hide fumadocs toc scroll indicator dot (#9021)
  • a7e359d docs: add expo sentinel docs (#9025)

📊 Changes

144 files changed (+4872 additions, -1739 deletions)

View changed files

📝 .cspell.jsonc (+2 -1)
📝 .github/prompts/release-notes-rewrite.md (+33 -9)
📝 .github/scripts/lib/pr-analyzer.ts (+101 -0)
📝 .github/scripts/release-notes.ts (+239 -76)
📝 .github/workflows/auto-changeset.yml (+186 -2)
📝 .github/workflows/auto-label.yml (+9 -0)
📝 .github/workflows/auto-retarget.yml (+13 -4)
📝 .github/workflows/lock-threads.yml (+10 -0)
📝 .github/workflows/release.yml (+1 -0)
📝 .github/workflows/semantic-pull-request.yml (+12 -1)
📝 .gitignore (+9 -0)
📝 CONTRIBUTING.md (+141 -188)
📝 demo/electron/package.json (+1 -1)
📝 demo/electron/pnpm-lock.yaml (+14 -35)
📝 demo/oidc-client/package.json (+1 -1)
📝 demo/oidc-client/pnpm-lock.yaml (+11 -56)
📝 docs/.remarkrc.mjs (+2 -0)
📝 docs/app/blog/[[...slug]]/page.tsx (+22 -1)
📝 docs/app/changelog/changelog-content.tsx (+2 -2)
📝 docs/app/community/community-client.tsx (+2 -2)

...and 80 more files

📄 Description

Brings stable fixes from main into the next branch.

This PR must be merged by a maintainer using 'Create a merge commit' (not squash, not rebase). This preserves individual fix commits and their verified signatures.

If there are conflicts, resolve them by keeping next's versions for package.json files (next is always ahead of main in version numbers).

Summary by cubic

Sync main into next for 1.6.2. Adds CSRF‑safe OAuth state checks (including oauth-proxy), provider‑scoped link‑social lookup, array‑safe query params in @better-auth/oauth-provider, Next.js RSC detection fix, improved 2FA UX (redirect methods + verified TOTP), restored getSession, standardized endpoint spans and INVALID_PASSWORD, hardened SAML, plus docs/CI updates and version bumps. CI now also groups release notes by npm package and change type and adds a one‑click changeset commit flow.

  • New Features

    • 2FA: verified flag on twoFactor; first enrollment starts false, flips on verifyTOTP. Migration: default true, no backfill.
    • 2FA redirect: return twoFactorMethods and pass to onTwoFactorRedirect.

  • Bug Fixes

    • Cookie‑backed OAuth: verify callback state against cookie nonce to prevent CSRF; oauth-proxy also enforces state binding.
    • @better-auth/oauth-provider: preserve multi‑valued query params during prompt redirects; reject skip_consent at schema level.
    • Next.js: header‑based RSC detection in nextCookies() to stop refresh loops; set new session cookie before deleting old one in 2FA.
    • Link‑social: provider‑scoped account lookup to avoid cross‑provider collisions.
    • SSO/SAML: include RelayState in signed AuthnRequests; strip SAMLResponse whitespace; throw when authnRequestsSigned: true without a key.
    • Instrumentation: endpoint spans use route templates.
    • API/Types: restore api.getSession on generic Auth<O>.
    • Passwords: use INVALID_PASSWORD for all checkPassword failures.
    • Docs: generic OAuth redirectURI must include providerId; phone‑number+password requires an account with providerId: "credential"; server methods (e.g. signUpEmail) need cookies returned to the client (Next/SvelteKit notes); fix getSignedCookie example to include secret.

Written for commit 700d298e1e. Summary will update on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/9016 **Author:** [@better-release[bot]](https://github.com/apps/better-release) **Created:** 4/7/2026 **Status:** ✅ Merged **Merged:** 4/9/2026 **Merged by:** [@gustavovalverde](https://github.com/gustavovalverde) **Base:** `next` ← **Head:** `main` --- ### 📝 Commits (10+) - [`60123da`](https://github.com/better-auth/better-auth/commit/60123da09ce09996782a30995a8a13bf6ce0274f) docs: add missing secret to getSignedCookie and remove misleading comments (#9008) - [`3baf029`](https://github.com/better-auth/better-auth/commit/3baf0294c2e439714fdf926977ea2cf4aed06539) chore(docs): add `remark-frontmatter` (#9015) - [`374985e`](https://github.com/better-auth/better-auth/commit/374985e340643f230adeb30961a76b414af6cb7c) docs: update community adapters and plugins pages (#9014) - [`3b95d70`](https://github.com/better-auth/better-auth/commit/3b95d70d046164424f778b4c01ba17319c2eaae5) docs: change community plugin name (#8961) - [`47dc887`](https://github.com/better-auth/better-auth/commit/47dc887d589d75d486edbd34b5cff869cb48194e) docs: add `@delmaredigital/payload-better-auth` to community plugins (#8375) - [`f61ad1c`](https://github.com/better-auth/better-auth/commit/f61ad1cab7360e4460e6450904e97498298a79d5) fix: use `INVALID_PASSWORD` for all `checkPassword` failures (#8902) - [`465c1dc`](https://github.com/better-auth/better-auth/commit/465c1dccf669f167cd03eb748df5ee2be3d1ff98) ci: add one-click changeset commit and unify bot identity (#9019) - [`2e537df`](https://github.com/better-auth/better-auth/commit/2e537df5f7f2a4263f52cce74d7a64a0a947792b) fix: endpoint instrumentation to always use route template (#9023) - [`5e7fd61`](https://github.com/better-auth/better-auth/commit/5e7fd61da065d900afc6bc20caadd63caee0808e) docs: hide fumadocs toc scroll indicator dot (#9021) - [`a7e359d`](https://github.com/better-auth/better-auth/commit/a7e359d870890230c79c09f85e3027eb1ddeb346) docs: add expo sentinel docs (#9025) ### 📊 Changes **144 files changed** (+4872 additions, -1739 deletions) <details> <summary>View changed files</summary> 📝 `.cspell.jsonc` (+2 -1) 📝 `.github/prompts/release-notes-rewrite.md` (+33 -9) 📝 `.github/scripts/lib/pr-analyzer.ts` (+101 -0) 📝 `.github/scripts/release-notes.ts` (+239 -76) 📝 `.github/workflows/auto-changeset.yml` (+186 -2) 📝 `.github/workflows/auto-label.yml` (+9 -0) 📝 `.github/workflows/auto-retarget.yml` (+13 -4) 📝 `.github/workflows/lock-threads.yml` (+10 -0) 📝 `.github/workflows/release.yml` (+1 -0) 📝 `.github/workflows/semantic-pull-request.yml` (+12 -1) 📝 `.gitignore` (+9 -0) 📝 `CONTRIBUTING.md` (+141 -188) 📝 `demo/electron/package.json` (+1 -1) 📝 `demo/electron/pnpm-lock.yaml` (+14 -35) 📝 `demo/oidc-client/package.json` (+1 -1) 📝 `demo/oidc-client/pnpm-lock.yaml` (+11 -56) 📝 `docs/.remarkrc.mjs` (+2 -0) 📝 `docs/app/blog/[[...slug]]/page.tsx` (+22 -1) 📝 `docs/app/changelog/changelog-content.tsx` (+2 -2) 📝 `docs/app/community/community-client.tsx` (+2 -2) _...and 80 more files_ </details> ### 📄 Description Brings stable fixes from main into the next branch. **This PR must be merged by a maintainer using 'Create a merge commit'** (not squash, not rebase). This preserves individual fix commits and their verified signatures. If there are conflicts, resolve them by keeping next's versions for `package.json` files (next is always ahead of main in version numbers). <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Sync main into next for 1.6.2. Adds CSRF‑safe OAuth state checks (including `oauth-proxy`), provider‑scoped link‑social lookup, array‑safe query params in `@better-auth/oauth-provider`, Next.js RSC detection fix, improved 2FA UX (redirect methods + verified TOTP), restored `getSession`, standardized endpoint spans and `INVALID_PASSWORD`, hardened SAML, plus docs/CI updates and version bumps. CI now also groups release notes by npm package and change type and adds a one‑click changeset commit flow. - **New Features** - 2FA: `verified` flag on `twoFactor`; first enrollment starts `false`, flips on `verifyTOTP`. Migration: default `true`, no backfill. - 2FA redirect: return `twoFactorMethods` and pass to `onTwoFactorRedirect`. - **Bug Fixes** - Cookie‑backed OAuth: verify callback `state` against cookie nonce to prevent CSRF; `oauth-proxy` also enforces state binding. - `@better-auth/oauth-provider`: preserve multi‑valued query params during prompt redirects; reject `skip_consent` at schema level. - Next.js: header‑based RSC detection in `nextCookies()` to stop refresh loops; set new session cookie before deleting old one in 2FA. - Link‑social: provider‑scoped account lookup to avoid cross‑provider collisions. - SSO/SAML: include RelayState in signed AuthnRequests; strip `SAMLResponse` whitespace; throw when `authnRequestsSigned: true` without a key. - Instrumentation: endpoint spans use route templates. - API/Types: restore `api.getSession` on generic `Auth<O>`. - Passwords: use `INVALID_PASSWORD` for all `checkPassword` failures. - Docs: generic OAuth `redirectURI` must include `providerId`; phone‑number+password requires an `account` with `providerId: "credential"`; server methods (e.g. `signUpEmail`) need cookies returned to the client (Next/SvelteKit notes); fix `getSignedCookie` example to include `secret`. <sup>Written for commit 700d298e1e6df7d6f381b6fa8456cc32aacf0b57. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-13 10:36:42 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#16618
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?