better-auth/.changeset/sso-upgrade-samlify.md

@better-auth/sso

@better-auth/sso
patch

Security: upgrade samlify to 2.12.0

Upgrades the SAML XML processing library from 2.10.2 to 2.12.0:

• XPath injection protection: all XPath expressions now use value escaping instead of string interpolation
• XXE prevention: the XML parser defaults to strict mode that rejects entity references
• Dependency reduction: removes node-forge, pako, uuid, and camelcase in favor of Node built-ins

PEM keys and certificates with leading whitespace are now normalized automatically before being passed to samlify. This prevents DECODER routines::unsupported errors when keys are copied from indented config files or environment variables.

Requires Node 20+.