#100865bd5e1c Thanks @gustavovalverde! - Refresh-token rotation and token revocation, two-factor backup-code regeneration, device-code claiming, and organization invitation acceptance now work on Prisma. Concurrent or repeat requests in these flows could previously return an error on Prisma instead of the expected result.
On MongoDB servers older than 5.0, these flows and other guarded value updates (rate-limit window resets, API-key refills) no longer fail with an empty-update error.
@better-auth/core: incrementOne now reports a clear error when called with no increment and no set.
Added support for server-side accountInfo calls with an optional userId parameter, allowing trusted callers to read provider profiles without constructing session headers (#9813)
Bug Fixes
Clarified that viewBackupCodes is a server-only function not accessible via HTTP in its API documentation (#9822)
Fixed Google One Tap authenticating the wrong user when the presented Google account is already linked to a different local user, by resolving identity through the shared OAuth path
Fixed storeStateStrategy defaulting to "cookie" instead of "database" when only secondaryStorage is configured, preventing oversized-cookie errors on platforms like AWS Lambda (#9591)
Fixed updateUserInfoOnLink not being applied when linking accounts through the standard OAuth redirect flow (#8758)
Fixed oidc-provider and mcp plugins accepting invalid redirect_uri schemes such as javascript: and data: (#9838)
Fixed organization logo not accepting null, preventing users from clearing an existing logo on create and update (#9842)
auth.api.accountInfo now accepts an optional userId, so a trusted server-side caller can read a user's provider profile without constructing session headers. This mirrors getAccessToken and refreshToken. HTTP callers still require a valid session, and a session always takes precedence over a supplied userId.
The shared "resolve the target user, then fetch a valid access token" logic behind these three endpoints now lives in one place. As part of that, a server-side call that supplies neither a session nor a userId reports USER_ID_OR_SESSION_REQUIRED (400) consistently, rather than UNAUTHORIZED on some endpoints.
#95915f282bd Thanks @Vishesh-Verma-07! - When only secondaryStorage is configured (no primary database), storeStateStrategy now defaults to "database" instead of "cookie", preventing oversized-cookie errors on platforms like AWS Lambda. The account cookie that holds OAuth tokens in database-less setups stays enabled, so getAccessToken keeps working.
Remove findAccount(accountId). It looked accounts up by account ID alone, which is unique neither across providers nor across users, so it returned a non-deterministic match. All callers now use a user-scoped or provider-scoped lookup.
Replace the ambiguous deleteSessions(string | string[]) with two explicit methods. deleteUserSessions(userId) revokes every session for a user, and deleteSessions(tokens) revokes sessions by token. The old single-string overload silently treated its argument as a user ID, so a caller that meant to delete one session token could instead wipe all of a user's sessions or quietly match nothing.
#981843c08a2 Thanks @gustavovalverde! - Fix Google One Tap signing in the wrong user when the presented Google account is already linked to someone else. One Tap now resolves identity through the shared OAuth path, so the user who owns the Google subject is signed in, matching the redirect and signIn.social flows. Previously it matched a local user by the token's email and used the subject only to decide linking, so a Google credential owned by one user could authenticate a different user who happened to share that email.
/account-info now resolves the account from the signed-in user's own linked accounts and accepts an optional providerId to disambiguate when two providers issue the same account ID. A colliding account ID returns a distinct AMBIGUOUS_ACCOUNT error instead of a misleading "not found", and an account with no configured social provider returns a 400 rather than a 500.
#9838be32012 Thanks @gustavovalverde! - Validate the scheme of OAuth redirect_uris in the oidc-provider and mcp plugins.
Both plugins previously accepted any string as a redirect_uri at registration. They now reject the javascript:, data:, and vbscript: schemes, which are never valid OAuth redirect targets. The @better-auth/oauth-provider package already applied this check, so this change brings the two older plugins in line with it.
The redirect-URI scheme policy now lives in @better-auth/core as a single SafeUrlSchema and an isSafeUrlScheme helper, and the OAuth provider plugins share that one implementation. The client navigation helpers (redirectPlugin, one-tap, and two-factor) also skip navigation when the target uses one of these schemes.
The change is non-breaking. The http, https, loopback, and custom application schemes still register unchanged. Both oidc-provider and mcp are on the migration path to @better-auth/oauth-provider, which remains the route to its stricter HTTPS-or-loopback policy.
#984287c1a0c Thanks @bytaesu! - You can now clear an organization's logo by passing logo: null to createOrganization and updateOrganization. Previously only a string was accepted, so an existing logo could not be removed.
#98229c8ded6 Thanks @gustavovalverde! - Document viewBackupCodes as a server-only function so its API comment no longer reads like an HTTP route.
The JSDoc above auth.api.viewBackupCodes advertised POST /two-factor/view-backup-codes, but the endpoint is server-only: it is not registered on the HTTP router and has no client method. The comment now states that it is callable only from trusted server code and that the userId should come from an authenticated session.
#875823d7cbf Thanks @bytaesu! - Apply accountLinking.updateUserInfoOnLink across every OAuth link flow.
Enabling updateUserInfoOnLink only synced the user's profile when linking through a direct ID token. Linking through the standard OAuth redirect (linkSocial, the generic OAuth oauth2.link endpoint, and implicit linking on social sign-in) ignored the option, so the name and image never changed. Every link path now honors it.
The synced fields match the sign-up path: name, image, and any fields your mapProfileToUser adds. The local email and emailVerified are never changed on a link, so linking a provider cannot rebind the account's identity.
Implicit linking on social sign-in also returned the pre-update user, so the freshly issued session served stale profile data from its cookie cache until the cache expired. The new session now carries the updated profile.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/RayLabsHQ/gitea-mirror/pull/341
**Author:** [@dependabot[bot]](https://github.com/apps/dependabot)
**Created:** 7/10/2026
**Status:** 🔄 Open
**Base:** `main` ← **Head:** `dependabot/npm_and_yarn/npm_and_yarn-bb76458d54`
---
### 📝 Commits (1)
- [`25f706a`](https://github.com/RayLabsHQ/gitea-mirror/commit/25f706a72338a2bc34ae764dce0158f8aee737a7) build(deps): bump the npm_and_yarn group across 1 directory with 2 updates
### 📊 Changes
**1 file changed** (+2 additions, -2 deletions)
<details>
<summary>View changed files</summary>
📝 `package.json` (+2 -2)
</details>
### 📄 Description
Bumps the npm_and_yarn group with 2 updates in the / directory: [@better-auth/oauth-provider](https://github.com/better-auth/better-auth/tree/HEAD/packages/oauth-provider) and [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth).
Updates `@better-auth/oauth-provider` from 1.6.11 to 1.6.23
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/better-auth/better-auth/releases">@better-auth/oauth-provider's releases</a>.</em></p>
<blockquote>
<h2>v1.6.23</h2>
<h2><code>better-auth</code></h2>
<h3>Features</h3>
<ul>
<li>Added Yandex as a social OAuth provider (<a href="https://redirect.github.com/better-auth/better-auth/pull/9138">#9138</a>)</li>
</ul>
<p>For detailed changes, see <a href="https://github.com/better-auth/better-auth/blob/9dfceee14021fc15a2fb93023f39635f25b0b5ba/packages/better-auth/CHANGELOG.md"><code>CHANGELOG</code></a></p>
<h2><code>@better-auth/drizzle-adapter</code></h2>
<h3>Bug Fixes</h3>
<ul>
<li>Fixed affected row counting for D1 and postgres-js adapters (<a href="https://redirect.github.com/better-auth/better-auth/pull/10257">#10257</a>)</li>
</ul>
<p>For detailed changes, see <a href="https://github.com/better-auth/better-auth/blob/9dfceee14021fc15a2fb93023f39635f25b0b5ba/packages/drizzle-adapter/CHANGELOG.md"><code>CHANGELOG</code></a></p>
<h2><code>@better-auth/stripe</code></h2>
<h3>Bug Fixes</h3>
<ul>
<li>Fixed organization subscription actions (cancel, upgrade, restore, and the billing portal) that could act on the wrong organization.</li>
</ul>
<p>For detailed changes, see <a href="https://github.com/better-auth/better-auth/blob/9dfceee14021fc15a2fb93023f39635f25b0b5ba/packages/stripe/CHANGELOG.md"><code>CHANGELOG</code></a></p>
<h2><code>auth</code></h2>
<h3>Bug Fixes</h3>
<ul>
<li>Fixed string default values not being properly escaped in the generated Drizzle schema (<a href="https://redirect.github.com/better-auth/better-auth/pull/10259">#10259</a>)</li>
</ul>
<p>For detailed changes, see <a href="https://github.com/better-auth/better-auth/blob/9dfceee14021fc15a2fb93023f39635f25b0b5ba/packages/cli/CHANGELOG.md"><code>CHANGELOG</code></a></p>
<h2>Contributors</h2>
<p>Thanks to everyone who contributed to this release:</p>
<p><a href="https://github.com/bytaesu"><code>@bytaesu</code></a>, <a href="https://github.com/vladflotsky"><code>@vladflotsky</code></a></p>
<p><strong>Full changelog:</strong> <a href="https://github.com/better-auth/better-auth/compare/v1.6.22...v1.6.23"><code>v1.6.22...v1.6.23</code></a></p>
<h2>v1.6.22</h2>
<h2><code>better-auth</code></h2>
<h3>Bug Fixes</h3>
<ul>
<li>Fixed unproven credentials not being revoked during magic link and email OTP sign-in (<a href="https://redirect.github.com/better-auth/better-auth/pull/10239">#10239</a>)</li>
<li>Fixed server-side OAuth requests to refuse redirect responses instead of following them (<a href="https://redirect.github.com/better-auth/better-auth/pull/10241">#10241</a>)</li>
</ul>
<p>For detailed changes, see <a href="https://github.com/better-auth/better-auth/blob/a90d061de7cdbd60e796230aadf5d1082add1fe2/packages/better-auth/CHANGELOG.md"><code>CHANGELOG</code></a></p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/better-auth/better-auth/blob/main/packages/oauth-provider/CHANGELOG.md">@better-auth/oauth-provider's changelog</a>.</em></p>
<blockquote>
<h2>1.6.23</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a href="https://github.com/better-auth/better-auth/commit/8581f97ea0000e03edd6aa7911efabf694a9ff95"><code>8581f97</code></a>]:
<ul>
<li>better-auth@1.6.23</li>
<li><code>@better-auth/core</code><a href="https://github.com/1"><code>@1</code></a>.6.23</li>
</ul>
</li>
</ul>
<h2>1.6.22</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a href="https://github.com/better-auth/better-auth/commit/c06a56d83a40bbaeac12d3a8b8b67e59f92a9110"><code>c06a56d</code></a>, <a href="https://github.com/better-auth/better-auth/commit/8bd43d9d8312fd9ddbfb8fb5c827cf0a0e55132d"><code>8bd43d9</code></a>, <a href="https://github.com/better-auth/better-auth/commit/3a035e968e27bfdee1e53ad857e5569090d9f2d1"><code>3a035e9</code></a>]:
<ul>
<li>better-auth@1.6.22</li>
<li><code>@better-auth/core</code><a href="https://github.com/1"><code>@1</code></a>.6.22</li>
</ul>
</li>
</ul>
<h2>1.6.21</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a href="https://github.com/better-auth/better-auth/commit/e0762a127ce351a96614e60866b3455e6eddffa1"><code>e0762a1</code></a>, <a href="https://github.com/better-auth/better-auth/commit/882cf9e592d1d305b5b78cadbb10aaeee7acd6dc"><code>882cf9e</code></a>, <a href="https://github.com/better-auth/better-auth/commit/f52e1ab50b60d289b64d6b06f1bff5a4358cdfd0"><code>f52e1ab</code></a>, <a href="https://github.com/better-auth/better-auth/commit/90d509e0b9f72614170ad7124ae9d3a7a97d7d3a"><code>90d509e</code></a>, <a href="https://github.com/better-auth/better-auth/commit/b5bec193a56cec2f7b71c84d71dacb632f0b96a0"><code>b5bec19</code></a>, <a href="https://github.com/better-auth/better-auth/commit/816d7f92522518e90d437c2a366d75db56690f86"><code>816d7f9</code></a>, <a href="https://github.com/better-auth/better-auth/commit/239bcc836cf39c4fb409a15333be45134f9e9e65"><code>239bcc8</code></a>, <a href="https://github.com/better-auth/better-auth/commit/1bc370aef5c249e82127cb9d35972101087ecde6"><code>1bc370a</code></a>, <a href="https://github.com/better-auth/better-auth/commit/570267cd5e782f018933ce3af4f51dbd250bf7de"><code>570267c</code></a>, <a href="https://github.com/better-auth/better-auth/commit/461ca6fd2453a2e145fa18a1df543e435e884701"><code>461ca6f</code></a>, <a href="https://github.com/better-auth/better-auth/commit/88409b0078c2bfddcc6503031fff333bfa045cd2"><code>88409b0</code></a>, <a href="https://github.com/better-auth/better-auth/commit/5953157acf619bcb8233c91952b1e4072202f055"><code>5953157</code></a>, <a href="https://github.com/better-auth/better-auth/commit/b046f9ec112b2cf547efea8dc870a4895602c53b"><code>b046f9e</code></a>, <a href="https://github.com/better-auth/better-auth/commit/ae647b4abe5a4d606c326f1ce0ffa2500b5424d1"><code>ae647b4</code></a>]:
<ul>
<li>better-auth@1.6.21</li>
<li><code>@better-auth/core</code><a href="https://github.com/1"><code>@1</code></a>.6.21</li>
</ul>
</li>
</ul>
<h2>1.6.20</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a href="https://github.com/better-auth/better-auth/commit/21448b1b77681e71e80ae0728d8658c936c18eb8"><code>21448b1</code></a>, <a href="https://github.com/better-auth/better-auth/commit/8ecf23817f5e501bdd8ab63ad5fdf2554ff1dff5"><code>8ecf238</code></a>, <a href="https://github.com/better-auth/better-auth/commit/930f5341d956bf3075f43758392a5c7f50947104"><code>930f534</code></a>]:
<ul>
<li>better-auth@1.6.20</li>
<li><code>@better-auth/core</code><a href="https://github.com/1"><code>@1</code></a>.6.20</li>
</ul>
</li>
</ul>
<h2>1.6.19</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a href="https://redirect.github.com/better-auth/better-auth/pull/10086">#10086</a> <a href="https://github.com/better-auth/better-auth/commit/5bd5e1cc73d2c9c38e69011f03038b61a4312a63"><code>5bd5e1c</code></a> Thanks <a href="https://github.com/gustavovalverde"><code>@gustavovalverde</code></a>! - Refresh-token rotation and token revocation, two-factor backup-code regeneration, device-code claiming, and organization invitation acceptance now work on Prisma. Concurrent or repeat requests in these flows could previously return an error on Prisma instead of the expected result.</p>
<p>On MongoDB servers older than 5.0, these flows and other guarded value updates (rate-limit window resets, API-key refills) no longer fail with an empty-update error.</p>
<p><code>@better-auth/core</code>: <code>incrementOne</code> now reports a clear error when called with no <code>increment</code> and no <code>set</code>.</p>
</li>
<li>
<p>Updated dependencies [<a href="https://github.com/better-auth/better-auth/commit/de4aa52e991f0a56786300af3e0d9ac8331f1996"><code>de4aa52</code></a>, <a href="https://github.com/better-auth/better-auth/commit/b4b02660c760fe4c8889d1311a3dbf3165f88d0b"><code>b4b0266</code></a>, <a href="https://github.com/better-auth/better-auth/commit/5bd5e1cc73d2c9c38e69011f03038b61a4312a63"><code>5bd5e1c</code></a>, <a href="https://github.com/better-auth/better-auth/commit/581f8271fb911cea2ce74810e086709909457cd3"><code>581f827</code></a>, <a href="https://github.com/better-auth/better-auth/commit/840788502a13d6fa4aa4540b930ddb4a99dc1ed6"><code>8407885</code></a>, <a href="https://github.com/better-auth/better-auth/commit/c1a8a64c146fab20c7ad0076ffdf12eff9adc17a"><code>c1a8a64</code></a>, <a href="https://github.com/better-auth/better-auth/commit/635f1908702d0c63cf66b4e5f054e9d527a3c8f7"><code>635f190</code></a>, <a href="https://github.com/better-auth/better-auth/commit/a787e0b66b368a1af0b4ba17c9750c2839668246"><code>a787e0b</code></a>, <a href="https://github.com/better-auth/better-auth/commit/c2f718fcdeec0c1767bb8acd5fefdd3810863b0a"><code>c2f718f</code></a>, <a href="https://github.com/better-auth/better-auth/commit/7d18175637a0b95a501fde0cf3db080879367a9d"><code>7d18175</code></a>]:</p>
<ul>
<li>better-auth@1.6.19</li>
<li><code>@better-auth/core</code><a href="https://github.com/1"><code>@1</code></a>.6.19</li>
</ul>
</li>
</ul>
<h2>1.6.18</h2>
<h3>Patch Changes</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/better-auth/better-auth/commit/9dfceee14021fc15a2fb93023f39635f25b0b5ba"><code>9dfceee</code></a> chore: release v1.6.23 (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/oauth-provider/issues/10260">#10260</a>)</li>
<li><a href="https://github.com/better-auth/better-auth/commit/a90d061de7cdbd60e796230aadf5d1082add1fe2"><code>a90d061</code></a> chore: release v1.6.22 (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/oauth-provider/issues/10245">#10245</a>)</li>
<li><a href="https://github.com/better-auth/better-auth/commit/414169d95a88a6e1fac41688bc7011e96feb0d2a"><code>414169d</code></a> chore: release v1.6.21 (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/oauth-provider/issues/10184">#10184</a>)</li>
<li><a href="https://github.com/better-auth/better-auth/commit/c342f42fff46043b5e195f7f757b0f2c1043414c"><code>c342f42</code></a> chore: release v1.6.20 (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/oauth-provider/issues/10108">#10108</a>)</li>
<li><a href="https://github.com/better-auth/better-auth/commit/ac4d81df748b8c09e584fdd6c440f8f327490fd1"><code>ac4d81d</code></a> chore: release v1.6.19 (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/oauth-provider/issues/10034">#10034</a>)</li>
<li><a href="https://github.com/better-auth/better-auth/commit/5bd5e1cc73d2c9c38e69011f03038b61a4312a63"><code>5bd5e1c</code></a> fix: make guarded state transitions portable on Prisma (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/oauth-provider/issues/10086">#10086</a>)</li>
<li><a href="https://github.com/better-auth/better-auth/commit/04debbff04c2091c52b6b694df9081af2be50681"><code>04debbf</code></a> chore: release v1.6.18 (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/oauth-provider/issues/10026">#10026</a>)</li>
<li><a href="https://github.com/better-auth/better-auth/commit/729fd84034d547f37bb8c1c5b8958280c5bdb487"><code>729fd84</code></a> fix(oauth-provider): canonicalize signed OAuth query params (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/oauth-provider/issues/9941">#9941</a>)</li>
<li><a href="https://github.com/better-auth/better-auth/commit/0d8b238acc13da34d6769bb413d407b1356703fc"><code>0d8b238</code></a> chore: release v1.6.17 (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/oauth-provider/issues/9984">#9984</a>)</li>
<li><a href="https://github.com/better-auth/better-auth/commit/73432841493a2d99144786c986ee57c071d816d8"><code>7343284</code></a> fix: jwks caching, oauth id mapping, team invitations, account cookie, and sc...</li>
<li>Additional commits viewable in <a href="https://github.com/better-auth/better-auth/commits/v1.6.23/packages/oauth-provider">compare view</a></li>
</ul>
</details>
<br />
Updates `better-auth` from 1.6.11 to 1.6.13
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/better-auth/better-auth/releases">better-auth's releases</a>.</em></p>
<blockquote>
<h2>v1.6.13</h2>
<h2><code>better-auth</code></h2>
<h3>Features</h3>
<ul>
<li>Added support for server-side <code>accountInfo</code> calls with an optional <code>userId</code> parameter, allowing trusted callers to read provider profiles without constructing session headers (<a href="https://redirect.github.com/better-auth/better-auth/pull/9813">#9813</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>Clarified that <code>viewBackupCodes</code> is a server-only function not accessible via HTTP in its API documentation (<a href="https://redirect.github.com/better-auth/better-auth/pull/9822">#9822</a>)</li>
<li>Fixed Google One Tap authenticating the wrong user when the presented Google account is already linked to a different local user, by resolving identity through the shared OAuth path</li>
<li>Fixed <code>storeStateStrategy</code> defaulting to <code>"cookie"</code> instead of <code>"database"</code> when only <code>secondaryStorage</code> is configured, preventing oversized-cookie errors on platforms like AWS Lambda (<a href="https://redirect.github.com/better-auth/better-auth/pull/9591">#9591</a>)</li>
<li>Fixed <code>updateUserInfoOnLink</code> not being applied when linking accounts through the standard OAuth redirect flow (<a href="https://redirect.github.com/better-auth/better-auth/pull/8758">#8758</a>)</li>
<li>Fixed <code>oidc-provider</code> and <code>mcp</code> plugins accepting invalid <code>redirect_uri</code> schemes such as <code>javascript:</code> and <code>data:</code> (<a href="https://redirect.github.com/better-auth/better-auth/pull/9838">#9838</a>)</li>
<li>Fixed organization <code>logo</code> not accepting <code>null</code>, preventing users from clearing an existing logo on create and update (<a href="https://redirect.github.com/better-auth/better-auth/pull/9842">#9842</a>)</li>
</ul>
<p>For detailed changes, see <a href="https://github.com/better-auth/better-auth/blob/a6f38c72ee3423ae80b0595fec3b4a61158c374d/packages/better-auth/CHANGELOG.md"><code>CHANGELOG</code></a></p>
<h2><code>@better-auth/sso</code></h2>
<h3>Bug Fixes</h3>
<ul>
<li>Fixed SAML Single Logout leaving the user signed in due to session deletion matching on row ID instead of session token</li>
<li>Fixed ambiguous <code>internalAdapter</code> helper methods that could silently match the wrong account or wipe all sessions for a user (<a href="https://redirect.github.com/better-auth/better-auth/pull/9818">#9818</a>)</li>
<li>Fixed a high-severity XML injection vulnerability in signed SAML assertions by updating <code>samlify</code> to 2.13.1 (GHSA-34r5-q4jw-r36m) (<a href="https://redirect.github.com/better-auth/better-auth/pull/9821">#9821</a>)</li>
</ul>
<p>For detailed changes, see <a href="https://github.com/better-auth/better-auth/blob/a6f38c72ee3423ae80b0595fec3b4a61158c374d/packages/sso/CHANGELOG.md"><code>CHANGELOG</code></a></p>
<h2><code>@better-auth/api-key</code></h2>
<h3>Bug Fixes</h3>
<ul>
<li>Fixed <code>verifyApiKey</code> rejecting keys created under a non-default <code>configId</code> when the request omitted <code>configId</code> (<a href="https://redirect.github.com/better-auth/better-auth/pull/9794">#9794</a>)</li>
</ul>
<p>For detailed changes, see <a href="https://github.com/better-auth/better-auth/blob/a6f38c72ee3423ae80b0595fec3b4a61158c374d/packages/api-key/CHANGELOG.md"><code>CHANGELOG</code></a></p>
<h2><code>@better-auth/core</code></h2>
<h3>Bug Fixes</h3>
<ul>
<li>Fixed a silent failure in <code>consumeOne</code> when an adapter's <code>deleteMany</code> returned a non-numeric value, now surfacing a clear error (<a href="https://redirect.github.com/better-auth/better-auth/pull/9831">#9831</a>)</li>
</ul>
<p>For detailed changes, see <a href="https://github.com/better-auth/better-auth/blob/a6f38c72ee3423ae80b0595fec3b4a61158c374d/packages/core/CHANGELOG.md"><code>CHANGELOG</code></a></p>
<h2><code>@better-auth/expo</code></h2>
<h3>Bug Fixes</h3>
<ul>
<li>Fixed sign-in being lost on Expo when a provider issues large tokens, by splitting oversized account cookies across multiple storage keys (<a href="https://redirect.github.com/better-auth/better-auth/pull/9815">#9815</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md">better-auth's changelog</a>.</em></p>
<blockquote>
<h2>1.6.13</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a href="https://redirect.github.com/better-auth/better-auth/pull/9813">#9813</a> <a href="https://github.com/better-auth/better-auth/commit/d3919dc1a560625d8f09161d64701e257452940f"><code>d3919dc</code></a> Thanks <a href="https://github.com/gustavovalverde"><code>@gustavovalverde</code></a>! - Support server-side <code>accountInfo</code> calls without session headers.</p>
<p><code>auth.api.accountInfo</code> now accepts an optional <code>userId</code>, so a trusted server-side caller can read a user's provider profile without constructing session headers. This mirrors <code>getAccessToken</code> and <code>refreshToken</code>. HTTP callers still require a valid session, and a session always takes precedence over a supplied <code>userId</code>.</p>
<p>The shared "resolve the target user, then fetch a valid access token" logic behind these three endpoints now lives in one place. As part of that, a server-side call that supplies neither a session nor a <code>userId</code> reports <code>USER_ID_OR_SESSION_REQUIRED</code> (400) consistently, rather than <code>UNAUTHORIZED</code> on some endpoints.</p>
</li>
<li>
<p><a href="https://redirect.github.com/better-auth/better-auth/pull/9591">#9591</a> <a href="https://github.com/better-auth/better-auth/commit/5f282bd382d694f6834b1d0f8f694f737f223811"><code>5f282bd</code></a> Thanks <a href="https://github.com/Vishesh-Verma-07"><code>@Vishesh-Verma-07</code></a>! - When only <code>secondaryStorage</code> is configured (no primary database), <code>storeStateStrategy</code> now defaults to <code>"database"</code> instead of <code>"cookie"</code>, preventing oversized-cookie errors on platforms like AWS Lambda. The account cookie that holds OAuth tokens in database-less setups stays enabled, so <code>getAccessToken</code> keeps working.</p>
</li>
<li>
<p><a href="https://redirect.github.com/better-auth/better-auth/pull/9818">#9818</a> <a href="https://github.com/better-auth/better-auth/commit/43c08a2bc77eb01d59ecac28379d5971af6beddc"><code>43c08a2</code></a> Thanks <a href="https://github.com/gustavovalverde"><code>@gustavovalverde</code></a>! - Fix two buggy <code>internalAdapter</code> helpers.</p>
<p>Remove <code>findAccount(accountId)</code>. It looked accounts up by account ID alone, which is unique neither across providers nor across users, so it returned a non-deterministic match. All callers now use a user-scoped or provider-scoped lookup.</p>
<p>Replace the ambiguous <code>deleteSessions(string | string[])</code> with two explicit methods. <code>deleteUserSessions(userId)</code> revokes every session for a user, and <code>deleteSessions(tokens)</code> revokes sessions by token. The old single-string overload silently treated its argument as a user ID, so a caller that meant to delete one session token could instead wipe all of a user's sessions or quietly match nothing.</p>
</li>
<li>
<p><a href="https://redirect.github.com/better-auth/better-auth/pull/9818">#9818</a> <a href="https://github.com/better-auth/better-auth/commit/43c08a2bc77eb01d59ecac28379d5971af6beddc"><code>43c08a2</code></a> Thanks <a href="https://github.com/gustavovalverde"><code>@gustavovalverde</code></a>! - Fix Google One Tap signing in the wrong user when the presented Google account is already linked to someone else. One Tap now resolves identity through the shared OAuth path, so the user who owns the Google subject is signed in, matching the redirect and <code>signIn.social</code> flows. Previously it matched a local user by the token's email and used the subject only to decide linking, so a Google credential owned by one user could authenticate a different user who happened to share that email.</p>
<p><code>/account-info</code> now resolves the account from the signed-in user's own linked accounts and accepts an optional <code>providerId</code> to disambiguate when two providers issue the same account ID. A colliding account ID returns a distinct <code>AMBIGUOUS_ACCOUNT</code> error instead of a misleading "not found", and an account with no configured social provider returns a 400 rather than a 500.</p>
</li>
<li>
<p><a href="https://redirect.github.com/better-auth/better-auth/pull/9838">#9838</a> <a href="https://github.com/better-auth/better-auth/commit/be32012ca3507a62371d1baa09cdacd5123a99bf"><code>be32012</code></a> Thanks <a href="https://github.com/gustavovalverde"><code>@gustavovalverde</code></a>! - Validate the scheme of OAuth <code>redirect_uris</code> in the <code>oidc-provider</code> and <code>mcp</code> plugins.</p>
<p>Both plugins previously accepted any string as a <code>redirect_uri</code> at registration. They now reject the <code>javascript:</code>, <code>data:</code>, and <code>vbscript:</code> schemes, which are never valid OAuth redirect targets. The <code>@better-auth/oauth-provider</code> package already applied this check, so this change brings the two older plugins in line with it.</p>
<p>The redirect-URI scheme policy now lives in <code>@better-auth/core</code> as a single <code>SafeUrlSchema</code> and an <code>isSafeUrlScheme</code> helper, and the OAuth provider plugins share that one implementation. The client navigation helpers (<code>redirectPlugin</code>, one-tap, and two-factor) also skip navigation when the target uses one of these schemes.</p>
<p>The change is non-breaking. The <code>http</code>, <code>https</code>, loopback, and custom application schemes still register unchanged. Both <code>oidc-provider</code> and <code>mcp</code> are on the migration path to <code>@better-auth/oauth-provider</code>, which remains the route to its stricter HTTPS-or-loopback policy.</p>
</li>
<li>
<p><a href="https://redirect.github.com/better-auth/better-auth/pull/9842">#9842</a> <a href="https://github.com/better-auth/better-auth/commit/87c1a0cab274b574592922ccc2454b0bd510a81f"><code>87c1a0c</code></a> Thanks <a href="https://github.com/bytaesu"><code>@bytaesu</code></a>! - You can now clear an organization's logo by passing <code>logo: null</code> to <code>createOrganization</code> and <code>updateOrganization</code>. Previously only a string was accepted, so an existing logo could not be removed.</p>
</li>
<li>
<p><a href="https://redirect.github.com/better-auth/better-auth/pull/9822">#9822</a> <a href="https://github.com/better-auth/better-auth/commit/9c8ded67b192997b6c02150c3423bbc99d9bdb6b"><code>9c8ded6</code></a> Thanks <a href="https://github.com/gustavovalverde"><code>@gustavovalverde</code></a>! - Document <code>viewBackupCodes</code> as a server-only function so its API comment no longer reads like an HTTP route.</p>
<p>The JSDoc above <code>auth.api.viewBackupCodes</code> advertised <code>POST /two-factor/view-backup-codes</code>, but the endpoint is server-only: it is not registered on the HTTP router and has no client method. The comment now states that it is callable only from trusted server code and that the <code>userId</code> should come from an authenticated session.</p>
</li>
<li>
<p><a href="https://redirect.github.com/better-auth/better-auth/pull/8758">#8758</a> <a href="https://github.com/better-auth/better-auth/commit/23d7cbfa793ca69b733f98334bd12962cad61646"><code>23d7cbf</code></a> Thanks <a href="https://github.com/bytaesu"><code>@bytaesu</code></a>! - Apply <code>accountLinking.updateUserInfoOnLink</code> across every OAuth link flow.</p>
<p>Enabling <code>updateUserInfoOnLink</code> only synced the user's profile when linking through a direct ID token. Linking through the standard OAuth redirect (<code>linkSocial</code>, the generic OAuth <code>oauth2.link</code> endpoint, and implicit linking on social sign-in) ignored the option, so the name and image never changed. Every link path now honors it.</p>
<p>The synced fields match the sign-up path: <code>name</code>, <code>image</code>, and any fields your <code>mapProfileToUser</code> adds. The local <code>email</code> and <code>emailVerified</code> are never changed on a link, so linking a provider cannot rebind the account's identity.</p>
<p>Implicit linking on social sign-in also returned the pre-update user, so the freshly issued session served stale profile data from its cookie cache until the cache expired. The new session now carries the updated profile.</p>
</li>
<li>
<p>Updated dependencies [<a href="https://github.com/better-auth/better-auth/commit/43c08a2bc77eb01d59ecac28379d5971af6beddc"><code>43c08a2</code></a>, <a href="https://github.com/better-auth/better-auth/commit/5c3e248cbf4f81c2cb540b545baa4a5e69d3b066"><code>5c3e248</code></a>]:</p>
<ul>
<li><code>@better-auth/core</code><a href="https://github.com/1"><code>@1</code></a>.6.13</li>
<li><code>@better-auth/drizzle-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.13</li>
<li><code>@better-auth/kysely-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.13</li>
<li><code>@better-auth/memory-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.13</li>
<li><code>@better-auth/mongo-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.13</li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/better-auth/better-auth/commit/a6f38c72ee3423ae80b0595fec3b4a61158c374d"><code>a6f38c7</code></a> chore: release v1.6.13 (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/9804">#9804</a>)</li>
<li><a href="https://github.com/better-auth/better-auth/commit/87c1a0cab274b574592922ccc2454b0bd510a81f"><code>87c1a0c</code></a> fix(organization): allow null logo on create and update (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/9842">#9842</a>)</li>
<li><a href="https://github.com/better-auth/better-auth/commit/be32012ca3507a62371d1baa09cdacd5123a99bf"><code>be32012</code></a> fix(oauth): validate redirect_uri schemes in oidc-provider and mcp (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/9838">#9838</a>)</li>
<li><a href="https://github.com/better-auth/better-auth/commit/9c8ded67b192997b6c02150c3423bbc99d9bdb6b"><code>9c8ded6</code></a> docs(two-factor): mark <code>viewBackupCodes</code> as server-only in its API comment (#...</li>
<li><a href="https://github.com/better-auth/better-auth/commit/43c08a2bc77eb01d59ecac28379d5971af6beddc"><code>43c08a2</code></a> fix(account): scope OAuth account identity and fix buggy internalAdapter help...</li>
<li><a href="https://github.com/better-auth/better-auth/commit/23d7cbfa793ca69b733f98334bd12962cad61646"><code>23d7cbf</code></a> fix(oauth): apply <code>updateUserInfoOnLink</code> in OAuth callback link flow (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/8758">#8758</a>)</li>
<li><a href="https://github.com/better-auth/better-auth/commit/d3919dc1a560625d8f09161d64701e257452940f"><code>d3919dc</code></a> feat(account): support server-side <code>accountInfo</code> calls without session header...</li>
<li><a href="https://github.com/better-auth/better-auth/commit/5f282bd382d694f6834b1d0f8f694f737f223811"><code>5f282bd</code></a> fix(account): default <code>storeStateStrategy</code> to "database" when using `secondar...</li>
<li><a href="https://github.com/better-auth/better-auth/commit/c0c574ea50cfb3b9350f666590ad9747bb39ad6f"><code>c0c574e</code></a> chore: release v1.6.12 (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/9590">#9590</a>)</li>
<li><a href="https://github.com/better-auth/better-auth/commit/c5b9f93498489888f543e1aa1fc07aae26f73a7f"><code>c5b9f93</code></a> fix(generic-oauth): add <code>accessTokenExpiresIn</code> for providers that omit `expir...</li>
<li>Additional commits viewable in <a href="https://github.com/better-auth/better-auth/commits/better-auth@1.6.13/packages/better-auth">compare view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/RayLabsHQ/gitea-mirror/network/alerts).
</details>
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/RayLabsHQ/gitea-mirror/pull/341
Author: @dependabot[bot]
Created: 7/10/2026
Status: 🔄 Open
Base:
main← Head:dependabot/npm_and_yarn/npm_and_yarn-bb76458d54📝 Commits (1)
25f706abuild(deps): bump the npm_and_yarn group across 1 directory with 2 updates📊 Changes
1 file changed (+2 additions, -2 deletions)
View changed files
📝
package.json(+2 -2)📄 Description
Bumps the npm_and_yarn group with 2 updates in the / directory: @better-auth/oauth-provider and better-auth.
Updates
@better-auth/oauth-providerfrom 1.6.11 to 1.6.23Release notes
Sourced from @better-auth/oauth-provider's releases.
... (truncated)
Changelog
Sourced from @better-auth/oauth-provider's changelog.
... (truncated)
Commits
9dfceeechore: release v1.6.23 (#10260)a90d061chore: release v1.6.22 (#10245)414169dchore: release v1.6.21 (#10184)c342f42chore: release v1.6.20 (#10108)ac4d81dchore: release v1.6.19 (#10034)5bd5e1cfix: make guarded state transitions portable on Prisma (#10086)04debbfchore: release v1.6.18 (#10026)729fd84fix(oauth-provider): canonicalize signed OAuth query params (#9941)0d8b238chore: release v1.6.17 (#9984)7343284fix: jwks caching, oauth id mapping, team invitations, account cookie, and sc...Updates
better-authfrom 1.6.11 to 1.6.13Release notes
Sourced from better-auth's releases.
... (truncated)
Changelog
Sourced from better-auth's changelog.
... (truncated)
Commits
a6f38c7chore: release v1.6.13 (#9804)87c1a0cfix(organization): allow null logo on create and update (#9842)be32012fix(oauth): validate redirect_uri schemes in oidc-provider and mcp (#9838)9c8ded6docs(two-factor): markviewBackupCodesas server-only in its API comment (#...43c08a2fix(account): scope OAuth account identity and fix buggy internalAdapter help...23d7cbffix(oauth): applyupdateUserInfoOnLinkin OAuth callback link flow (#8758)d3919dcfeat(account): support server-sideaccountInfocalls without session header...5f282bdfix(account): defaultstoreStateStrategyto "database" when using `secondar...c0c574echore: release v1.6.12 (#9590)c5b9f93fix(generic-oauth): addaccessTokenExpiresInfor providers that omit `expir...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.