Gustavo Valverde 472a5f22ff refactor(oauth-provider): refuse unrotatable clients before verifying the assertion ...

verifyClientAssertion takes an `assertClient` precondition that runs on the looked-up client before any key is fetched or the jti is consumed. Key rotation uses it, so a jwks_uri or trusted client is refused without a JWKS fetch, a signature check, or spending the assertion.

2026-10-12 14:18:42 +01:00

..

api-key

fix(deps): align @better-auth/utils with better-call (#11512)

2026-10-01 15:14:19 +00:00

better-auth

fix(better-auth): allow SvelteKit 3 as a peer dependency (#11488)

2026-10-09 16:33:41 +00:00

cimd

fix(oauth-provider): accept host-bearing custom-scheme native redirects (#10956)

2026-10-09 08:59:37 +01:00

cli

…

core

fix(oauth-provider): accept host-bearing custom-scheme native redirects (#10956)

2026-10-09 08:59:37 +01:00

drizzle-adapter

fix(deps): align @better-auth/utils with better-call (#11512)

2026-10-01 15:14:19 +00:00

electron

fix(deps): align @better-auth/utils with better-call (#11512)

2026-10-01 15:14:19 +00:00

expo

…

i18n

…

kysely-adapter

fix(kysely-adapter): allow concurrent queries on the D1 dialect (#11490)

2026-10-10 07:59:43 +00:00

mcp

fix(mcp): keep McpOptions assignable to OAuthOptions under exactOptionalPropertyTypes (#11635)

2026-10-08 15:21:14 +01:00

memory-adapter

fix(deps): align @better-auth/utils with better-call (#11512)

2026-10-01 15:14:19 +00:00

mongo-adapter

fix(mongodb-adapter): don't abort a transaction after commit was attempted (#11014)

2026-10-03 05:53:10 +09:00

oauth-provider

refactor(oauth-provider): refuse unrotatable clients before verifying the assertion

2026-10-12 14:18:42 +01:00

passkey

fix(deps): align @better-auth/utils with better-call (#11512)

2026-10-01 15:14:19 +00:00

prisma-adapter

fix(deps): align @better-auth/utils with better-call (#11512)

2026-10-01 15:14:19 +00:00

redis-storage

…

release-tooling

…

scim

fix(scim): return 409 when concurrent updates claim the same unique key (#11669)

2026-10-10 11:38:31 +00:00

sso

fix(sso): reject mismatched OIDC issuers (#11438)

2026-10-08 16:25:31 +00:00

stripe

fix(stripe): bail out of checkout.session.completed for non-subscription modes (#9684)

2026-10-01 18:15:28 +00:00

telemetry

fix(deps): align @better-auth/utils with better-call (#11512)

2026-10-01 15:14:19 +00:00

test-utils

fix(db): keep derived replay-marker ids under uuid and serial ids (#11625)

2026-10-08 14:31:59 +00:00