github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-22 06:16:18 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #9115] [MERGED] chore: sync main to next #25347

New Issue
Closed
opened 2026-04-15 22:50:51 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-15 22:50:51 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/9115
Author: @better-release[bot]
Created: 4/11/2026
Status: ✅ Merged
Merged: 4/14/2026
Merged by: @undefined

Base: next ← Head: main

📝 Commits (10+)

  • f320994 chore: fix typecheck command in CLAUDE.md (#9110)
  • 9fd0192 fix(ci): fix grep -c fallback producing invalid integer in release validation
  • 314e06f feat(oauth-provider): add customTokenResponseFields and harden authorization code validation (#9118)
  • 484ce6a fix(two-factor): enforce 2FA on all sign-in paths (#9122)
  • f875897 fix(two-factor): updated backup codes respect storeBackupCodes option (#7231)
  • e2e25a4 fix(oauth-provider): graceful DCR override for unauthenticated confidential clients (#9123)
  • 504ea25 chore(deps-dev): bump @sveltejs/kit from 2.53.3 to 2.57.1 (#9109)
  • a6e9b94 docs: improve enterprise contact form (#9128)
  • ed2c18d chore(deps): bump next from 16.2.2 to 16.2.3 in /docs (#9112)
  • a6f3197 docs(landing): polish sentinel section (#9142)

📊 Changes

102 files changed (+3835 additions, -1416 deletions)

View changed files

➖ .changeset/fix-password-reset-callback-operation-id.md (+0 -5)
➖ .changeset/honest-regions-jam.md (+0 -5)
➖ .changeset/pr-8926.md (+0 -5)
➖ .changeset/pr-9032.md (+0 -5)
➖ .changeset/pr-9084.md (+0 -5)
➖ .changeset/sso-saml-hardening.md (+0 -25)
📝 .github/workflows/release.yml (+4 -2)
📝 CLAUDE.md (+2 -2)
📝 demo/nextjs/package.json (+1 -1)
📝 demo/nextjs/pnpm-lock.yaml (+92 -71)
📝 demo/stateless/package.json (+1 -1)
📝 demo/stateless/pnpm-lock.yaml (+41 -41)
📝 docs/app/api/enterprise/contact/route.ts (+73 -58)
📝 docs/app/enterprise/enterprise-client.tsx (+182 -157)
📝 docs/app/not-found.tsx (+12 -7)
📝 docs/components/docs/mdx-components.tsx (+14 -4)
📝 docs/components/landing/hero-readme.tsx (+103 -85)
➕ docs/components/ui/form.tsx (+165 -0)
📝 docs/content/docs/concepts/database.mdx (+2 -0)
📝 docs/content/docs/guides/next-auth-migration-guide.mdx (+4 -0)

...and 80 more files

📄 Description

Brings stable fixes from main into the next branch.

This PR must be merged by a maintainer using 'Create a merge commit' (not squash, not rebase). This preserves individual fix commits and their verified signatures.

If there are conflicts, resolve them by keeping next's versions for package.json files (next is always ahead of main in version numbers).

Summary by cubic

Syncs main into next. Publishes v1.6.3 across all packages, adds token response customization and stricter validation in @better-auth/oauth-provider, enforces 2FA across all sign‑in paths, hardens dynamic baseURL, secures @better-auth/stripe metadata merging, improves docs UX, fixes schema docs FKs, updates links, bumps next to 16.2.3, and fixes a client query race.

  • New Features

    • @better-auth/oauth-provider: customTokenResponseFields to add non‑standard JSON fields to token responses; authorization code values validated with Zod for consistent invalid_verification errors.
    • Dynamic Client Registration (unauthenticated): override confidential methods to none (public) and clear type: "web"; authenticated registrations keep confidential methods.
    • Metadata helpers: oauthProviderAuthServerMetadata/oauthProviderOpenIdConfigMetadata now adapt to dynamic baseURL and set short cache headers.
    • Docs: enterprise contact form rebuilt with Zod + react-hook-form and honeypot; SSO docs refactored to export named field definitions; 404 page updated.

  • Bug Fixes

    • Two‑factor: enforce on all session‑creating sign‑in flows; authenticated requests are skipped. Backup codes re‑saved using the configured storeBackupCodes strategy.
    • Base URL: resolve dynamic baseURL from request headers for direct auth.api calls; throw APIError when unresolved or host is disallowed; honor advanced.trustedProxyHeaders; rehydrate trusted origins/providers and cookies per call; MCP auth path aligned with the new resolver.
    • Client: prevent useAuthQuery mount race that caused duplicate requests by initializing once during first mount.
    • @better-auth/stripe: prevent prototype pollution by dropping __proto__, constructor, and prototype keys when merging user metadata; bump defu to ^6.1.5.
    • @better-auth/sso: unify SAML response processing and fix provider/config issues (ACS URL providerId, DB lookup with defaultSSO, encryption fields, config parsing, and helper completeness).
    • CI/Docs/Deps: fix release notes PR link counting; fix schema table FK references with explicit references; update Convex Labs link; correct “invocable endpoints” wording; bump @sveltejs/kit to ^2.57.1; bump next to 16.2.3 in docs and demos.

Written for commit 6f17bb3ebd. Summary will update on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/9115 **Author:** [@better-release[bot]](https://github.com/apps/better-release) **Created:** 4/11/2026 **Status:** ✅ Merged **Merged:** 4/14/2026 **Merged by:** [@undefined](undefined) **Base:** `next` ← **Head:** `main` --- ### 📝 Commits (10+) - [`f320994`](https://github.com/better-auth/better-auth/commit/f32099449ed7ab1e1e558feae2a51d9b148c8ceb) chore: fix typecheck command in `CLAUDE.md` (#9110) - [`9fd0192`](https://github.com/better-auth/better-auth/commit/9fd0192d0efaf5bdacc8f3a22674bffed2854e32) fix(ci): fix grep -c fallback producing invalid integer in release validation - [`314e06f`](https://github.com/better-auth/better-auth/commit/314e06f0fd84ac90b55b5430624a74c5a8d62bfd) feat(oauth-provider): add `customTokenResponseFields` and harden authorization code validation (#9118) - [`484ce6a`](https://github.com/better-auth/better-auth/commit/484ce6a262c39b9c1be91d37774a2a13de3a5a1f) fix(two-factor): enforce 2FA on all sign-in paths (#9122) - [`f875897`](https://github.com/better-auth/better-auth/commit/f8758975ae475429d56b34aa6067e304ee973c8f) fix(two-factor): updated backup codes respect `storeBackupCodes` option (#7231) - [`e2e25a4`](https://github.com/better-auth/better-auth/commit/e2e25a49545f3e386cfcc4e86b33c1796a1430b1) fix(oauth-provider): graceful DCR override for unauthenticated confidential clients (#9123) - [`504ea25`](https://github.com/better-auth/better-auth/commit/504ea253ac84691cb1ba7b83598eee4ad037d6d6) chore(deps-dev): bump @sveltejs/kit from 2.53.3 to 2.57.1 (#9109) - [`a6e9b94`](https://github.com/better-auth/better-auth/commit/a6e9b943184c6f6c899dcced591c97199a991670) docs: improve enterprise contact form (#9128) - [`ed2c18d`](https://github.com/better-auth/better-auth/commit/ed2c18df3150ab3a024f7d14a5b5fa58719332f2) chore(deps): bump next from 16.2.2 to 16.2.3 in /docs (#9112) - [`a6f3197`](https://github.com/better-auth/better-auth/commit/a6f31972cadde34a5b0feb5184300b69bd629231) docs(landing): polish sentinel section (#9142) ### 📊 Changes **102 files changed** (+3835 additions, -1416 deletions) <details> <summary>View changed files</summary> ➖ `.changeset/fix-password-reset-callback-operation-id.md` (+0 -5) ➖ `.changeset/honest-regions-jam.md` (+0 -5) ➖ `.changeset/pr-8926.md` (+0 -5) ➖ `.changeset/pr-9032.md` (+0 -5) ➖ `.changeset/pr-9084.md` (+0 -5) ➖ `.changeset/sso-saml-hardening.md` (+0 -25) 📝 `.github/workflows/release.yml` (+4 -2) 📝 `CLAUDE.md` (+2 -2) 📝 `demo/nextjs/package.json` (+1 -1) 📝 `demo/nextjs/pnpm-lock.yaml` (+92 -71) 📝 `demo/stateless/package.json` (+1 -1) 📝 `demo/stateless/pnpm-lock.yaml` (+41 -41) 📝 `docs/app/api/enterprise/contact/route.ts` (+73 -58) 📝 `docs/app/enterprise/enterprise-client.tsx` (+182 -157) 📝 `docs/app/not-found.tsx` (+12 -7) 📝 `docs/components/docs/mdx-components.tsx` (+14 -4) 📝 `docs/components/landing/hero-readme.tsx` (+103 -85) ➕ `docs/components/ui/form.tsx` (+165 -0) 📝 `docs/content/docs/concepts/database.mdx` (+2 -0) 📝 `docs/content/docs/guides/next-auth-migration-guide.mdx` (+4 -0) _...and 80 more files_ </details> ### 📄 Description Brings stable fixes from main into the next branch. **This PR must be merged by a maintainer using 'Create a merge commit'** (not squash, not rebase). This preserves individual fix commits and their verified signatures. If there are conflicts, resolve them by keeping next's versions for `package.json` files (next is always ahead of main in version numbers). <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Syncs `main` into `next`. Publishes v1.6.3 across all packages, adds token response customization and stricter validation in `@better-auth/oauth-provider`, enforces 2FA across all sign‑in paths, hardens dynamic `baseURL`, secures `@better-auth/stripe` metadata merging, improves docs UX, fixes schema docs FKs, updates links, bumps `next` to 16.2.3, and fixes a client query race. - **New Features** - `@better-auth/oauth-provider`: `customTokenResponseFields` to add non‑standard JSON fields to token responses; authorization code values validated with Zod for consistent `invalid_verification` errors. - Dynamic Client Registration (unauthenticated): override confidential methods to `none` (public) and clear `type: "web"`; authenticated registrations keep confidential methods. - Metadata helpers: `oauthProviderAuthServerMetadata`/`oauthProviderOpenIdConfigMetadata` now adapt to dynamic `baseURL` and set short cache headers. - Docs: enterprise contact form rebuilt with Zod + `react-hook-form` and honeypot; SSO docs refactored to export named field definitions; 404 page updated. - **Bug Fixes** - Two‑factor: enforce on all session‑creating sign‑in flows; authenticated requests are skipped. Backup codes re‑saved using the configured `storeBackupCodes` strategy. - Base URL: resolve dynamic `baseURL` from request headers for direct `auth.api` calls; throw `APIError` when unresolved or host is disallowed; honor `advanced.trustedProxyHeaders`; rehydrate trusted origins/providers and cookies per call; MCP auth path aligned with the new resolver. - Client: prevent `useAuthQuery` mount race that caused duplicate requests by initializing once during first mount. - `@better-auth/stripe`: prevent prototype pollution by dropping `__proto__`, `constructor`, and `prototype` keys when merging user metadata; bump `defu` to `^6.1.5`. - `@better-auth/sso`: unify SAML response processing and fix provider/config issues (ACS URL `providerId`, DB lookup with `defaultSSO`, encryption fields, config parsing, and helper completeness). - CI/Docs/Deps: fix release notes PR link counting; fix schema table FK references with explicit `references`; update Convex Labs link; correct “invocable endpoints” wording; bump `@sveltejs/kit` to `^2.57.1`; bump `next` to `16.2.3` in docs and demos. <sup>Written for commit 6f17bb3ebd992867be968f38d73fdfff28eeeaab. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-15 22:50:51 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#25347
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?