github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #8989] [MERGED] chore: promote v1.6.0 to stable #25252

New Issue
Closed
opened 2026-04-15 22:47:27 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-15 22:47:27 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/8989
Author: @better-release[bot]
Created: 4/6/2026
Status: ✅ Merged
Merged: 4/6/2026
Merged by: @gustavovalverde

Base: main ← Head: next

📝 Commits (10+)

  • 5dd9e44 chore: enter beta pre-release mode with changesets for 1.6.0
  • 64c2978 fix: prevent major version escalation in changeset peer dep resolution
  • 9b4ccb1 fix: restore original changeset bump types now that peer dep patch is in place
  • 73beda2 chore: version packages (beta) (#8945)
  • 49a1674 Merge pull request #8972 from better-auth/main
  • 29d197e chore: sync main to next (#8976)
  • d666a03 chore: exit pre-release mode for v1.6.0
  • 535655b chore: fix release-blocking Changesets null versions on next (#8992)
  • d9b16d2 chore: sync main to next
  • 8737dbf chore: remove pending pr-8927 changeset (#8993)

📊 Changes

50 files changed (+603 additions, -62 deletions)

View changed files

📝 .changeset/config.json (+1 -0)
➖ .changeset/deprecate-oidc-provider.md (+0 -7)
➖ .changeset/fix-deps-security-overrides.md (+0 -5)
➖ .changeset/fix-idor-authorization-scim-passkey.md (+0 -5)
➖ .changeset/fix-oauth-provider-par-loopback-dcr.md (+0 -10)
➖ .changeset/pr-8927.md (+0 -5)
➖ .changeset/pr-8980.md (+0 -5)
➖ .changeset/violet-papayas-see.md (+0 -5)
➕ e2e/adapter/CHANGELOG.md (+3 -0)
➕ e2e/integration/test-utils/CHANGELOG.md (+3 -0)
➕ packages/api-key/CHANGELOG.md (+25 -0)
📝 packages/api-key/package.json (+1 -1)
➕ packages/better-auth/CHANGELOG.md (+89 -0)
📝 packages/better-auth/package.json (+1 -1)
➕ packages/cli/CHANGELOG.md (+27 -0)
📝 packages/cli/package.json (+1 -1)
➕ packages/core/CHANGELOG.md (+13 -0)
📝 packages/core/package.json (+1 -1)
➕ packages/drizzle-adapter/CHANGELOG.md (+23 -0)
📝 packages/drizzle-adapter/package.json (+1 -1)

...and 30 more files

📄 Description

Promotes v1.6.0 from beta to stable. Merging this PR publishes all packages to npm with the latest tag.\n\nThis PR must be merged by an admin using 'Create a merge commit' (not squash, not rebase). The admin bypass is required because main enforces linear history for regular PRs, but the promotion needs a merge commit to preserve individual contributor commits and their verified signatures.

Summary by cubic

Promotes v1.6.0 from beta to stable and publishes all packages to npm with the latest tag; fixes Changesets config on next (set privatePackages: false) that caused null versions, and removes the stale pr-8927 changeset. Admins must merge using “Create a merge commit” to preserve history and signatures.

  • New Features

    • Case-insensitive queries across adapters (@better-auth/*-adapter).
    • Passkey pre-auth registration and WebAuthn extensions (@better-auth/passkey).
    • Plugin interface now exposes version across built-in plugins.
    • OAuth provider improvements: PAR handling, loopback redirect matching, skip_consent guard, JSON redirects, and custom ID token claims (@better-auth/oauth-provider).

  • Bug Fixes

    • Enforced SCIM role checks and passkey ownership validation (better-auth).
    • OAuth fixes: state double-hashing, form_post body parsing, auth_time normalization, and dynamic baseURL handling.
    • Non-blocking scrypt, username uniqueness, safer updateUser, and accurate session “fresh age” (better-auth).
    • Pinned samlify to ~2.10.2 to avoid upstream breaks and patched transitive node-forge CVEs (@better-auth/sso).

Written for commit 8737dbf3f6. Summary will update on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/8989 **Author:** [@better-release[bot]](https://github.com/apps/better-release) **Created:** 4/6/2026 **Status:** ✅ Merged **Merged:** 4/6/2026 **Merged by:** [@gustavovalverde](https://github.com/gustavovalverde) **Base:** `main` ← **Head:** `next` --- ### 📝 Commits (10+) - [`5dd9e44`](https://github.com/better-auth/better-auth/commit/5dd9e44c041839bf269056cb246fd617abe6cd33) chore: enter beta pre-release mode with changesets for 1.6.0 - [`64c2978`](https://github.com/better-auth/better-auth/commit/64c297851650e9f1624eb1d8c6be80a2e7e4784f) fix: prevent major version escalation in changeset peer dep resolution - [`9b4ccb1`](https://github.com/better-auth/better-auth/commit/9b4ccb1f1106a729c8be0960e51722855afee4f5) fix: restore original changeset bump types now that peer dep patch is in place - [`73beda2`](https://github.com/better-auth/better-auth/commit/73beda26f9e5d5bb7dead4b29c882d6051d11d00) chore: version packages (beta) (#8945) - [`49a1674`](https://github.com/better-auth/better-auth/commit/49a1674642790006c5639f14793f38e0f6aeae43) Merge pull request #8972 from better-auth/main - [`29d197e`](https://github.com/better-auth/better-auth/commit/29d197e688b5617c01a075cf87a5d205353c6b48) chore: sync main to next (#8976) - [`d666a03`](https://github.com/better-auth/better-auth/commit/d666a033726f79ac2ff045f98feb047a6300b629) chore: exit pre-release mode for v1.6.0 - [`535655b`](https://github.com/better-auth/better-auth/commit/535655bc0daaa86e4ddceabbaa1cef92b749a734) chore: fix release-blocking Changesets null versions on next (#8992) - [`d9b16d2`](https://github.com/better-auth/better-auth/commit/d9b16d255193ae56722d5c9e7eccd82775c0ec10) chore: sync main to next - [`8737dbf`](https://github.com/better-auth/better-auth/commit/8737dbf3f65dbc06bce15de94cc20bd7cdd7f75a) chore: remove pending `pr-8927` changeset (#8993) ### 📊 Changes **50 files changed** (+603 additions, -62 deletions) <details> <summary>View changed files</summary> 📝 `.changeset/config.json` (+1 -0) ➖ `.changeset/deprecate-oidc-provider.md` (+0 -7) ➖ `.changeset/fix-deps-security-overrides.md` (+0 -5) ➖ `.changeset/fix-idor-authorization-scim-passkey.md` (+0 -5) ➖ `.changeset/fix-oauth-provider-par-loopback-dcr.md` (+0 -10) ➖ `.changeset/pr-8927.md` (+0 -5) ➖ `.changeset/pr-8980.md` (+0 -5) ➖ `.changeset/violet-papayas-see.md` (+0 -5) ➕ `e2e/adapter/CHANGELOG.md` (+3 -0) ➕ `e2e/integration/test-utils/CHANGELOG.md` (+3 -0) ➕ `packages/api-key/CHANGELOG.md` (+25 -0) 📝 `packages/api-key/package.json` (+1 -1) ➕ `packages/better-auth/CHANGELOG.md` (+89 -0) 📝 `packages/better-auth/package.json` (+1 -1) ➕ `packages/cli/CHANGELOG.md` (+27 -0) 📝 `packages/cli/package.json` (+1 -1) ➕ `packages/core/CHANGELOG.md` (+13 -0) 📝 `packages/core/package.json` (+1 -1) ➕ `packages/drizzle-adapter/CHANGELOG.md` (+23 -0) 📝 `packages/drizzle-adapter/package.json` (+1 -1) _...and 30 more files_ </details> ### 📄 Description Promotes v1.6.0 from beta to stable. Merging this PR publishes all packages to npm with the `latest` tag.\n\n**This PR must be merged by an admin using 'Create a merge commit'** (not squash, not rebase). The admin bypass is required because main enforces linear history for regular PRs, but the promotion needs a merge commit to preserve individual contributor commits and their verified signatures. <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Promotes v1.6.0 from beta to stable and publishes all packages to npm with the `latest` tag; fixes Changesets config on `next` (set `privatePackages: false`) that caused null versions, and removes the stale `pr-8927` changeset. Admins must merge using “Create a merge commit” to preserve history and signatures. - **New Features** - Case-insensitive queries across adapters (`@better-auth/*-adapter`). - Passkey pre-auth registration and WebAuthn extensions (`@better-auth/passkey`). - Plugin interface now exposes `version` across built-in plugins. - OAuth provider improvements: PAR handling, loopback redirect matching, `skip_consent` guard, JSON redirects, and custom ID token claims (`@better-auth/oauth-provider`). - **Bug Fixes** - Enforced SCIM role checks and passkey ownership validation (`better-auth`). - OAuth fixes: state double-hashing, `form_post` body parsing, `auth_time` normalization, and dynamic `baseURL` handling. - Non-blocking `scrypt`, username uniqueness, safer `updateUser`, and accurate session “fresh age” (`better-auth`). - Pinned `samlify` to `~2.10.2` to avoid upstream breaks and patched transitive `node-forge` CVEs (`@better-auth/sso`). <sup>Written for commit 8737dbf3f65dbc06bce15de94cc20bd7cdd7f75a. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-15 22:47:27 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#25252
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?