Skip to content

chore(deps): Bump the better-auth group across 1 directory with 6 updates - #11

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/better-auth-6aa13e2110
Closed

chore(deps): Bump the better-auth group across 1 directory with 6 updates#11
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/better-auth-6aa13e2110

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the better-auth group with 6 updates in the / directory:

Package From To
@better-auth/api-key 1.7.7 1.7.10
@better-auth/core 1.7.7 1.7.10
@better-auth/utils 0.4.2 0.5.0
better-auth 1.7.7 1.7.10
better-call 1.4.0 2.0.6
@better-auth/kysely-adapter 1.7.7 1.7.10

Updates @better-auth/api-key from 1.7.7 to 1.7.10

Release notes

Sourced from @​better-auth/api-key's releases.

v1.7.10

better-auth

Bug Fixes

  • Fixed Captcha and OpenAPI plugin subpath imports and type resolution for better-auth/plugins/multi-session and better-auth/test. (#11822)
  • Fixed Google One Tap sign-ins not recording google as the last login method. (#11393)
  • Fixed imports from better-auth/plugins/one-tap failing with a not-exported error. (#11696)
  • Fixed Google One Tap ignoring plugin-level autoSelect and cancelOnTapOutside settings. (#11820)
  • Fixed Google One Tap sign-ins ignoring configured Google profile mapping and user info updates. (#11819)
  • Fixed Google One Tap calling a prompt method unsupported by FedCM and retrying skipped prompts. (#11821)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

  • Added optional self-service signing key rotation for private_key_jwt clients. (#11695)

Bug Fixes

  • Fixed valid DPoP proofs being rejected for parameterized routes and URLs with trailing slashes. (#11786)
  • Fixed native clients with HTTP loopback callbacks being rejected when application type inference is enabled. (#11798)
  • Fixed device-code clients being unable to refresh access for approved resources omitted from a token poll. (#11815)
  • Fixed OAuth consent without a reference overwriting or reusing consent for a different reference. (#11801)
  • Fixed dynamic client registration rejecting requests that include both supported and unsupported grants. (#11797)
  • Fixed attempts to change cached trusted clients returning HTTP 500 instead of HTTP 400. (#11781)
  • Improved errors for unknown OAuth client_id values to say client not found. (#11799)
  • Fixed PKCE verifier errors to return the specified HTTP 400 response and error code. (#11724)
  • Fixed unknown OAuth clients receiving invalid_grant instead of invalid_client at the token endpoint. (#11176)
  • Fixed unverifiable JWT access tokens causing server errors at /oauth2/userinfo, /oauth2/introspect, and /oauth2/revoke. (#11596)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Limited JWKS refetches for unknown key IDs to protect servers from repeated requests. (#11805)
  • Fixed unreachable JWKS endpoints being reported as invalid tokens instead of server errors. (#11612)

For detailed changes, see CHANGELOG

@better-auth/mongo-adapter

Bug Fixes

  • Fixed MongoDB findMany ignoring ID sorting and potentially repeating or skipping paginated results. (#11801)

... (truncated)

Changelog

Sourced from @​better-auth/api-key's changelog.

1.7.10

1.7.9

1.7.8

Patch Changes

  • #11512 4175b34 Thanks @​bytaesu! - Align the installed @better-auth/utils version with better-call while accepting ^0.4.2 || ^0.5.0 across official package peers.
Commits

Updates @better-auth/core from 1.7.7 to 1.7.10

Release notes

Sourced from @​better-auth/core's releases.

v1.7.10

better-auth

Bug Fixes

  • Fixed Captcha and OpenAPI plugin subpath imports and type resolution for better-auth/plugins/multi-session and better-auth/test. (#11822)
  • Fixed Google One Tap sign-ins not recording google as the last login method. (#11393)
  • Fixed imports from better-auth/plugins/one-tap failing with a not-exported error. (#11696)
  • Fixed Google One Tap ignoring plugin-level autoSelect and cancelOnTapOutside settings. (#11820)
  • Fixed Google One Tap sign-ins ignoring configured Google profile mapping and user info updates. (#11819)
  • Fixed Google One Tap calling a prompt method unsupported by FedCM and retrying skipped prompts. (#11821)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

  • Added optional self-service signing key rotation for private_key_jwt clients. (#11695)

Bug Fixes

  • Fixed valid DPoP proofs being rejected for parameterized routes and URLs with trailing slashes. (#11786)
  • Fixed native clients with HTTP loopback callbacks being rejected when application type inference is enabled. (#11798)
  • Fixed device-code clients being unable to refresh access for approved resources omitted from a token poll. (#11815)
  • Fixed OAuth consent without a reference overwriting or reusing consent for a different reference. (#11801)
  • Fixed dynamic client registration rejecting requests that include both supported and unsupported grants. (#11797)
  • Fixed attempts to change cached trusted clients returning HTTP 500 instead of HTTP 400. (#11781)
  • Improved errors for unknown OAuth client_id values to say client not found. (#11799)
  • Fixed PKCE verifier errors to return the specified HTTP 400 response and error code. (#11724)
  • Fixed unknown OAuth clients receiving invalid_grant instead of invalid_client at the token endpoint. (#11176)
  • Fixed unverifiable JWT access tokens causing server errors at /oauth2/userinfo, /oauth2/introspect, and /oauth2/revoke. (#11596)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Limited JWKS refetches for unknown key IDs to protect servers from repeated requests. (#11805)
  • Fixed unreachable JWKS endpoints being reported as invalid tokens instead of server errors. (#11612)

For detailed changes, see CHANGELOG

@better-auth/mongo-adapter

Bug Fixes

  • Fixed MongoDB findMany ignoring ID sorting and potentially repeating or skipping paginated results. (#11801)

... (truncated)

Changelog

Sourced from @​better-auth/core's changelog.

1.7.10

Patch Changes

  • #11612 fedd055 Thanks @​vhinayindia! - If your resource server verifies access tokens with verifyAccessTokenRequest or verifyBearerToken and a jwksUrl, including through the MCP plugin, a key set that cannot be reached at all, for example a refused connection, now throws an error. Before, the token was rejected as invalid with 401 "no token payload", which hid the outage. A key set that answers with an HTTP error already threw.

    With remoteVerify configured, such a failure no longer falls back to remote introspection.

    The OAuth provider's /oauth2/introspect, /oauth2/userinfo and /oauth2/revoke behave the same way with the JWT plugin's jwks.remoteUrl: they return 500 instead of reporting the token as invalid.

  • #11805 bbd0a19 Thanks @​gustavovalverde! - Servers that verify JWTs against a key set now refetch that key set at most once every 30 seconds per server process when a token names a key ID (kid) the cached set does not contain. This covers the OAuth provider plugin's introspection, revocation, UserInfo, and logout endpoints, and resource servers that call verifyAccessTokenRequest or verifyBearerToken with jwksUrl. Previously every such token caused a new fetch: a remote request with jwksUrl or jwks.remoteUrl, or otherwise a read of the jwks table. Anyone could send tokens with made-up kid values to force one fetch per request, and the UserInfo endpoint needs no client credentials.

    Concurrent verifications now share one fetch, and a key set fetch that takes longer than 5 seconds fails with a JWKSTimeout error instead of waiting indefinitely.

    A token signed with a newly published key still verifies without waiting for the 5-minute cache to expire. It can be rejected for up to 30 seconds if the key set was already refetched for another unknown kid in that time. No configuration change is needed.

1.7.9

1.7.8

Patch Changes

  • #11512 4175b34 Thanks @​bytaesu! - Align the installed @better-auth/utils version with better-call while accepting ^0.4.2 || ^0.5.0 across official package peers.

  • #11592 435645e Thanks @​drewsephski! - Fix Atlassian user info errors being logged as coming from Figma.

  • #11625 369176e Thanks @​gustavovalverde! - Fixed single-use checks for apps that set advanced.database.generateId: "uuid". Default id generation is unaffected, and no migration is needed.

    • On SQLite and MySQL, SAML sign-in, DPoP-bound requests checked against the database replay store, private_key_jwt client authentication, and magic link or email OTP sign-ins that adopt an unverified account failed with a NOT NULL error on the id column. They now work. SIWE sign-in ignored the email field and used the wallet-derived address; it now uses the supplied email when no other account has it.
    • On Postgres and MongoDB, a reused SAML assertion, DPoP proof, or client assertion was accepted. Each one is now accepted only once.

    With generateId: "serial", behavior is unchanged: these checks need string ids, and Better Auth now logs a warning the first time one of these flows runs.

  • #11749 e78f15a Thanks @​gustavovalverde! - ID token verification now allows 30 seconds of clock difference between your server and the identity provider when checking exp, nbf, and iat. Previously, a provider whose clock ran even slightly ahead (for example, an nbf set a fraction of a second in the future) made sign-in fail. This affected generic OAuth providers configured with discoveryUrl since 1.7.0, ID token sign-in with the built-in social providers, and Google One Tap. Tokens up to 30 seconds past exp are now also accepted. No configuration change is needed. A custom verifyIdToken replaces this check and must set its own tolerance, and the SSO plugin's OIDC sign-in is unchanged.

  • #11663 60525e0 Thanks @​kaiizer777! - Fixed Microsoft Entra ID sign-in with an ID token (signIn.social with idToken, and linking an account with an ID token) rejecting every token. Microsoft publishes its signing keys without an alg field, which made verification fail. Those keys are now treated as RS256, and Microsoft ID tokens signed with any other algorithm are rejected. The redirect sign-in flow was not affected.

  • #11515 916ef5c Thanks @​BilalAtique! - If you pass client to mongodbAdapter on a replica set, concurrent requests that write the same documents no longer fail with a 500. Before, MongoDB aborted all but one of them with a write conflict, so a SCIM directory that provisions several users at once returned 500 for most of them. The adapter now retries such a transaction, as MongoDB requires, for up to 120 seconds or until your MongoClient's timeoutMS. Under contention a request can take longer instead of failing.

    A retry runs the work again. databaseHooks before hooks can run more than once for one request, and after hooks still run once, after the commit. Work that the request does outside the database before it commits can also repeat on a retried request. For example, an email sign-up can send its verification email twice. Requests that succeed on the first attempt are unaffected, and so are other adapters.

  • #11718 1d95ebf Thanks @​bytaesu! - Fix missing device sessions and failed automatic session switching after cache eviction when storeSessionInDatabase is enabled and preserveSessionInDatabase is disabled. Automatic switching now follows the order of held sessions, and large lists or sessions whose users no longer exist no longer cause valid sessions to disappear.

  • #10956 6214610 Thanks @​disbell! - Native OAuth clients and Client ID Metadata Documents can now use custom-scheme redirect URIs with a host and a path, such as Cursor's cursor://anysphere.cursor-mcp/oauth/callback. Previously, only the authority-free reverse-domain form, such as com.example.app:/callback, was accepted, and these registrations failed with invalid_redirect_uri.

    Cursor also omits application_type when it registers, so the web default still rejects it. To accept Cursor, set the new clientRegistrationDefaultApplicationType option to "infer". A dynamic registration that omits application_type then becomes native when any of its redirect URIs uses a custom scheme, and every redirect URI must pass the native rules. Setting "native" treats every registration that omits the field as native. The default remains "web", and an application_type the client sends is never overridden.

    Pairwise clients (subject_type: "pairwise") cannot use these host-bearing custom-scheme redirect URIs. Web clients are unaffected: they still accept only https redirect URIs on non-loopback hosts.

  • #11626 67743ed Thanks @​gustavovalverde! - Password resets and password changes no longer keep the new password when revoking the user's sessions fails. With revokeSessionsOnPasswordReset or revokeOtherSessions, database sessions are revoked and the password is saved in one transaction when transactions are enabled for the adapter, so a failure leaves the old password and sessions in place. Sessions in secondary storage are still removed after commit, on a best-effort basis. This covers /reset-password, the email OTP and phone number reset endpoints, and /change-password. onPasswordReset now runs after sessions are revoked, so a throwing callback no longer leaves them active, and a callback that lists the user's sessions no longer sees the revoked ones.

... (truncated)

Commits
  • b734a41 chore: release v1.7.10 (#11795)
  • bb5edcf fix(core): use a newer cached key set before joining a pending JWKS fetch (#1...
  • fedd055 fix(oauth2): report an unreachable JWKS as an error, not an invalid token (#1...
  • bbd0a19 fix(core): limit JWKS refetches for unknown key IDs (#11805)
  • d2a5f83 chore: release v1.7.9 (#11761)
  • c03ced5 chore: bump @biomejs/biome (#11760)
  • 5f4cc5c chore: release v1.7.8 (#11513)
  • e78f15a fix(core): allow 30s of clock skew when verifying ID tokens (#11749)
  • 60525e0 fix(core): verify microsoft entra id tokens when jwks keys omit alg (#11663)
  • 916ef5c fix(mongo-adapter): retry a transaction aborted with a transient error (#11515)
  • Additional commits viewable in compare view

Updates @better-auth/utils from 0.4.2 to 0.5.0

Release notes

Sourced from @​better-auth/utils's releases.

v0.5.0

   🐞 Bug Fixes

    View changes on GitHub

v0.4.3

   🐞 Bug Fixes

    View changes on GitHub
Commits

Updates better-auth from 1.7.7 to 1.7.10

Release notes

Sourced from better-auth's releases.

v1.7.10

better-auth

Bug Fixes

  • Fixed Captcha and OpenAPI plugin subpath imports and type resolution for better-auth/plugins/multi-session and better-auth/test. (#11822)
  • Fixed Google One Tap sign-ins not recording google as the last login method. (#11393)
  • Fixed imports from better-auth/plugins/one-tap failing with a not-exported error. (#11696)
  • Fixed Google One Tap ignoring plugin-level autoSelect and cancelOnTapOutside settings. (#11820)
  • Fixed Google One Tap sign-ins ignoring configured Google profile mapping and user info updates. (#11819)
  • Fixed Google One Tap calling a prompt method unsupported by FedCM and retrying skipped prompts. (#11821)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

  • Added optional self-service signing key rotation for private_key_jwt clients. (#11695)

Bug Fixes

  • Fixed valid DPoP proofs being rejected for parameterized routes and URLs with trailing slashes. (#11786)
  • Fixed native clients with HTTP loopback callbacks being rejected when application type inference is enabled. (#11798)
  • Fixed device-code clients being unable to refresh access for approved resources omitted from a token poll. (#11815)
  • Fixed OAuth consent without a reference overwriting or reusing consent for a different reference. (#11801)
  • Fixed dynamic client registration rejecting requests that include both supported and unsupported grants. (#11797)
  • Fixed attempts to change cached trusted clients returning HTTP 500 instead of HTTP 400. (#11781)
  • Improved errors for unknown OAuth client_id values to say client not found. (#11799)
  • Fixed PKCE verifier errors to return the specified HTTP 400 response and error code. (#11724)
  • Fixed unknown OAuth clients receiving invalid_grant instead of invalid_client at the token endpoint. (#11176)
  • Fixed unverifiable JWT access tokens causing server errors at /oauth2/userinfo, /oauth2/introspect, and /oauth2/revoke. (#11596)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Limited JWKS refetches for unknown key IDs to protect servers from repeated requests. (#11805)
  • Fixed unreachable JWKS endpoints being reported as invalid tokens instead of server errors. (#11612)

For detailed changes, see CHANGELOG

@better-auth/mongo-adapter

Bug Fixes

  • Fixed MongoDB findMany ignoring ID sorting and potentially repeating or skipping paginated results. (#11801)

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.10

Patch Changes

  • #11393 eebd47a Thanks @​breken-ai! - If you use the lastLoginMethod plugin with oneTap, signing in through Google One Tap now records "google", the same value as signing in with the Google button. Before, a One Tap sign-in recorded nothing: the better-auth.last_used_login_method cookie kept its previous value or stayed unset, and so did user.lastLoginMethod with storeInDatabase.

    If your customResolveMethod includes a /one-tap/callback → "google" workaround, remove that mapping; keep the resolver if it handles other routes.

  • #11821 09d07e6 Thanks @​gustavovalverde! - The Google One Tap prompt (authClient.oneTap() without button) no longer calls getSkippedReason(), which Google's FedCM migration guide says to remove. Before, it called it under any promptOptions.fedCM setting.

    A skipped prompt now ends the flow and calls onPromptNotification right away instead of retrying. Google doesn't report why a prompt was skipped, and a prompt the user closed stays hidden for Google's cooldown period, so the retries could not bring it back. Dismissed prompts still retry as before.

    Google Identity Services still logs its FedCM migration warning, because it does so whenever prompt() receives a listener. The plugin needs the listener to track dismissals and skips, so the warning is expected and safe to ignore.

  • #11819 eaecb72 Thanks @​gustavovalverde! - Google One Tap now applies your socialProviders.google.mapProfileToUser and custom getUserInfo, the same as the standard Google sign-in. Before, One Tap ignored both and always stored the token's name, email, email_verified, and picture claims.

    If you configured either one, users created through One Tap now get the fields it returns, including any extra fields such as a first name from given_name. Returning users are updated from it on each One Tap sign-in when socialProviders.google.overrideUserInfoOnSignIn is on, and so are existing users that One Tap links when account.accountLinking.updateUserInfoOnLink is on. Check that your mapper suits One Tap users too.

    If you set socialProviders.google.overrideUserInfoOnSignIn, One Tap sign-ins now update returning users' name, image, and email from Google, as the redirect sign-in already does.

    Setups that configure none of these, including oneTap({ clientId }) with no Google provider, are unaffected.

  • #11820 88c9a37 Thanks @​gustavovalverde! - If you set autoSelect or cancelOnTapOutside on oneTapClient(), the One Tap prompt and the Sign in with Google button now use them. Before, only values passed to authClient.oneTap() took effect, so with autoSelect: true on the plugin, returning users still had to pick an account. Values passed to oneTap() still override the plugin's. Apps that set these options only on oneTap(), or not at all, are unaffected.

  • #11696 0cf1f7c Thanks @​drewsephski! - You can now import the One Tap plugin from better-auth/plugins/one-tap, as you can for other plugins. Previously this import failed with a "not exported" error. Imports from better-auth/plugins and better-auth/client/plugins are unchanged.

  • #11822 414e845 Thanks @​gustavovalverde! - You can now import the Captcha and OpenAPI plugins from better-auth/plugins/captcha and better-auth/plugins/open-api, as you can for other plugins. Previously these imports failed with a "not exported" error. Imports from better-auth/plugins are unchanged.

    If your TypeScript config uses "moduleResolution": "node" (or node10), better-auth/plugins/multi-session and better-auth/test now resolve their types. Previously TypeScript reported that it could not find their declarations. Projects using bundler, node16, or nodenext resolution are unaffected.

  • Updated dependencies [fedd055, bbd0a19, 99cdfe7]:

    • @​better-auth/core@​1.7.10
    • @​better-auth/mongo-adapter@​1.7.10
    • @​better-auth/drizzle-adapter@​1.7.10
    • @​better-auth/kysely-adapter@​1.7.10
    • @​better-auth/memory-adapter@​1.7.10
    • @​better-auth/prisma-adapter@​1.7.10
    • @​better-auth/telemetry@​1.7.10

1.7.9

Patch Changes

  • #11766 6edaa61 Thanks @​bytaesu! - An onAPIError.onError handler that throws or rejects no longer fails the request or causes an unhandled promise rejection. The error is logged and the original error response is returned. Async handlers now finish before the response is sent.

  • Updated dependencies []:

    • @​better-auth/core@​1.7.9
    • @​better-auth/drizzle-adapter@​1.7.9
    • @​better-auth/kysely-adapter@​1.7.9
    • @​better-auth/memory-adapter@​1.7.9

... (truncated)

Commits
  • b734a41 chore: release v1.7.10 (#11795)
  • eebd47a fix(last-login-method): record Google One Tap sign-ins (#11393)
  • eaecb72 fix(one-tap): apply the Google provider's mapProfileToUser and getUserInfo (#...
  • 414e845 fix(better-auth): keep package subpaths in sync with build entries (#11822)
  • 88c9a37 fix(one-tap): apply plugin-level autoSelect and cancelOnTapOutside (#11820)
  • 09d07e6 fix(one-tap): stop calling prompt moment methods unsupported under FedCM (#11...
  • 0cf1f7c fix(one-tap): add the better-auth/plugins/one-tap subpath export (#11696)
  • d2a5f83 chore: release v1.7.9 (#11761)
  • dbca311 test: fix test names in bearer and organization (#11768)
  • c03ced5 chore: bump @biomejs/biome (#11760)
  • Additional commits viewable in compare view

Updates better-call from 1.4.0 to 2.0.6

Release notes

Sourced from better-call's releases.

v2.0.6

   🐞 Bug Fixes

    View changes on GitHub

v2.0.5

   🐞 Bug Fixes

    View changes on GitHub

v2.0.4

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub

v2.0.3

   🐞 Bug Fixes

    View changes on GitHub

v2.0.2

No significant changes

    View changes on GitHub

v2.0.1

   🐞 Bug Fixes

... (truncated)

Commits
  • 86a79a9 chore: release v2.0.6
  • 1c85038 fix: include README in published package (#170)
  • 566c850 chore: release v2.0.5
  • de59505 fix(router): only strip basePath when it is a leading prefix (#149)
  • d9de25a chore: release v2.0.4
  • 6718b44 ci: migrate release to npm OIDC trusted publishing (#146)
  • 31e5f8f fix(client): correct return types when throw option is true (#127)
  • faf741d fix(to-response): preserve multiple Set-Cookie when merging headers (#137)
  • f5e54a1 fix(to-response): only mark true cycles in safeStringify (#140)
  • b021012 test(router): add streaming response test (#138)
  • Additional commits viewable in compare view

Updates @better-auth/kysely-adapter from 1.7.7 to 1.7.10

Release notes

Sourced from @​better-auth/kysely-adapter's releases.

v1.7.10

better-auth

Bug Fixes

  • Fixed Captcha and OpenAPI plugin subpath imports and type resolution for better-auth/plugins/multi-session and better-auth/test. (#11822)
  • Fixed Google One Tap sign-ins not recording google as the last login method. (#11393)
  • Fixed imports from better-auth/plugins/one-tap failing with a not-exported error. (#11696)
  • Fixed Google One Tap ignoring plugin-level autoSelect and cancelOnTapOutside settings. (#11820)
  • Fixed Google One Tap sign-ins ignoring configured Google profile mapping and user info updates. (#11819)
  • Fixed Google One Tap calling a prompt method unsupported by FedCM and retrying skipped prompts. (#11821)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

  • Added optional self-service signing key rotation for private_key_jwt clients. (#11695)

Bug Fixes

  • Fixed valid DPoP proofs being rejected for parameterized routes and URLs with trailing slashes. (#11786)
  • Fixed native clients with HTTP loopback callbacks being rejected when application type inference is enabled. (#11798)
  • Fixed device-code clients being unable to refresh access for approved resources omitted from a token poll. (#11815)
  • Fixed OAuth consent without a reference overwriting or reusing consent for a different reference. (#11801)
  • Fixed dynamic client registration rejecting requests that include both supported and unsupported grants. (#11797)
  • Fixed attempts to change cached trusted clients returning HTTP 500 instead of HTTP 400. (#11781)
  • Improved errors for unknown OAuth client_id values to say client not found. (#11799)
  • Fixed PKCE verifier errors to return the specified HTTP 400 response and error code. (#11724)
  • Fixed unknown OAuth clients receiving invalid_grant instead of invalid_client at the token endpoint. (#11176)
  • Fixed unverifiable JWT access tokens causing server errors at /oauth2/userinfo, /oauth2/introspect, and /oauth2/revoke. (#11596)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Limited JWKS refetches for unknown key IDs to protect servers from repeated requests. (#11805)
  • Fixed unreachable JWKS endpoints being reported as invalid tokens instead of server errors. (#11612)

For detailed changes, see CHANGELOG

@better-auth/mongo-adapter

Bug Fixes

  • Fixed MongoDB findMany ignoring ID sorting and potentially repeating or skipping paginated results. (#11801)

... (truncated)

Changelog

Sourced from @​better-auth/kysely-adapter's changelog.

1.7.10

1.7.9

1.7.8

Patch Changes

  • #11512 4175b34 Thanks @​bytaesu! - Align the installed @better-auth/utils version with better-call while accepting ^0.4.2 || ^0.5.0 across official package peers.

  • #11490 9904b29 Thanks @​aryan1306! - Allow concurrent D1 queries on a shared auth instance with Kysely 0.29, avoiding cross-request I/O errors.

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 20, 2026
@Madraka

Madraka commented Oct 20, 2026

Copy link
Copy Markdown
Contributor

@dependabot recreate

@dependabot
chore(deps): Bump the better-auth group across 1 directory with 6 upd…
1b872a7 
…ates

Bumps the better-auth group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@better-auth/api-key](https://github.com/better-auth/better-auth/tree/HEAD/packages/api-key) | `1.7.7` | `1.7.10` |
| [@better-auth/core](https://github.com/better-auth/better-auth/tree/HEAD/packages/core) | `1.7.7` | `1.7.10` |
| [@better-auth/utils](https://github.com/better-auth/utils) | `0.4.2` | `0.5.0` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.7` | `1.7.10` |
| [better-call](https://github.com/better-auth/better-call/tree/HEAD/packages/better-call) | `1.4.0` | `2.0.6` |
| [@better-auth/kysely-adapter](https://github.com/better-auth/better-auth/tree/HEAD/packages/kysely-adapter) | `1.7.7` | `1.7.10` |



Updates `@better-auth/api-key` from 1.7.7 to 1.7.10
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/api-key/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.10/packages/api-key)

Updates `@better-auth/core` from 1.7.7 to 1.7.10
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/core/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.10/packages/core)

Updates `@better-auth/utils` from 0.4.2 to 0.5.0
- [Release notes](https://github.com/better-auth/utils/releases)
- [Commits](better-auth/utils@v0.4.2...v0.5.0)

Updates `better-auth` from 1.7.7 to 1.7.10
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.10/packages/better-auth)

Updates `better-call` from 1.4.0 to 2.0.6
- [Release notes](https://github.com/better-auth/better-call/releases)
- [Commits](https://github.com/better-auth/better-call/commits/v2.0.6/packages/better-call)

Updates `@better-auth/kysely-adapter` from 1.7.7 to 1.7.10
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/kysely-adapter/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.10/packages/kysely-adapter)

---
updated-dependencies:
- dependency-name: "@better-auth/api-key"
  dependency-version: 1.7.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: better-auth
- dependency-name: "@better-auth/core"
  dependency-version: 1.7.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: better-auth
- dependency-name: "@better-auth/kysely-adapter"
  dependency-version: 1.7.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: better-auth
- dependency-name: "@better-auth/utils"
  dependency-version: 0.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: better-auth
- dependency-name: better-auth
  dependency-version: 1.7.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: better-auth
- dependency-name: better-call
  dependency-version: 2.0.6
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: better-auth
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot changed the title chore(deps): Bump the better-auth group with 6 updates chore(deps): Bump the better-auth group across 1 directory with 6 updates Oct 20, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/better-auth-6aa13e2110 branch from a6fb815 to 1b872a7 Compare October 20, 2026 21:37
@Madraka

Madraka commented Oct 20, 2026

Copy link
Copy Markdown
Contributor

Closed after the history rewrite: this branch is built on the old commits. Dependabot will reopen the update from the new main.

@Madraka Madraka closed this Oct 20, 2026
@Madraka
Madraka deleted the dependabot/npm_and_yarn/better-auth-6aa13e2110 branch October 20, 2026 21:45
@dependabot @github

dependabot Bot commented on behalf of github Oct 20, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@Madraka Madraka mentioned this pull request Oct 23, 2026
Merged
5 tasks done
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Madraka