Bumps better-auth and @better-auth/sso from 1.5.5 → 1.6.11.
Prep work for an upcoming header-auth bridge fix (follow-up to #29). Doing the bump first as its own PR so the next change lands on a clean, current version of Better Auth — and so any regression from the bump itself surfaces in isolation.
What's in the 1.5 → 1.6 window
Reviewed the changelog against this codebase. Nothing requires code changes; flagging the items worth knowing:
freshAge semantics changed — now aligned with session createdAt instead of updatedAt. Sensitive operations may demand re-auth sooner. We don't gate anything on session freshness, so no impact here.
1.6.2: OAuth state CSRF verification — applies to OIDC/SAML callback flows via @better-auth/sso. No code change needed.
1.6.0: Account cookie compared by provider accountId, not internal id — only relevant to account-linking flows; we don't customize these.
1.6.0: TwoFactor table gets verified column, default true — no migration needed; we don't use 2FA.
1.6.0: oidc-provider plugin deprecated in favor of @better-auth/oauth-provider. We still import oidcProvider from better-auth/plugins; it works in 1.6.x and emits a deprecation warning. Migrating is a separate cleanup, not blocking.
1.5: API Key plugin moved to @better-auth/api-key — confirmed we don't import it from the main package.
Test plan
bun test — 270 pass, 4 skip, 0 fail. Includes auth-guards.test.ts, auth-origins.test.ts, and other Better Auth-touching tests.
CI runs astro check + Docker build on this PR — local typecheck/build was not run (known to OOM on this project; CI is the authoritative typecheck).
Manual smoke verification deferred to the follow-up header-auth PR, where end-to-end auth behavior gets exercised in a browser.
Why a standalone PR
The follow-up header-auth fix needs to touch the middleware + add a small plugin that uses internalAdapter.createSession and setSessionCookie. Landing this bump separately means:
Any regression from the dep bump is isolated and easy to revert.
The header-auth PR can be reviewed purely on its own logic, against the same Better Auth version that ships to users.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/RayLabsHQ/gitea-mirror/pull/301
**Author:** [@arunavo4](https://github.com/arunavo4)
**Created:** 5/27/2026
**Status:** ✅ Merged
**Merged:** 5/27/2026
**Merged by:** [@arunavo4](https://github.com/arunavo4)
**Base:** `main` ← **Head:** `chore/bump-better-auth-1.6.11`
---
### 📝 Commits (1)
- [`e9fda64`](https://github.com/RayLabsHQ/gitea-mirror/commit/e9fda64b16cd9568f05270730ec54543b55eb9ad) chore: bump better-auth to 1.6.11
### 📊 Changes
**2 files changed** (+31 additions, -47 deletions)
<details>
<summary>View changed files</summary>
📝 `bun.lock` (+29 -45)
📝 `package.json` (+2 -2)
</details>
### 📄 Description
## Summary
Bumps `better-auth` and `@better-auth/sso` from **1.5.5 → 1.6.11**.
Prep work for an upcoming header-auth bridge fix (follow-up to #29). Doing the bump first as its own PR so the next change lands on a clean, current version of Better Auth — and so any regression from the bump itself surfaces in isolation.
## What's in the 1.5 → 1.6 window
Reviewed the changelog against this codebase. Nothing requires code changes; flagging the items worth knowing:
- **`freshAge` semantics changed** — now aligned with session `createdAt` instead of `updatedAt`. Sensitive operations may demand re-auth sooner. We don't gate anything on session freshness, so no impact here.
- **1.6.2: OAuth state CSRF verification** — applies to OIDC/SAML callback flows via `@better-auth/sso`. No code change needed.
- **1.6.0: Account cookie compared by provider accountId, not internal id** — only relevant to account-linking flows; we don't customize these.
- **1.6.0: TwoFactor table gets `verified` column, default true** — no migration needed; we don't use 2FA.
- **1.6.0: `oidc-provider` plugin deprecated** in favor of `@better-auth/oauth-provider`. We still import `oidcProvider` from `better-auth/plugins`; it works in 1.6.x and emits a deprecation warning. Migrating is a separate cleanup, not blocking.
- **1.5: API Key plugin moved to `@better-auth/api-key`** — confirmed we don't import it from the main package.
## Test plan
- [x] `bun test` — 270 pass, 4 skip, 0 fail. Includes `auth-guards.test.ts`, `auth-origins.test.ts`, and other Better Auth-touching tests.
- [ ] CI runs `astro check` + Docker build on this PR — local typecheck/build was not run (known to OOM on this project; CI is the authoritative typecheck).
- [ ] Manual smoke verification deferred to the follow-up header-auth PR, where end-to-end auth behavior gets exercised in a browser.
## Why a standalone PR
The follow-up header-auth fix needs to touch the middleware + add a small plugin that uses `internalAdapter.createSession` and `setSessionCookie`. Landing this bump separately means:
- Any regression from the dep bump is isolated and easy to revert.
- The header-auth PR can be reviewed purely on its own logic, against the same Better Auth version that ships to users.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/RayLabsHQ/gitea-mirror/pull/301
Author: @arunavo4
Created: 5/27/2026
Status: ✅ Merged
Merged: 5/27/2026
Merged by: @arunavo4
Base:
main← Head:chore/bump-better-auth-1.6.11📝 Commits (1)
e9fda64chore: bump better-auth to 1.6.11📊 Changes
2 files changed (+31 additions, -47 deletions)
View changed files
📝
bun.lock(+29 -45)📝
package.json(+2 -2)📄 Description
Summary
Bumps
better-authand@better-auth/ssofrom 1.5.5 → 1.6.11.Prep work for an upcoming header-auth bridge fix (follow-up to #29). Doing the bump first as its own PR so the next change lands on a clean, current version of Better Auth — and so any regression from the bump itself surfaces in isolation.
What's in the 1.5 → 1.6 window
Reviewed the changelog against this codebase. Nothing requires code changes; flagging the items worth knowing:
freshAgesemantics changed — now aligned with sessioncreatedAtinstead ofupdatedAt. Sensitive operations may demand re-auth sooner. We don't gate anything on session freshness, so no impact here.@better-auth/sso. No code change needed.verifiedcolumn, default true — no migration needed; we don't use 2FA.oidc-providerplugin deprecated in favor of@better-auth/oauth-provider. We still importoidcProviderfrombetter-auth/plugins; it works in 1.6.x and emits a deprecation warning. Migrating is a separate cleanup, not blocking.@better-auth/api-key— confirmed we don't import it from the main package.Test plan
bun test— 270 pass, 4 skip, 0 fail. Includesauth-guards.test.ts,auth-origins.test.ts, and other Better Auth-touching tests.astro check+ Docker build on this PR — local typecheck/build was not run (known to OOM on this project; CI is the authoritative typecheck).Why a standalone PR
The follow-up header-auth fix needs to touch the middleware + add a small plugin that uses
internalAdapter.createSessionandsetSessionCookie. Landing this bump separately means:🤖 Generated with Claude Code
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.