github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-22 06:16:18 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #9115] chore: sync main to next #16693

New Issue
Open
opened 2026-04-13 10:38:50 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-13 10:38:50 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/9115
Author: @better-release[bot]
Created: 4/11/2026
Status: 🔄 Open

Base: next ← Head: main

📝 Commits (10+)

  • f320994 chore: fix typecheck command in CLAUDE.md (#9110)
  • 9fd0192 fix(ci): fix grep -c fallback producing invalid integer in release validation
  • 314e06f feat(oauth-provider): add customTokenResponseFields and harden authorization code validation (#9118)
  • 484ce6a fix(two-factor): enforce 2FA on all sign-in paths (#9122)
  • f875897 fix(two-factor): updated backup codes respect storeBackupCodes option (#7231)
  • e2e25a4 fix(oauth-provider): graceful DCR override for unauthenticated confidential clients (#9123)
  • 504ea25 chore(deps-dev): bump @sveltejs/kit from 2.53.3 to 2.57.1 (#9109)
  • a6e9b94 docs: improve enterprise contact form (#9128)
  • ed2c18d chore(deps): bump next from 16.2.2 to 16.2.3 in /docs (#9112)
  • a6f3197 docs(landing): polish sentinel section (#9142)

📊 Changes

36 files changed (+2352 additions, -1123 deletions)

View changed files

➕ .changeset/dcr-graceful-override-confidential.md (+25 -0)
➕ .changeset/fix-2fa-bypass.md (+7 -0)
➕ .changeset/fix-backup-codes-storage.md (+7 -0)
➕ .changeset/oauth-provider-token-refactor.md (+9 -0)
📝 .github/workflows/release.yml (+2 -2)
📝 CLAUDE.md (+2 -2)
📝 demo/nextjs/package.json (+1 -1)
📝 demo/nextjs/pnpm-lock.yaml (+92 -71)
📝 demo/stateless/package.json (+1 -1)
📝 demo/stateless/pnpm-lock.yaml (+41 -41)
📝 docs/app/api/enterprise/contact/route.ts (+70 -58)
📝 docs/app/enterprise/enterprise-client.tsx (+182 -157)
📝 docs/components/docs/mdx-components.tsx (+14 -4)
📝 docs/components/landing/hero-readme.tsx (+103 -85)
➕ docs/components/ui/form.tsx (+165 -0)
📝 docs/content/docs/concepts/database.mdx (+2 -0)
📝 docs/content/docs/guides/next-auth-migration-guide.mdx (+4 -0)
📝 docs/content/docs/plugins/2fa.mdx (+1 -0)
📝 docs/content/docs/plugins/oauth-provider.mdx (+20 -2)
📝 docs/content/docs/plugins/oidc-provider.mdx (+5 -5)

...and 16 more files

📄 Description

Brings stable fixes from main into the next branch.

This PR must be merged by a maintainer using 'Create a merge commit' (not squash, not rebase). This preserves individual fix commits and their verified signatures.

If there are conflicts, resolve them by keeping next's versions for package.json files (next is always ahead of main in version numbers).

Summary by cubic

Syncs main into next. Adds token response customization and stronger validation in @better-auth/oauth-provider, enforces 2FA across all sign-in paths, improves docs UX (enterprise contact, SSO), fixes schema docs foreign-key references, and bumps next to 16.2.3.

  • New Features

    • @better-auth/oauth-provider: customTokenResponseFields to add non‑standard JSON fields to token responses; authorization code values validated with Zod for consistent invalid_verification errors.
    • Dynamic Client Registration (unauthenticated): override client_secret_*/omitted methods to none (public) and clear type: "web"; authenticated registrations keep confidential methods.
    • Docs: enterprise contact form rebuilt with Zod + react-hook-form and honeypot; landing sentinel colors polished; SSO docs refactored to export named field definitions for reuse.

  • Bug Fixes

    • Two‑factor: enforce on all session‑creating sign‑in flows; authenticated requests are skipped. Backup codes re‑saved using the configured storeBackupCodes strategy.
    • CI/Docs/Deps: fix release notes PR link counting; update CLAUDE.md to use pnpm typecheck; fix schema table FK references with explicit references support; bump @sveltejs/kit dev dep to ^2.57.1; bump next to 16.2.3 in docs and demos.

Written for commit 6c946a3e0c. Summary will update on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/9115 **Author:** [@better-release[bot]](https://github.com/apps/better-release) **Created:** 4/11/2026 **Status:** 🔄 Open **Base:** `next` ← **Head:** `main` --- ### 📝 Commits (10+) - [`f320994`](https://github.com/better-auth/better-auth/commit/f32099449ed7ab1e1e558feae2a51d9b148c8ceb) chore: fix typecheck command in `CLAUDE.md` (#9110) - [`9fd0192`](https://github.com/better-auth/better-auth/commit/9fd0192d0efaf5bdacc8f3a22674bffed2854e32) fix(ci): fix grep -c fallback producing invalid integer in release validation - [`314e06f`](https://github.com/better-auth/better-auth/commit/314e06f0fd84ac90b55b5430624a74c5a8d62bfd) feat(oauth-provider): add `customTokenResponseFields` and harden authorization code validation (#9118) - [`484ce6a`](https://github.com/better-auth/better-auth/commit/484ce6a262c39b9c1be91d37774a2a13de3a5a1f) fix(two-factor): enforce 2FA on all sign-in paths (#9122) - [`f875897`](https://github.com/better-auth/better-auth/commit/f8758975ae475429d56b34aa6067e304ee973c8f) fix(two-factor): updated backup codes respect `storeBackupCodes` option (#7231) - [`e2e25a4`](https://github.com/better-auth/better-auth/commit/e2e25a49545f3e386cfcc4e86b33c1796a1430b1) fix(oauth-provider): graceful DCR override for unauthenticated confidential clients (#9123) - [`504ea25`](https://github.com/better-auth/better-auth/commit/504ea253ac84691cb1ba7b83598eee4ad037d6d6) chore(deps-dev): bump @sveltejs/kit from 2.53.3 to 2.57.1 (#9109) - [`a6e9b94`](https://github.com/better-auth/better-auth/commit/a6e9b943184c6f6c899dcced591c97199a991670) docs: improve enterprise contact form (#9128) - [`ed2c18d`](https://github.com/better-auth/better-auth/commit/ed2c18df3150ab3a024f7d14a5b5fa58719332f2) chore(deps): bump next from 16.2.2 to 16.2.3 in /docs (#9112) - [`a6f3197`](https://github.com/better-auth/better-auth/commit/a6f31972cadde34a5b0feb5184300b69bd629231) docs(landing): polish sentinel section (#9142) ### 📊 Changes **36 files changed** (+2352 additions, -1123 deletions) <details> <summary>View changed files</summary> ➕ `.changeset/dcr-graceful-override-confidential.md` (+25 -0) ➕ `.changeset/fix-2fa-bypass.md` (+7 -0) ➕ `.changeset/fix-backup-codes-storage.md` (+7 -0) ➕ `.changeset/oauth-provider-token-refactor.md` (+9 -0) 📝 `.github/workflows/release.yml` (+2 -2) 📝 `CLAUDE.md` (+2 -2) 📝 `demo/nextjs/package.json` (+1 -1) 📝 `demo/nextjs/pnpm-lock.yaml` (+92 -71) 📝 `demo/stateless/package.json` (+1 -1) 📝 `demo/stateless/pnpm-lock.yaml` (+41 -41) 📝 `docs/app/api/enterprise/contact/route.ts` (+70 -58) 📝 `docs/app/enterprise/enterprise-client.tsx` (+182 -157) 📝 `docs/components/docs/mdx-components.tsx` (+14 -4) 📝 `docs/components/landing/hero-readme.tsx` (+103 -85) ➕ `docs/components/ui/form.tsx` (+165 -0) 📝 `docs/content/docs/concepts/database.mdx` (+2 -0) 📝 `docs/content/docs/guides/next-auth-migration-guide.mdx` (+4 -0) 📝 `docs/content/docs/plugins/2fa.mdx` (+1 -0) 📝 `docs/content/docs/plugins/oauth-provider.mdx` (+20 -2) 📝 `docs/content/docs/plugins/oidc-provider.mdx` (+5 -5) _...and 16 more files_ </details> ### 📄 Description Brings stable fixes from main into the next branch. **This PR must be merged by a maintainer using 'Create a merge commit'** (not squash, not rebase). This preserves individual fix commits and their verified signatures. If there are conflicts, resolve them by keeping next's versions for `package.json` files (next is always ahead of main in version numbers). <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Syncs `main` into `next`. Adds token response customization and stronger validation in `@better-auth/oauth-provider`, enforces 2FA across all sign-in paths, improves docs UX (enterprise contact, SSO), fixes schema docs foreign-key references, and bumps `next` to 16.2.3. - **New Features** - `@better-auth/oauth-provider`: `customTokenResponseFields` to add non‑standard JSON fields to token responses; authorization code values validated with Zod for consistent `invalid_verification` errors. - Dynamic Client Registration (unauthenticated): override `client_secret_*`/omitted methods to `none` (public) and clear `type: "web"`; authenticated registrations keep confidential methods. - Docs: enterprise contact form rebuilt with Zod + `react-hook-form` and honeypot; landing sentinel colors polished; SSO docs refactored to export named field definitions for reuse. - **Bug Fixes** - Two‑factor: enforce on all session‑creating sign‑in flows; authenticated requests are skipped. Backup codes re‑saved using the configured `storeBackupCodes` strategy. - CI/Docs/Deps: fix release notes PR link counting; update `CLAUDE.md` to use `pnpm typecheck`; fix schema table FK references with explicit `references` support; bump `@sveltejs/kit` dev dep to `^2.57.1`; bump `next` to `16.2.3` in docs and demos. <sup>Written for commit 6c946a3e0cd9fce519f27784766222bb58b325e8. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-13 10:38:50 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#16693
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?