github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-13 16:32:26 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #9106] [MERGED] chore: sync main to next #16685

New Issue
Closed
opened 2026-04-13 10:38:40 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-13 10:38:40 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/9106
Author: @gustavovalverde
Created: 4/10/2026
Status: ✅ Merged
Merged: 4/10/2026
Merged by: @gustavovalverde

Base: next ← Head: chore/sync-main-to-next

📝 Commits (10+)

  • 83ed1fe fix(ci): prevent label explosion on PRs targeting the next branch (#9071)
  • a2fbe07 refactor(ci): simplify release notes to one-line entries (#9067)
  • 41679fa docs: add database table names (#9062)
  • 6ce30cf fix: incorrect operationId in password reset callback endpoint (#9072)
  • f6428d0 fix(open-api): correct get-session nullable schema for OAS 3.1 (#8389)
  • 099ee48 chore(docs): format markdown including mdx files (#9085)
  • d141a3b docs: fix PostgreSQL Prisma native type typo (#9090)
  • 5f84335 feat(stripe): support Stripe SDK v21 and v22 (#9084)
  • 684154d chore: replace z.union with z.xor for permission schemas in admin plugin (#8982)
  • c5066fe fix(stripe): omit quantity for metered prices in checkout and upgrades (#8926)

📊 Changes

219 files changed (+18609 additions, -16988 deletions)

View changed files

➕ .changeset/fix-password-reset-callback-operation-id.md (+5 -0)
➕ .changeset/honest-regions-jam.md (+5 -0)
➕ .changeset/pr-8926.md (+5 -0)
➕ .changeset/pr-9032.md (+5 -0)
➕ .changeset/pr-9084.md (+5 -0)
➕ .changeset/sso-saml-hardening.md (+25 -0)
📝 .github/prompts/release-notes-rewrite.md (+51 -67)
📝 .github/scripts/release-notes.ts (+91 -52)
📝 .github/workflows/auto-label.yml (+7 -1)
📝 .github/workflows/release.yml (+59 -24)
📝 .vscode/settings.json (+2 -1)
📝 demo/expo/src/app/forgot-password.tsx (+3 -3)
📝 demo/expo/src/app/index.tsx (+2 -2)
📝 demo/nextjs/app/(auth)/forgot-password/page.tsx (+2 -2)
📝 demo/nextjs/components/forms/forgot-password-form.tsx (+10 -10)
📝 demo/nextjs/components/forms/sign-in-form.tsx (+1 -1)
📝 demo/nextjs/package.json (+1 -1)
📝 demo/nextjs/pnpm-lock.yaml (+41 -27)
📝 docs/README.md (+6 -6)
📝 docs/app/legal/privacy/page.mdx (+68 -68)

...and 80 more files

📄 Description

Summary

Resolves merge conflicts in the automated main-to-next sync (replaces #9074).

  • Doc files (2fa, oauth-provider, sso): kept next's feature content (OTP enablement, private_key_jwt, SAML options), applied main's formatting pass and database table name pattern where applicable
  • packages/sso/src/routes/sso.ts: kept next's version, which has all 4 security fixes from #9055 and private_key_jwt from #8836

Note: main's saml-pipeline.ts arrives as a new file but is not wired into sso.ts yet. A follow-up PR should port the security fixes into the pipeline and adopt it, replacing the current inline approach.

Closes #9074

Summary by cubic

Syncs main into next, adopts the SAML pipeline in SSO with private_key_jwt, and preserves next’s SSO/SAML settings. Brings over docs formatting and table names, CI/release improvements, OpenAPI alignment changesets, SAML hardening in @better-auth/sso, Stripe SDK v21–v22 support, and renames demos to “Forgot Password” using requestPasswordReset.

  • Bug Fixes

    • SSO/SAML: switched to saml-pipeline.ts; ported security fixes (InResponseTo path, audience restriction, SessionIndex as string, default allowIdpInitiated=false); unified response handling; fixed ACS URL identifier, provider lookup, missing encryption fields; completed createSP/createIdP; corrected defaultSSO parsing; added private_key_jwt; guarded toLowerCase() against falsy email/nameID; used validated samlRedirectUrl for error redirects.
    • OpenAPI: aligned password reset callback operationId; fixed get-session nullable schema for OAS 3.1.
    • Tooling/CI/Release: omitted quantity for metered stripe prices; fixed tsconfig path alias resolution; skipped auto-label on next/bot PRs; renamed release PRs with version; simplified one‑line release notes; fixed release validation grep count fallback.

  • Migration

    • SAML ACS error redirects now use UPPERCASE codes (e.g., SAML_MULTIPLE_ASSERTIONS) — update any URL parsing.
    • Demo routes and labels use “Forgot Password” and the requestPasswordReset method; update any copied examples.

Written for commit 2e0ad30369. Summary will update on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/9106 **Author:** [@gustavovalverde](https://github.com/gustavovalverde) **Created:** 4/10/2026 **Status:** ✅ Merged **Merged:** 4/10/2026 **Merged by:** [@gustavovalverde](https://github.com/gustavovalverde) **Base:** `next` ← **Head:** `chore/sync-main-to-next` --- ### 📝 Commits (10+) - [`83ed1fe`](https://github.com/better-auth/better-auth/commit/83ed1fe3604a2cb20426e76c9eb34a2fc2b22b22) fix(ci): prevent label explosion on PRs targeting the next branch (#9071) - [`a2fbe07`](https://github.com/better-auth/better-auth/commit/a2fbe079f8eccc9dd9d9593f0d7706a6893c765a) refactor(ci): simplify release notes to one-line entries (#9067) - [`41679fa`](https://github.com/better-auth/better-auth/commit/41679fa81795a2305ddf5f70a9cba27ea483f33e) docs: add database table names (#9062) - [`6ce30cf`](https://github.com/better-auth/better-auth/commit/6ce30cf13853619b9022e93bd6ecb956bc32482d) fix: incorrect `operationId` in password reset callback endpoint (#9072) - [`f6428d0`](https://github.com/better-auth/better-auth/commit/f6428d02fcabc2e628f39b0e402f1a6eb0602649) fix(open-api): correct get-session nullable schema for OAS 3.1 (#8389) - [`099ee48`](https://github.com/better-auth/better-auth/commit/099ee48c4147bf0bacbb9cc9ae7ed35bed8f6589) chore(docs): format markdown including mdx files (#9085) - [`d141a3b`](https://github.com/better-auth/better-auth/commit/d141a3b190f710918f7f25298e94d58473a96253) docs: fix PostgreSQL Prisma native type typo (#9090) - [`5f84335`](https://github.com/better-auth/better-auth/commit/5f84335815d75410320bdfa665a6712d3416b04f) feat(stripe): support Stripe SDK v21 and v22 (#9084) - [`684154d`](https://github.com/better-auth/better-auth/commit/684154d3d10072b25a3f07aab7c2c24b43ca5a9e) chore: replace z.union with z.xor for permission schemas in admin plugin (#8982) - [`c5066fe`](https://github.com/better-auth/better-auth/commit/c5066fe5d68babf2376cfc63d813de5542eca463) fix(stripe): omit quantity for metered prices in checkout and upgrades (#8926) ### 📊 Changes **219 files changed** (+18609 additions, -16988 deletions) <details> <summary>View changed files</summary> ➕ `.changeset/fix-password-reset-callback-operation-id.md` (+5 -0) ➕ `.changeset/honest-regions-jam.md` (+5 -0) ➕ `.changeset/pr-8926.md` (+5 -0) ➕ `.changeset/pr-9032.md` (+5 -0) ➕ `.changeset/pr-9084.md` (+5 -0) ➕ `.changeset/sso-saml-hardening.md` (+25 -0) 📝 `.github/prompts/release-notes-rewrite.md` (+51 -67) 📝 `.github/scripts/release-notes.ts` (+91 -52) 📝 `.github/workflows/auto-label.yml` (+7 -1) 📝 `.github/workflows/release.yml` (+59 -24) 📝 `.vscode/settings.json` (+2 -1) 📝 `demo/expo/src/app/forgot-password.tsx` (+3 -3) 📝 `demo/expo/src/app/index.tsx` (+2 -2) 📝 `demo/nextjs/app/(auth)/forgot-password/page.tsx` (+2 -2) 📝 `demo/nextjs/components/forms/forgot-password-form.tsx` (+10 -10) 📝 `demo/nextjs/components/forms/sign-in-form.tsx` (+1 -1) 📝 `demo/nextjs/package.json` (+1 -1) 📝 `demo/nextjs/pnpm-lock.yaml` (+41 -27) 📝 `docs/README.md` (+6 -6) 📝 `docs/app/legal/privacy/page.mdx` (+68 -68) _...and 80 more files_ </details> ### 📄 Description ## Summary Resolves merge conflicts in the automated main-to-next sync (replaces #9074). - **Doc files** (2fa, oauth-provider, sso): kept next's feature content (OTP enablement, private_key_jwt, SAML options), applied main's formatting pass and database table name pattern where applicable - **`packages/sso/src/routes/sso.ts`**: kept next's version, which has all 4 security fixes from #9055 and private_key_jwt from #8836 Note: main's `saml-pipeline.ts` arrives as a new file but is not wired into `sso.ts` yet. A follow-up PR should port the security fixes into the pipeline and adopt it, replacing the current inline approach. Closes #9074 <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Syncs `main` into `next`, adopts the SAML pipeline in SSO with `private_key_jwt`, and preserves `next`’s SSO/SAML settings. Brings over docs formatting and table names, CI/release improvements, OpenAPI alignment changesets, SAML hardening in `@better-auth/sso`, Stripe SDK v21–v22 support, and renames demos to “Forgot Password” using `requestPasswordReset`. - **Bug Fixes** - SSO/SAML: switched to `saml-pipeline.ts`; ported security fixes (InResponseTo path, audience restriction, SessionIndex as string, default `allowIdpInitiated=false`); unified response handling; fixed ACS URL identifier, provider lookup, missing encryption fields; completed `createSP`/`createIdP`; corrected `defaultSSO` parsing; added private_key_jwt; guarded `toLowerCase()` against falsy email/nameID; used validated `samlRedirectUrl` for error redirects. - OpenAPI: aligned password reset callback `operationId`; fixed get-session nullable schema for OAS 3.1. - Tooling/CI/Release: omitted quantity for metered `stripe` prices; fixed tsconfig path alias resolution; skipped auto-label on `next`/bot PRs; renamed release PRs with version; simplified one‑line release notes; fixed release validation grep count fallback. - **Migration** - SAML ACS error redirects now use UPPERCASE codes (e.g., `SAML_MULTIPLE_ASSERTIONS`) — update any URL parsing. - Demo routes and labels use “Forgot Password” and the `requestPasswordReset` method; update any copied examples. <sup>Written for commit 2e0ad3036966c962dae96de13b48f01eda070d41. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-13 10:38:40 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#16685
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?