Skip to content

chore(deps): update dependency better-auth to v1.6.29 - #284

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/better-auth-group
Open

chore(deps): update dependency better-auth to v1.6.29#284
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/better-auth-group

Conversation

@renovate

@renovate renovate Bot commented Jun 1, 2026 •
edited
Loading

Copy link
Copy Markdown

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
better-auth (source) 1.5.6 → 1.6.29 age confidence

Release Notes

better-auth/better-auth (better-auth)

v1.6.29

Compare Source

Patch Changes

v1.6.28

Compare Source

Patch Changes

v1.6.27

Compare Source

Patch Changes

v1.6.26

Compare Source

Patch Changes

v1.6.25

Compare Source

Patch Changes

v1.6.24

Compare Source

Patch Changes

  • #​10235 03dc5a0 Thanks @​ping-maxwell! - Fixes silent foreign-key and adapter-join misrouting when a user remaps a built-in model name to a string that collides with another schema key

  • #​10357 7508940 Thanks @​c-nicol! - Fixes Kysely migration generation for new-table fields that are both unique: true and index: true.

  • #​10342 bae7198 Thanks @​ping-maxwell! - Fix organization.listMembers failing with "User not found for member" for orgs with more than ~100 members by applying the same membership limit to the users query.

  • #​10336 ef4d273 Thanks @​Tushar-Khandelwal-2004! - Prevent verification callbacks from failing auth requests when cloning the request throws.

  • #​10333 99dbdd7 Thanks @​c-nicol! - Fixes Drizzle schema generation for fields that are both unique: true and index: true.

  • #​10368 086ca91 Thanks @​gaurav0107! - Force-validate the request Origin on the magic-link (/sign-in/magic-link) and email-otp (/email-otp/send-verification-otp) send endpoints, including cookieless requests, to match the built-in /sign-in/email and /sign-up/email routes. A cookieless cross-origin POST can no longer trigger a magic-link or verification-OTP email to an arbitrary address. Cookieless requests that carry no Origin (server-to-server) are unaffected.

  • #​10290 8f2dedd Thanks @​GautamBytes! - Expose the remote MCP auth client's 401 challenge headers to browser clients using CORS.

  • #​10453 4e685ee Thanks @​ping-maxwell! - OpenAPI now includes user.additionalFields and plugin user schema fields (e.g. username plugin username / displayUsername) on /sign-up/email and /update-user request bodies.

  • #​10190 3bf0e49 Thanks @​gaurav-init! - Pass the endpoint context as the second argument to beforeDeleteOrganization and afterDeleteOrganization hooks in the organization plugin, matching the signature shown in the docs and the existing databaseHooks pattern. The Stripe plugin's beforeDeleteOrganization wrapper now forwards the context to user-supplied hooks instead of dropping it.

  • #​10040 f59a0ee Thanks @​shiminshen! - Organization invitations now let the database generate their id when ID generation is delegated to the database (e.g. advanced.database.generateId: "uuid" with a UUID-capable adapter such as Postgres), matching every other model. Previously createInvitation always generated the invitation id in application code, so invitation rows received an app-generated value instead of a database-generated one while organizations, members and teams correctly deferred to the database (better-auth/better-auth#10024). A caller-provided id (e.g. via beforeCreateInvitation) is still honored.

  • #​10302 0f2cc1b Thanks @​momomuchu! - Prefer exact schema-key matches over modelName aliases in getDefaultModelName, so remapping a built-in table onto another table's schema key (e.g. user.modelName = "account") does not reroute internal adapter queries to the wrong table.

  • #​9787 ae78109 Thanks @​ping-maxwell! - Fixes an issue where useSession({ throw: true }) incorrectly excluded null from its data type.

  • #​10222 46d2bf0 Thanks @​ping-maxwell! - fix: add no-store cache-control headers to get-session route

  • #​10316 29a373e Thanks @​vinay-oppuri! - Recognize SQLite BIGINT as a valid number type in migration diffs so database-backed rate limiter columns like lastRequest no longer report spurious pending changes on every run.

  • #​10379 f6d18fa Thanks @​ping-maxwell! - fix(client): restore auth query revalidation and signal listeners after remount

  • #​5753 f23ce50 Thanks @​ping-maxwell! - feat(last-login-method): beforeStoreCookie option for GDPR compliance

  • #​10376 c4d1dda Thanks @​ping-maxwell! - Pass the request endpoint context as a third argument to verifyIdToken, so custom ID token verifiers can read request headers (for example Apple's user-agent requirement).

  • Updated dependencies [6758231, 54fab08, c4d1dda]:

v1.6.23

Compare Source

Patch Changes

v1.6.22

Compare Source

Patch Changes

  • #​10239 c06a56d Thanks @​gustavovalverde! - Magic-link and email-OTP sign-in now reset the credentials on an account whose email had never been confirmed. When verification resolves to such an account, any existing password on it is removed and its sessions are revoked before the user is signed in, so proven control of the mailbox is the source of truth for the account.

    If you signed up with email and password but first signed in through a magic link or email OTP rather than confirming the verification email, your password is cleared and you will need to set a new one through password reset.

  • #​10240 3a035e9 Thanks @​gustavovalverde! - Add account-level lockout for two-factor verification. The attempt limit applies per account across sign-in challenges and across factors: TOTP, email-OTP, and backup codes share one counter, and a successful verification resets it.

    Enabled by default: an account locks for 15 minutes after 10 consecutive failed verifications, and locked attempts return 429 with the ACCOUNT_TEMPORARILY_LOCKED error code. Configure it with twoFactor({ accountLockout: { enabled, maxFailedAttempts, durationSeconds } }).

    Run a database migration after upgrading: this adds failedVerificationCount and lockedUntil columns to the twoFactor table.

  • Updated dependencies [8bd43d9]:

v1.6.21

Compare Source

Patch Changes

  • #​10212 e0762a1 Thanks @​bytaesu! - In root-mounted deployments, requests whose path does not start with the configured basePath now return 404 instead of resolving to an endpoint.

  • #​10187 882cf9e Thanks @​ping-maxwell! - Admin permission changes and bans now take effect immediately for admin APIs, even when session cookie cache is enabled. Sensitive session checks also continue to work in stateless apps where signed cookies are the session record.

  • #​9939 f52e1ab Thanks @​benpsnyder! - fixes a bug causing deviceAuthorization() throwing a ZodError at construction when called without a schema option

  • #​10196 b5bec19 Thanks @​Paola3stefania! - OAuth sign-up and account-link profile sync now ignore provider profile values for user fields marked input: false. Input-allowed additional fields still persist from mapProfileToUser, and schema defaults still apply when OAuth creates a user. Apps that used mapProfileToUser to fill input: false fields should set those fields in server-side provisioning code instead.

  • #​10197 816d7f9 Thanks @​Paola3stefania! - Google sign-in now accepts hd: "*" to allow any Google Workspace hosted domain while still rejecting tokens with no hosted-domain claim.

    Google One Tap now applies the configured Google hosted-domain restriction before creating a session.

  • #​10192 239bcc8 Thanks @​bytaesu! - Validate PayPal user info against the verified ID token subject during social sign-in.

  • #​10228 1bc370a Thanks @​gustavovalverde! - The SIWE plugin no longer binds a provided email that already belongs to another account. With anonymous set to false, /siwe/verify previously created the new account using that email even when it was already in use; it now keeps the wallet-derived address in that case, so one email cannot be attached to two accounts.

  • #​10198 570267c Thanks @​rachit367! - Honor disableMigration on plugin schema tables. Tables flagged with disableMigration: true are now skipped by better-auth generate (Drizzle and Prisma output) and by the runtime migrator, instead of being emitted and created anyway. The flag was previously dropped while assembling the table list, so it had no effect.

  • #​10182 461ca6f Thanks @​bytaesu! - Only store display username fallbacks as usernames when they pass username validation during email sign-up.

  • #​10183 88409b0 Thanks @​bytaesu! - Require OAuth proxy profile callbacks to match an issued OAuth state before creating sessions.

  • #​10203 5953157 Thanks @​bytaesu! - Rate limiting no longer trusts multi-hop X-Forwarded-For chains, preventing a client behind an appending proxy from spoofing the leftmost hop to bypass the per-IP rate limit. Single-value IP headers continue to work. To key the real client behind a proxy chain, set advanced.ipAddress.trustedProxies to your reverse-proxy IPs or CIDR ranges (the chain is walked right to left, skipping trusted hops), or point advanced.ipAddress.ipAddressHeaders at a single trusted client-IP header.

  • #​10191 b046f9e Thanks @​bytaesu! - Rate limit client requests before plugin request handlers run.

  • #​10210 ae647b4 Thanks @​gustavovalverde! - Two-factor verification now locks out after five wrong codes per sign-in challenge for TOTP and backup codes. Once the limit is reached the challenge is rejected with TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE, and a new sign-in is required to try again.

    During a rolling deploy, two-factor challenges issued by the previous version may prompt the user to sign in again; this clears once the deploy completes.

  • Updated dependencies [90d509e, 816d7f9, 570267c, 5953157]:

v1.6.20

Compare Source

Patch Changes

v1.6.19

Compare Source

Patch Changes

  • #​10088 de4aa52 Thanks @​bytaesu! - Session and account cache cookies near the browser's per-cookie size limit (for example with a long cookiePrefix or many cached fields) are now split into chunks instead of being silently dropped by the browser. A cache too large to fit even when chunked is skipped with a warning rather than failing the request, so reads fall back to the database.

  • #​9995 b4b0266 Thanks @​ElGauchooooo! - The device authorization plugin now accepts an optional user_id when issuing a device code via /device/code, pre-binding the code to that user. Only the bound user can approve or deny the code, so a publicly visible user code can no longer be claimed by someone else.

  • #​10086 5bd5e1c Thanks @​gustavovalverde! - Refresh-token rotation and token revocation, two-factor backup-code regeneration, device-code claiming, and organization invitation acceptance now work on Prisma. Concurrent or repeat requests in these flows could previously return an error on Prisma instead of the expected result.

    On MongoDB servers older than 5.0, these flows and other guarded value updates (rate-limit window resets, API-key refills) no longer fail with an empty-update error.

    @better-auth/core: incrementOne now reports a clear error when called with no increment and no set.

  • #​9319 581f827 Thanks @​ping-maxwell! - fix(last-login-method): include domain when clearing cross-subdomain cookies

  • #​10067 8407885 Thanks @​bytaesu! - The oauth-popup plugin now ignores internal OAuth state fields passed through its additionalData parameter, so additionalData only ever carries your own custom values.

  • #​9555 c1a8a64 Thanks @​ChrisMGeo! - Fix invalid OpenAPI output for Better Auth callback, session, and passkey routes so client generators can consume the schema.

  • #​10071 635f190 Thanks @​gustavovalverde! - Auth clients exported from wrapper packages can now be emitted in TypeScript declaration builds without extra type annotations.

  • #​10070 a787e0b Thanks @​gustavovalverde! - Single-use verification flows no longer hang on database adapters that use a one-connection pool. This fixes magic-link verification and similar token checks in connection-limited serverless database setups.

  • #​9348 c2f718f Thanks @​ping-maxwell! - fix: cookie cache fallback lookup

  • #​8863 7d18175 Thanks @​ping-maxwell! - sendVerificationEmail was invoked via runInBackgroundOrAwait, which could defer work when advanced.backgroundTasks.handler is configured (so the handler could return 200 before the email callback finished) and, in the default path, caught and logged errors without rethrowing. User callbacks that throw APIError (e.g. 429 from a rate limiter) were therefore not reliably reflected in the HTTP response (better-auth/better-auth#8757).

    Now we await sendVerificationEmailFn so failures surface to the client with the correct status. The unauthenticated /send-verification-email path enforces a constant-time floor (500 ms) so that the response duration does not reveal whether the email belongs to a real unverified user.

  • Updated dependencies [0895993, 5bd5e1c, a787e0b]:

v1.6.18

Compare Source

Patch Changes

v1.6.17

Compare Source

Patch Changes

  • #​9993 baeaa00 Thanks @​gustavovalverde! - When a team had a single open slot, accepting an invitation into it was wrongly rejected as over the member limit and left a dangling membership record. Two invitations accepted into a nearly-full team at the same time could also push it past its limit. Both are fixed.

  • #​9482 3e99e6c Thanks @​bytaesu! - admin.setUserPassword now creates a credential account when the target user does not have one, matching the behavior of resetPassword. Previously the call returned status: true without doing anything for users without an existing credential account (e.g., social-only or magic-link signups), so admins migrating users from another auth system or assigning an initial password to a social-only user can now do so directly without poking the account table.

  • 96c78c3 Thanks @​GautamBytes! - Downgrade expected auth validation failures from error logs to warnings.

  • #​9993 baeaa00 Thanks @​gustavovalverde! - Captcha provider verification requests now time out after 10 seconds and fail closed, so a slow or unreachable captcha provider can no longer tie up a request indefinitely.

  • #​9993 baeaa00 Thanks @​gustavovalverde! - A delete-account confirmation link can no longer delete the account more than once when its callback is opened concurrently.

  • #​9991 0c3856f Thanks @​gustavovalverde! - Completing account deletion through /delete-user/callback now fails when the session has been revoked server-side, instead of proceeding within the cookie-cache window. Deployments that keep sessions only in the cookie are unaffected.

  • #​9993 baeaa00 Thanks @​gustavovalverde! - Polling for a device-authorization token can no longer redeem the same approved device code more than once when several polls arrive together.

  • #​9993 baeaa00 Thanks @​gustavovalverde! - Submitting the same email OTP from several requests at once can no longer sign in more than once or gain extra tries beyond the attempt limit.

  • #​10002 ed7b6c9 Thanks @​gustavovalverde! - Adding a member to a team that is already at its maximumMembersPerTeam limit is now rejected on every path. addMember with a teamId and add-team-member previously skipped the limit that invitation acceptance enforced, so they could push a team over its cap. A rejected addMember no longer creates the organization member.

  • #​9677 e0a768c Thanks @​GautamBytes! - Refactor role.authorize control flow while preserving existing authorization behavior.

  • #​9987 7343284 Thanks @​bytaesu! - Generic OAuth sign-in works again for providers whose userinfo response has no sub or id field when mapProfileToUser derives the account id. An empty id field now falls back to sub.

  • #​9991 0c3856f Thanks @​gustavovalverde! - getCookieCache now returns null for an expired session instead of the stale session data. Middleware that calls it to gate access no longer treats an expired signed cookie as a live session.

  • #​9993 baeaa00 Thanks @​gustavovalverde! - The Have I Been Pwned plugin now checks submitted passwords against the breach database on more password-setting endpoints by default, including the email-OTP and phone-number reset-password routes and the admin create-user and set-user-password routes. A breached password can no longer be set through those routes when the plugin is enabled with its default paths.

  • #​9987 7343284 Thanks @​bytaesu! - Preserve the fresh account cookie issued while switching users in the same browser instead of expiring it from stale request cookie state.

  • #​9991 0c3856f Thanks @​gustavovalverde! - Expired MCP access tokens are no longer accepted. A protected MCP resource now rejects a bearer token once it has expired, both on the server and through the remote client. A refresh token is accepted only when the original authorization included the offline_access scope.

  • #​9991 0c3856f Thanks @​gustavovalverde! - The multi-session set-active and revoke endpoints now act only on the session the caller holds a signed cookie for. A request could previously activate or revoke a different session by naming its token in the request body without holding that session's cookie.

  • #​9890 d9c526b Thanks @​bytaesu! - Add an experimental oauthPopup plugin (with oauthPopupClient and signIn.popup) for popup-based OAuth sign-in. It lets an app sign in inside a cross-site iframe by completing OAuth in a popup and handing the session token back to the opener, where the bearer plugin authenticates with it. The API may change while it is experimental.

  • #​9991 0c3856f Thanks @​gustavovalverde! - The OIDC provider's RP-initiated logout endpoint (/oauth2/endsession) no longer logs a user out, or revokes their OAuth tokens, in response to a cross-site GET that carries only a session cookie. Logout authenticated by a valid id_token_hint is unaffected.

  • #​10003 fdef997 Thanks @​gustavovalverde! - Google One Tap now requires a configured Google client ID and rejects the sign-in callback when none is set. A Google ID token issued for a different application is no longer accepted. Set the client ID on the oneTap plugin or on socialProviders.google.

  • #​9993 baeaa00 Thanks @​gustavovalverde! - A one-time token can no longer be redeemed for a session more than once when redeemed concurrently.

  • #​9993 baeaa00 Thanks @​gustavovalverde! - A password reset token can no longer change the password more than once when used from several requests at the same time.

  • #​9993 baeaa00 Thanks @​gustavovalverde! - Submitting the same phone-number OTP from several requests at once can no longer sign in more than once or gain extra tries beyond the attempt limit.

  • #​9993 baeaa00 Thanks @​gustavovalverde! - Concurrent requests can no longer slip past the configured rate limit. The in-memory rate-limit store no longer grows without bound, and the database backend removes expired entries on its own. A custom rate-limit storage may implement a new optional consume method for strict enforcement; without it, the previous behavior is kept and a one-time warning is logged.

  • #​9987 [7343284](https://redirect.github.co

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone America/Toronto)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, on day 1 of the month (* 0-3 1 * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot changed the title chore(deps): update dependency better-auth to v1.6.11 chore(deps): update better-auth group to v1.6.11 Jun 2, 2026
@renovate
renovate Bot force-pushed the renovate/better-auth-group branch from 43c4488 to 5bb26b5 Compare June 12, 2026 21:45
@renovate renovate Bot changed the title chore(deps): update better-auth group to v1.6.11 chore(deps): update better-auth group to v1.6.12 Jun 12, 2026
@renovate
renovate Bot force-pushed the renovate/better-auth-group branch from 5bb26b5 to 0665d53 Compare June 14, 2026 12:52
@renovate renovate Bot changed the title chore(deps): update better-auth group to v1.6.12 chore(deps): update better-auth group to v1.6.13 Jun 14, 2026
@renovate
renovate Bot force-pushed the renovate/better-auth-group branch from 0665d53 to fc67f4c Compare June 16, 2026 22:53
@renovate renovate Bot changed the title chore(deps): update better-auth group to v1.6.13 chore(deps): update better-auth group to v1.6.14 Jun 16, 2026
@renovate
renovate Bot force-pushed the renovate/better-auth-group branch from fc67f4c to 8261bb6 Compare June 22, 2026 17:42
@renovate renovate Bot changed the title chore(deps): update better-auth group to v1.6.14 chore(deps): update better-auth group Jun 22, 2026
@renovate
renovate Bot force-pushed the renovate/better-auth-group branch from 8261bb6 to 1a7938c Compare June 24, 2026 10:42
@renovate renovate Bot changed the title chore(deps): update better-auth group chore(deps): update dependency better-auth to v1.6.16 Jun 25, 2026
@renovate
renovate Bot force-pushed the renovate/better-auth-group branch from 1a7938c to e3c758b Compare June 26, 2026 07:02
@renovate renovate Bot changed the title chore(deps): update dependency better-auth to v1.6.16 chore(deps): update dependency better-auth to v1.6.17 Jun 26, 2026
@renovate
renovate Bot force-pushed the renovate/better-auth-group branch from e3c758b to 4bc8c30 Compare June 26, 2026 19:41
@renovate renovate Bot changed the title chore(deps): update dependency better-auth to v1.6.17 chore(deps): update dependency better-auth to v1.6.18 Jun 26, 2026
@renovate
renovate Bot force-pushed the renovate/better-auth-group branch from 4bc8c30 to 9156555 Compare June 30, 2026 01:51
@renovate renovate Bot changed the title chore(deps): update dependency better-auth to v1.6.18 chore(deps): update dependency better-auth to v1.6.19 Jun 30, 2026
@renovate
renovate Bot force-pushed the renovate/better-auth-group branch from 9156555 to b5b33e9 Compare July 4, 2026 04:42
@renovate renovate Bot changed the title chore(deps): update dependency better-auth to v1.6.19 chore(deps): update dependency better-auth to v1.6.20 Jul 4, 2026
@renovate
renovate Bot force-pushed the renovate/better-auth-group branch from b5b33e9 to 6357357 Compare July 10, 2026 06:07
@renovate renovate Bot changed the title chore(deps): update dependency better-auth to v1.6.20 chore(deps): update dependency better-auth to v1.6.21 Jul 10, 2026
@renovate
renovate Bot force-pushed the renovate/better-auth-group branch from 6357357 to e6a8542 Compare July 10, 2026 15:10
@renovate renovate Bot changed the title chore(deps): update dependency better-auth to v1.6.21 chore(deps): update dependency better-auth to v1.6.22 Jul 10, 2026
@renovate
renovate Bot force-pushed the renovate/better-auth-group branch from e6a8542 to 340ad43 Compare July 13, 2026 23:01
@renovate renovate Bot changed the title chore(deps): update dependency better-auth to v1.6.22 chore(deps): update dependency better-auth to v1.6.23 Jul 13, 2026
@renovate
renovate Bot force-pushed the renovate/better-auth-group branch from 340ad43 to d3bc835 Compare August 5, 2026 11:07
@renovate renovate Bot changed the title chore(deps): update dependency better-auth to v1.6.23 chore(deps): update dependency better-auth to v1.6.24 Aug 5, 2026
@renovate
renovate Bot force-pushed the renovate/better-auth-group branch from d3bc835 to 3bad485 Compare August 6, 2026 18:59
@renovate renovate Bot changed the title chore(deps): update dependency better-auth to v1.6.24 chore(deps): update dependency better-auth to v1.6.25 Aug 6, 2026
@renovate
renovate Bot force-pushed the renovate/better-auth-group branch from 3bad485 to 504e4ab Compare August 19, 2026 02:41
@renovate renovate Bot changed the title chore(deps): update dependency better-auth to v1.6.25 chore(deps): update dependency better-auth to v1.6.26 Aug 19, 2026
@renovate
renovate Bot force-pushed the renovate/better-auth-group branch from 504e4ab to f49a677 Compare August 25, 2026 20:43
@renovate renovate Bot changed the title chore(deps): update dependency better-auth to v1.6.26 chore(deps): update dependency better-auth to v1.6.27 Aug 25, 2026
@renovate
renovate Bot force-pushed the renovate/better-auth-group branch from f49a677 to d2bdfef Compare August 28, 2026 00:01
@renovate renovate Bot changed the title chore(deps): update dependency better-auth to v1.6.27 chore(deps): update dependency better-auth to v1.6.28 Aug 28, 2026
@renovate
renovate Bot force-pushed the renovate/better-auth-group branch from d2bdfef to 196911e Compare August 28, 2026 22:50
@renovate renovate Bot changed the title chore(deps): update dependency better-auth to v1.6.28 chore(deps): update dependency better-auth to v1.6.29 Aug 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants