Skip to content

chore(deps): Bump the better-auth group across 1 directory with 6 updates - #155

Merged
Madraka merged 1 commit into
mainfrom
dependabot/npm_and_yarn/better-auth-f121157a06
Nov 8, 2026
Merged

chore(deps): Bump the better-auth group across 1 directory with 6 updates#155
Madraka merged 1 commit into
mainfrom
dependabot/npm_and_yarn/better-auth-f121157a06

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the better-auth group with 6 updates in the / directory:

Package From To
@better-auth/api-key 1.7.12 1.7.17
@better-auth/core 1.7.12 1.7.17
@better-auth/utils 0.5.0 0.5.1
better-auth 1.7.12 1.7.17
better-call 1.4.4 1.4.5
@better-auth/kysely-adapter 1.7.12 1.7.17

Updates @better-auth/api-key from 1.7.12 to 1.7.17

Release notes

Sourced from @​better-auth/api-key's releases.

v1.7.17

better-auth

Bug Fixes

  • Fixed sessions created by a session.delete.after hook being treated as revoked during "revoke all sessions" when using secondaryStorage with storeSessionInDatabase (#12212)
  • Fixed remembered sign-ins and sign-ups to refresh their session even if an earlier sign-in in the same browser used rememberMe: false (#12181)
  • Fixed denying a device authorization request to reject a revoked session that is still in the cookie cache (#12216)
  • Fixed IP wildcard trusted origins such as exp://192.168.*.*:* matching custom-scheme hosts with out-of-range or zero-padded octets (#12217)
  • Fixed the phone number plugin storing an empty phoneNumber on sign-up and replacing a verified number when linking an account with an empty phone number (#12219)
  • Fixed TOTP verification rejecting API key sessions so they can now finish two-factor enrollment (#12211)
  • Fixed trusted devices being ignored when an app runs the two-factor sign-in step from its own hook on another sign-in path, such as email OTP (#12228)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

  • Fixed Expo social sign-in to reject authorization URLs without a state parameter when OAuth state is stored in a cookie (#12218)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

  • Fixed MySQL create with generateId: "serial" leaving an inserted row behind when the table reports no auto-increment id (#12220)

For detailed changes, see CHANGELOG

@better-auth/passkey

Bug Fixes

  • Fixed passkey registration and sign-in when one passkey() plugin is shared between auth instances where only some set baseURL (#12225)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​aliamanatali, @​bytaesu

Full changelog: v1.7.16...v1.7.17

v1.7.16

better-auth

... (truncated)

Changelog

Sourced from @​better-auth/api-key's changelog.

1.7.17

1.7.16

1.7.15

Patch Changes

  • #12107 9ce8b2c Thanks @​bytaesu! - API keys stored in secondary storage now verify, load, and list correctly when the storage client returns already-parsed JSON objects, such as @upstash/redis.

1.7.14

1.7.13

Commits

Updates @better-auth/core from 1.7.12 to 1.7.17

Release notes

Sourced from @​better-auth/core's releases.

v1.7.17

better-auth

Bug Fixes

  • Fixed sessions created by a session.delete.after hook being treated as revoked during "revoke all sessions" when using secondaryStorage with storeSessionInDatabase (#12212)
  • Fixed remembered sign-ins and sign-ups to refresh their session even if an earlier sign-in in the same browser used rememberMe: false (#12181)
  • Fixed denying a device authorization request to reject a revoked session that is still in the cookie cache (#12216)
  • Fixed IP wildcard trusted origins such as exp://192.168.*.*:* matching custom-scheme hosts with out-of-range or zero-padded octets (#12217)
  • Fixed the phone number plugin storing an empty phoneNumber on sign-up and replacing a verified number when linking an account with an empty phone number (#12219)
  • Fixed TOTP verification rejecting API key sessions so they can now finish two-factor enrollment (#12211)
  • Fixed trusted devices being ignored when an app runs the two-factor sign-in step from its own hook on another sign-in path, such as email OTP (#12228)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

  • Fixed Expo social sign-in to reject authorization URLs without a state parameter when OAuth state is stored in a cookie (#12218)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

  • Fixed MySQL create with generateId: "serial" leaving an inserted row behind when the table reports no auto-increment id (#12220)

For detailed changes, see CHANGELOG

@better-auth/passkey

Bug Fixes

  • Fixed passkey registration and sign-in when one passkey() plugin is shared between auth instances where only some set baseURL (#12225)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​aliamanatali, @​bytaesu

Full changelog: v1.7.16...v1.7.17

v1.7.16

better-auth

... (truncated)

Changelog

Sourced from @​better-auth/core's changelog.

1.7.17

1.7.16

Patch Changes

  • #12198 f25081a Thanks @​bytaesu! - Generic OAuth providers whose discovery document has a jwks_uri now reject a user profile whose sub differs from the ID token's sub. Direct ID-token sign-in and linking with a generic OAuth provider now resolve the profile from the verified ID token only and ignore a submitted access or refresh token.

  • #12198 f25081a Thanks @​bytaesu! - Account linking and new OAuth users now count an email as verified only when the provider claim is true or the string "true", which covers generic OAuth, Cognito, and Microsoft Entra ID claims sent as strings. Any other emailVerified value, including a non-boolean value returned from mapProfileToUser such as 1, now reads as unverified.

  • #12198 f25081a Thanks @​bytaesu! - The Zoom social provider now applies its configured provider options, so disableSignUp, requireEmailVerification, and overrideUserInfoOnSignIn take effect for Zoom sign-ins.

1.7.15

Patch Changes

  • #12106 9ef0c5b Thanks @​bytaesu! - Built-in social providers no longer follow HTTP redirects on token exchange, refresh, verification, and signing key (JWKS) requests, matching the other server-side OAuth requests.

1.7.14

Patch Changes

  • #12045 2947ab7 Thanks @​honuuk! - Kakao sign-in now passes loginHint to Kakao, so the Kakao Account login page opens with the ID field prefilled.

1.7.13

Patch Changes

  • #11997 2712441 Thanks @​bytaesu! - The Cloudflare provider now accepts tokenEndpointAuth: { method }. The existing tokenEndpointAuthMethod option is marked as deprecated and remains supported for backward compatibility.

  • #11948 1cf4b2c Thanks @​allenzhou101! - Allow the Vercel social provider to configure token endpoint authentication, including dynamic OIDC tokens and private key JWT client assertions, without replacing the built-in sign-in flow.

Commits

Updates @better-auth/utils from 0.5.0 to 0.5.1

Release notes

Sourced from @​better-auth/utils's releases.

v0.5.1

   🚀 Features

    View changes on GitHub
Commits

Updates better-auth from 1.7.12 to 1.7.17

Release notes

Sourced from better-auth's releases.

v1.7.17

better-auth

Bug Fixes

  • Fixed sessions created by a session.delete.after hook being treated as revoked during "revoke all sessions" when using secondaryStorage with storeSessionInDatabase (#12212)
  • Fixed remembered sign-ins and sign-ups to refresh their session even if an earlier sign-in in the same browser used rememberMe: false (#12181)
  • Fixed denying a device authorization request to reject a revoked session that is still in the cookie cache (#12216)
  • Fixed IP wildcard trusted origins such as exp://192.168.*.*:* matching custom-scheme hosts with out-of-range or zero-padded octets (#12217)
  • Fixed the phone number plugin storing an empty phoneNumber on sign-up and replacing a verified number when linking an account with an empty phone number (#12219)
  • Fixed TOTP verification rejecting API key sessions so they can now finish two-factor enrollment (#12211)
  • Fixed trusted devices being ignored when an app runs the two-factor sign-in step from its own hook on another sign-in path, such as email OTP (#12228)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

  • Fixed Expo social sign-in to reject authorization URLs without a state parameter when OAuth state is stored in a cookie (#12218)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

  • Fixed MySQL create with generateId: "serial" leaving an inserted row behind when the table reports no auto-increment id (#12220)

For detailed changes, see CHANGELOG

@better-auth/passkey

Bug Fixes

  • Fixed passkey registration and sign-in when one passkey() plugin is shared between auth instances where only some set baseURL (#12225)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​aliamanatali, @​bytaesu

Full changelog: v1.7.16...v1.7.17

v1.7.16

better-auth

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.17

Patch Changes

  • #12181 b6a87ad Thanks @​aliamanatali! - A remembered sign-in or sign-up now refreshes its session like any other remembered session, even if an earlier sign-in in the same browser used rememberMe: false. Previously the earlier choice stayed in a dont_remember cookie until the browser closed, so the new session stopped sliding and expired expiresIn after it was created.

  • #12216 cff7c1c Thanks @​bytaesu! - Denying a device authorization request now rejects a session that was revoked but still present in the cookie cache, matching the behavior of approving a request.

  • #12217 16aa412 Thanks @​bytaesu! - IP wildcard trusted origins such as exp://192.168.*.*:* no longer match custom-scheme hosts with out-of-range or zero-padded octets like 192.168.999.999.

  • #12219 9150314 Thanks @​bytaesu! - Signing up with an empty phoneNumber with the phone number plugin no longer stores the empty string or makes later sign-ups fail. Linking an account whose profile maps an empty phone number no longer replaces the user's verified number.

  • #12212 f5be351 Thanks @​bytaesu! - Fixed sessions created by a session.delete.after hook during "revoke all sessions" being treated as revoked immediately when secondaryStorage is used with storeSessionInDatabase.

  • #12211 98bcd98 Thanks @​bytaesu! - Fixed TOTP verification rejecting sessions created from an API key, so API-key sessions can now finish two-factor enrollment.

  • #12228 fbff537 Thanks @​bytaesu! - Trusted devices are honored again when an app runs the two-factor sign-in step from its own hook on another sign-in path, such as email OTP.

  • Updated dependencies [fc2e00b]:

    • @​better-auth/kysely-adapter@​1.7.17
    • @​better-auth/core@​1.7.17
    • @​better-auth/drizzle-adapter@​1.7.17
    • @​better-auth/memory-adapter@​1.7.17
    • @​better-auth/mongo-adapter@​1.7.17
    • @​better-auth/prisma-adapter@​1.7.17
    • @​better-auth/telemetry@​1.7.17

1.7.16

Patch Changes

  • #12198 f25081a Thanks @​bytaesu! - /admin/update-user now requires the new user:set-phone permission to change phoneNumber or phoneNumberVerified. If you use a custom access control, add set-phone to your statements and grant it to roles that should change phone numbers.

  • #12198 f25081a Thanks @​bytaesu! - Anonymous users are no longer linked or deleted on a sign-in that is still waiting for a second factor.

  • #12198 f25081a Thanks @​bytaesu! - Email verification and change email links now only work for the account they were issued to. Opening a change email link no longer signs the user in, and it verifies the new email only if the current one was verified.

  • #12198 f25081a Thanks @​bytaesu! - Wildcard trusted origins now match custom-scheme URLs by their parsed scheme, host, and path, and no longer match a URL with userinfo or one that cannot be parsed as an origin. A wildcard host made only of digits, dots, and wildcards, such as 192.168.*.*, now matches only IPv4 addresses in that range.

  • #12198 f25081a Thanks @​bytaesu! - Looking up a user by email now returns only an account whose stored address matches the requested one, ignoring case, even on databases with accent-insensitive collations. The email OTP password reset routes now validate the address and send the code to the address on the account.

  • #12198 f25081a Thanks @​bytaesu! - Email change codes from the email OTP plugin are now bound to the requesting account and the new address. Codes sent before the upgrade must be requested again.

  • #12198 f25081a Thanks @​bytaesu! - Fixed the email OTP checkVerificationOtp and resetPassword endpoints and the phone number resetPassword endpoint allowing more OTP guesses than allowedAttempts when requests arrive concurrently. A correct check still leaves the OTP usable for the follow-up call.

  • #12198 f25081a Thanks @​bytaesu! - The Expo authorization proxy now sets the signed state cookie only for an unexpired state issued by the server. getAuthStateVerificationIdentifier is now exported for plugins that look up OAuth state records.

  • #12198 f25081a Thanks @​bytaesu! - Passkey registration, device authorization, two-factor enrollment and verification, social account linking, and phone number changes now reject a session revoked in the database or secondary storage, even when cookie caching is enabled. Sessions created from API keys are refused on these routes, except two-factor enrollment and phone number changes.

  • #12198 f25081a Thanks @​bytaesu! - Generic OAuth providers whose discovery document has a jwks_uri now reject a user profile whose sub differs from the ID token's sub. Direct ID-token sign-in and linking with a generic OAuth provider now resolve the profile from the verified ID token only and ignore a submitted access or refresh token.

... (truncated)

Commits
  • e3ae9e1 chore: release v1.7.17 (#12214)
  • b6a87ad fix(cookies): clear the dont_remember marker on a remembered sign-in (#12181)
  • fbff537 fix(two-factor): honor trusted devices when the sign-in step runs on custom p...
  • 16aa412 fix(origin-check): validate IPv4 octets in IP wildcard trusted origins (#12217)
  • 9150314 fix(phone-number): treat empty phone number as missing (#12219)
  • cff7c1c fix(device-authorization): reject revoked cached sessions on deny (#12216)
  • f5be351 fix: keep sessions created by delete hooks during bulk revocation (#12212)
  • 98bcd98 fix(two-factor): accept API key sessions when verifying TOTP enrollment (#12211)
  • 93edae1 chore: release v1.7.16 (#12199)
  • f25081a fix: harden authentication flows (#12198)
  • Additional commits viewable in compare view

Updates better-call from 1.4.4 to 1.4.5

Release notes

Sourced from better-call's releases.

v1.4.5

   🐞 Bug Fixes

    View changes on GitHub
Commits

Updates @better-auth/kysely-adapter from 1.7.12 to 1.7.17

Release notes

Sourced from @​better-auth/kysely-adapter's releases.

v1.7.17

better-auth

Bug Fixes

  • Fixed sessions created by a session.delete.after hook being treated as revoked during "revoke all sessions" when using secondaryStorage with storeSessionInDatabase (#12212)
  • Fixed remembered sign-ins and sign-ups to refresh their session even if an earlier sign-in in the same browser used rememberMe: false (#12181)
  • Fixed denying a device authorization request to reject a revoked session that is still in the cookie cache (#12216)
  • Fixed IP wildcard trusted origins such as exp://192.168.*.*:* matching custom-scheme hosts with out-of-range or zero-padded octets (#12217)
  • Fixed the phone number plugin storing an empty phoneNumber on sign-up and replacing a verified number when linking an account with an empty phone number (#12219)
  • Fixed TOTP verification rejecting API key sessions so they can now finish two-factor enrollment (#12211)
  • Fixed trusted devices being ignored when an app runs the two-factor sign-in step from its own hook on another sign-in path, such as email OTP (#12228)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

  • Fixed Expo social sign-in to reject authorization URLs without a state parameter when OAuth state is stored in a cookie (#12218)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

  • Fixed MySQL create with generateId: "serial" leaving an inserted row behind when the table reports no auto-increment id (#12220)

For detailed changes, see CHANGELOG

@better-auth/passkey

Bug Fixes

  • Fixed passkey registration and sign-in when one passkey() plugin is shared between auth instances where only some set baseURL (#12225)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​aliamanatali, @​bytaesu

Full changelog: v1.7.16...v1.7.17

v1.7.16

better-auth

... (truncated)

Changelog

Sourced from @​better-auth/kysely-adapter's changelog.

1.7.17

Patch Changes

  • #12220 fc2e00b Thanks @​bytaesu! - On MySQL with generateId: "serial", a create that fails because the table reports no auto-increment id no longer leaves the inserted row behind, so retrying does not fail with a duplicate key error.

1.7.16

Patch Changes

  • #12198 f25081a Thanks @​bytaesu! - On MySQL with generateId: "serial", resolve the created row from the id reported by the INSERT itself instead of re-reading LAST_INSERT_ID() on a separate connection, and fail instead of guessing when no auto-increment id is reported.

1.7.15

1.7.14

1.7.13

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 7, 2026
@Madraka

Madraka commented Nov 8, 2026

Copy link
Copy Markdown
Contributor

@dependabot rebase

@dependabot dependabot Bot changed the title chore(deps): Bump the better-auth group with 6 updates chore(deps): Bump the better-auth group across 1 directory with 6 updates Nov 8, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/better-auth-f121157a06 branch from ec17c9e to e0dcc40 Compare November 8, 2026 05:09
@dependabot
chore(deps): Bump the better-auth group across 1 directory with 6 upd…
56c047b 
…ates

Bumps the better-auth group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@better-auth/api-key](https://github.com/better-auth/better-auth/tree/HEAD/packages/api-key) | `1.7.12` | `1.7.17` |
| [@better-auth/core](https://github.com/better-auth/better-auth/tree/HEAD/packages/core) | `1.7.12` | `1.7.17` |
| [@better-auth/utils](https://github.com/better-auth/utils) | `0.5.0` | `0.5.1` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.12` | `1.7.17` |
| [better-call](https://github.com/better-auth/better-call/tree/HEAD/packages/better-call) | `1.4.4` | `1.4.5` |
| [@better-auth/kysely-adapter](https://github.com/better-auth/better-auth/tree/HEAD/packages/kysely-adapter) | `1.7.12` | `1.7.17` |



Updates `@better-auth/api-key` from 1.7.12 to 1.7.17
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/api-key/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.17/packages/api-key)

Updates `@better-auth/core` from 1.7.12 to 1.7.17
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/core/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.17/packages/core)

Updates `@better-auth/utils` from 0.5.0 to 0.5.1
- [Release notes](https://github.com/better-auth/utils/releases)
- [Commits](better-auth/utils@v0.5.0...v0.5.1)

Updates `better-auth` from 1.7.12 to 1.7.17
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.17/packages/better-auth)

Updates `better-call` from 1.4.4 to 1.4.5
- [Release notes](https://github.com/better-auth/better-call/releases)
- [Commits](https://github.com/better-auth/better-call/commits/v1.4.5/packages/better-call)

Updates `@better-auth/kysely-adapter` from 1.7.12 to 1.7.17
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/kysely-adapter/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.17/packages/kysely-adapter)

---
updated-dependencies:
- dependency-name: "@better-auth/api-key"
  dependency-version: 1.7.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: better-auth
- dependency-name: "@better-auth/core"
  dependency-version: 1.7.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: better-auth
- dependency-name: "@better-auth/kysely-adapter"
  dependency-version: 1.7.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: better-auth
- dependency-name: "@better-auth/utils"
  dependency-version: 0.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: better-auth
- dependency-name: better-auth
  dependency-version: 1.7.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: better-auth
- dependency-name: better-call
  dependency-version: 1.4.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: better-auth
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/better-auth-f121157a06 branch from e0dcc40 to 56c047b Compare November 8, 2026 05:30
@Madraka
Madraka merged commit 2b0cb45 into main Nov 8, 2026
9 checks passed
@Madraka
Madraka deleted the dependabot/npm_and_yarn/better-auth-f121157a06 branch November 8, 2026 05:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Madraka