chore(deps): update better-auth monorepo to v1.7.0-rc.4

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@better-auth/test-utils (source)	1.7.0-rc.1 → 1.7.0-rc.4
better-auth (source)	1.7.0-rc.1 → 1.7.0-rc.4

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

better-auth/better-auth (@​better-auth/test-utils)

v1.7.0-rc.4

Compare Source

better-auth

Features

• Added a placeholder email utility for generating temporary email addresses (#​10576)

Bug Fixes

• Fixed sessions not being cleaned up when a user is deleted (#​10520)
• Fixed missing PKCE challenge in Apple OAuth flows (#​10294)
• Fixed duplicate in-flight session requests when React retries a suspended component (#​10676)
• Fixed cookie cache to work independently of the JWT plugin internals (#​10666)
• Fixed findSessions to skip null-parsed session tokens instead of returning early (#​10580)
• Fixed missing verification type when sending email OTP during sign-up (#​10608)
• Fixed OTP being cleared after password validation errors in email OTP flows (#​10552)
• Fixed email OTP to verify the code before revealing whether the email exists (#​10605)
• Fixed client plugin type inference when using jwtClient (#​10513)
• Fixed JWT signing to use the transaction-scoped adapter (#​10623)
• Fixed Apple user data being lost when using the OAuth proxy (#​10599)
• Fixed Google One Tap to enforce provider signup restrictions (#​10479)
• Fixed client plugin type inference when using oneTapClient (#​10635)
• Fixed rate limit database cleanup to be awaited by default (#​10619)
• Fixed $fetch and $store not being exposed on the Solid client (#​10444)
• Improved Next.js performance by reusing the next/headers import promise in production (#​10467)

For detailed changes, see CHANGELOG

@better-auth/expo

❗ Breaking Changes

• Switched to async secure storage access to prevent crashes when iOS Keychain is unavailable (#​10438)

Migration: getCookie() now returns a Promise. Custom storage implementations must provide both sync and async SecureStore methods, and should use setItemAsync() when the write must be awaited.

For detailed changes, see CHANGELOG

@better-auth/redis-storage

Bug Fixes

• Fixed Redis storage to use SCAN instead of KEYS to avoid blocking the server (#​10507)

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

• Fixed SCIM PATCH to create filtered attribute values when no target matches, instead of rejecting with a noTarget error (#​10682)

For detailed changes, see CHANGELOG

auth

Bug Fixes

• Fixed issuer-scoped account identities being overwritten during OAuth flows (#​10668)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​birkskyum, @​bytaesu, @​Emmaccen, @​gustavovalverde, @​jashkarangiya, @​jeroenvandermerwe, @​jlucaso1, @​jsj, @​krish-vachhani, @​mrosberghaus, @​XXMOHAMED012

Full changelog: v1.7.0-rc.3...v1.7.0-rc.4

v1.7.0-rc.3

Compare Source

better-auth

❗ Breaking Changes

• Added database indexes for device and user code lookups in the device authorization flow (#​10059)

Migration: MySQL and SQL Server users must convert device code and user code columns to bounded strings (max 191 characters) and resolve any oversized values before applying the migration.

• Changed Microsoft and microsoftEntraId accounts to use the stable oid claim as the account identifier instead of sub (#​10204)

Migration: Migrate existing Microsoft account rows keyed by sub to oid before upgrading; tokens without a valid oid claim are rejected after the update.

Features

• Added RP-initiated logout support for Generic OAuth providers, redirecting users to their OpenID provider's logout endpoint on sign-out (#​9368)
• Added RFC 8628 device authorization grant support to the OAuth provider, enabling device-flow token exchanges for registered OAuth clients (#​10135)

Bug Fixes

• Enabled native database transactions in test instances for Postgres and MySQL databases.
• Fixed a deadlock during sign-up when JWT session caching and native transactions are both enabled on single-connection databases (#​10622)
• Fixed TypeScript errors when composing One Tap, Electron, and Expo plugins with createAuthClient (#​10505)

For detailed changes, see CHANGELOG

@better-auth/core

❗ Breaking Changes

• Changed Microsoft and microsoftEntraId accounts to use the stable oid claim as the account identifier instead of sub (#​10204)

Migration: Migrate existing Microsoft account rows keyed by sub to oid before upgrading; tokens without a valid oid claim are rejected after the update.

Features

• Added RP-initiated logout support for Generic OAuth providers, redirecting users to their OpenID provider's logout endpoint on sign-out (#​9368)

Bug Fixes

• Fixed TypeScript errors when composing One Tap, Electron, and Expo plugins with createAuthClient (#​10505)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

❗ Breaking Changes

• Aligned MCP authorization with the 2026-07-28 specification, replacing legacy type/public client fields with applicationType and enforcing stricter redirect validation and scope controls (#​10577)

Migration: Apply a database migration to add applicationType, nullable clientDiscoveryId, and clientCredentialsScopes columns; backfill applicationType from existing values and clientCredentialsScopes to [] for all clients; deduplicate (clientId, resourceId) pairs before applying the new unique index. Replace OAuthClient string-index accesses with OAuthClient & YourExtensionMetadata, and compose mcp() with cimd() explicitly if using Client ID Metadata Documents.

Features

• Added RFC 8628 device authorization grant support to the OAuth provider, enabling device-flow token exchanges for registered OAuth clients (#​10135)

Bug Fixes

• Fixed MCP scope enforcement to return a 403 with an RFC 6750 insufficient_scope WWW-Authenticate challenge listing all missing scopes, allowing clients to request them in a single authorization request.

For detailed changes, see CHANGELOG

@better-auth/cimd

❗ Breaking Changes

• Aligned MCP authorization with the 2026-07-28 specification, replacing legacy type/public client fields with applicationType and enforcing stricter redirect validation and scope controls (#​10577)

Migration: Apply a database migration to add applicationType, nullable clientDiscoveryId, and clientCredentialsScopes columns; backfill applicationType from existing values and clientCredentialsScopes to [] for all clients; deduplicate (clientId, resourceId) pairs before applying the new unique index. Replace OAuthClient string-index accesses with OAuthClient & YourExtensionMetadata, and compose mcp() with cimd() explicitly if using Client ID Metadata Documents.

Bug Fixes

• Fixed Client ID Metadata Document caching to follow shared-cache freshness rules, preferring s-maxage, honoring conditional revalidation, and treating ambiguous or duplicate freshness directives as immediately stale to prevent unique-constraint failures on concurrent refreshes.

For detailed changes, see CHANGELOG

@better-auth/mcp

❗ Breaking Changes

• Aligned MCP authorization with the 2026-07-28 specification, replacing legacy type/public client fields with applicationType and enforcing stricter redirect validation and scope controls (#​10577)

Migration: Apply a database migration to add applicationType, nullable clientDiscoveryId, and clientCredentialsScopes columns; backfill applicationType from existing values and clientCredentialsScopes to [] for all clients; deduplicate (clientId, resourceId) pairs before applying the new unique index. Replace OAuthClient string-index accesses with OAuthClient & YourExtensionMetadata, and compose mcp() with cimd() explicitly if using Client ID Metadata Documents.

For detailed changes, see CHANGELOG

@better-auth/scim

Features

• Added SCIM Enterprise User extension attributes and classic user attributes with improved Microsoft Entra interoperability (#​10620)
• Added a managed connection catalog for runtime SCIM tenant connection and credential management through server-only auth.api methods (#​10592)

Bug Fixes

• Fixed Microsoft Entra interoperability by accepting case-insensitive string boolean values for the SCIM active field and primary sub-attributes of emails, phoneNumbers, addresses, roles, and entitlements at the HTTP ingress.
• Added managedConnections configuration to allow trusted server code to create, issue, rotate, and revoke SCIM tenant connections and bearer credentials through server-only auth.api methods without a code-defined connection.
• Fixed dynamic SCIM connection decommissioning to allow retaining a terminal connection binding by supplying the provisioning domain before the first authenticated request.

For detailed changes, see CHANGELOG

@better-auth/sso

Features

• Extended resolveUser to SAML sign-ins with a discriminated protocol field, and added guardProviderMutation to authorize SSO provider updates and deletions (#​10621)

Bug Fixes

• Fixed SSO provider registration to allow reusing a SCIM connection ID, since SCIM connections no longer participate in the authentication provider namespace.
• Improved SAML security by verifying assertion signatures on the raw XML rather than a pre-parsed response, enforcing signing policy and size limits on SP metadata, and correcting wantAssertionsSigned to control assertion signing instead of response signing.

For detailed changes, see CHANGELOG

@better-auth/electron

Bug Fixes

• Fixed TypeScript errors when composing One Tap, Electron, and Expo plugins with createAuthClient (#​10505)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

• Fixed TypeScript errors when composing One Tap, Electron, and Expo plugins with createAuthClient (#​10505)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• Fixed raw database instances (better-sqlite3, node:sqlite, bun:sqlite, mysql2, pg) passed directly as database to automatically receive native adapter transactions, matching the explicit { db }/{ dialect } config shapes and unblocking plugins like @better-auth/scim when using the quickstart configuration.

For detailed changes, see CHANGELOG

@better-auth/passkey

Features

• Added an optional createSession setting to passkey registration that signs the user in automatically on successful registration (#​9873)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​brentmitchell25, @​GautamBytes, @​gustavovalverde

Full changelog: v1.7.0-rc.2...v1.7.0-rc.3

v1.7.0-rc.2

Compare Source

better-auth

❗ Breaking Changes

• chore!: move joins to advanced.database.joins (#​10359)

  If you previously set experimental: { joins: true }, update your config to:

  advanced: {
    database: {
      joins: true,
    },
  }

  Adapters that support native joins use them when enabled. If an adapter cannot return joined data for a query, Better Auth falls back to additional queries and combines the results. Drizzle and Prisma users should ensure their schema includes the required relations (npx auth@latest generate).

• feat(auth)!: scope accounts by issuer (#​10403)

  This release is breaking. Account.accountId is renamed to Account.providerAccountId, and Account.issuer is required. Account-specific APIs select the local Account.id through accountId; token and provider-profile APIs can instead select the signed account cookie with useAccountCookie: true. Credential accounts use local:credential and the linked user's stable id as their provider identity.

  OAuth provider identity now comes from raw verified profiles. OpenID Connect discovery uses sub, plain OAuth uses id, and providers can declare accountSubject for another immutable field; Better Auth no longer switches between sub and id at runtime. getUserInfo().user no longer carries provider identity, and mapProfileToUser cannot return id. Read the selected identity from accountInfo.account.providerAccountId instead of accountInfo.user.id. The generic microsoftEntraId helper now requires a concrete tenant GUID; use the built-in Microsoft provider for multi-tenant authorities.

  SSO account subjects are now protocol-defined. OIDC uses the verified sub claim, and SAML uses the signed NameID; mapping.id is removed from both configurations. A manual SAML configuration without metadata XML must set idpMetadata.entityID, because samlConfig.issuer identifies the service provider and no longer acts as the IdP identity.

  Apply the reviewed account-identity backfill in the Better Auth 1.7 upgrade guide before deploying. The generated schema migration cannot assign trusted issuers or resolve existing identity collisions automatically.

• feat(scim)!: decouple provisioning from the organization plugin (#​10390)

  This replaces the previous SCIM configuration, client APIs, database schema, and organization-backed Group model. Existing SCIM installations cannot migrate provisioning state in place. Follow the SCIM cutover in the 1.7 upgrade guide, including full directory reprovisioning, before resuming traffic.

  Deferred database side effects now run only after a successful transaction. A rolled-back User update no longer refreshes its cached profile, and a rolled-back bulk session revocation no longer invalidates sessions.

Features

• feat: add ctx to verifyIdToken (#​10376)
• feat(db): add compound table indexes (#​10402)
• feat(last-login-method): beforeStoreCookie option for GDPR compliance (#​5753)
• feat(organization): add getOrganization for metadata-only fetches (#​10397)
• feat(sso): add transactional OIDC user resolution (#​10473)

Bug Fixes

• chore: widen drizzle-kit peer dependency range (#​10299)
• fix: get-session should have no-cache cache control headers (#​10222)
• fix: recognize BIGINT as valid number type for SQLite in migrations. (#​10316)
• fix(auth): handle request clone failures in callbacks (#​10336)
• fix(client): preserve null in useSession().data type with throw:true (#​9787)
• fix(client): restore auth query lifecycle after remount (#​10379)
• fix(cookies): tighten CookieAttributes index signature type (#​10441) (#​10442)
• fix(core): dedup request-state AsyncLocalStorage init to fix intermittent "No request state found" (#​9862)
• fix(core): resolve user.modelName collisions in references and adapter (#​10235)
• fix(db): avoid duplicate unique indexes in kysely migrations (#​10357)
• fix(magic-link, email-otp): force-validate Origin on cookieless send endpoints (#​10368)
• fix(mcp): expose remote auth challenge headers (#​10290)
• fix(open-api): include plugin user fields on sign-up/update bodies (#​10453)
• fix(organization): apply membershipLimit to listMembers user fetch (#​10342)
• fix(organization): let the database generate invitation ids (#​10040)
• fix(siwe): issue addressless nonces (#​10234)

For detailed changes, see CHANGELOG

@better-auth/core

❗ Breaking Changes

• chore!: move joins to advanced.database.joins (#​10359)

  If you previously set experimental: { joins: true }, update your config to:

  advanced: {
    database: {
      joins: true,
    },
  }

  Adapters that support native joins use them when enabled. If an adapter cannot return joined data for a query, Better Auth falls back to additional queries and combines the results. Drizzle and Prisma users should ensure their schema includes the required relations (npx auth@latest generate).

• feat(auth)!: scope accounts by issuer (#​10403)

  This release is breaking. Account.accountId is renamed to Account.providerAccountId, and Account.issuer is required. Account-specific APIs select the local Account.id through accountId; token and provider-profile APIs can instead select the signed account cookie with useAccountCookie: true. Credential accounts use local:credential and the linked user's stable id as their provider identity.

  OAuth provider identity now comes from raw verified profiles. OpenID Connect discovery uses sub, plain OAuth uses id, and providers can declare accountSubject for another immutable field; Better Auth no longer switches between sub and id at runtime. getUserInfo().user no longer carries provider identity, and mapProfileToUser cannot return id. Read the selected identity from accountInfo.account.providerAccountId instead of accountInfo.user.id. The generic microsoftEntraId helper now requires a concrete tenant GUID; use the built-in Microsoft provider for multi-tenant authorities.

  SSO account subjects are now protocol-defined. OIDC uses the verified sub claim, and SAML uses the signed NameID; mapping.id is removed from both configurations. A manual SAML configuration without metadata XML must set idpMetadata.entityID, because samlConfig.issuer identifies the service provider and no longer acts as the IdP identity.

  Apply the reviewed account-identity backfill in the Better Auth 1.7 upgrade guide before deploying. The generated schema migration cannot assign trusted issuers or resolve existing identity collisions automatically.

• feat(scim)!: decouple provisioning from the organization plugin (#​10390)

  This replaces the previous SCIM configuration, client APIs, database schema, and organization-backed Group model. Existing SCIM installations cannot migrate provisioning state in place. Follow the SCIM cutover in the 1.7 upgrade guide, including full directory reprovisioning, before resuming traffic.

  Deferred database side effects now run only after a successful transaction. A rolled-back User update no longer refreshes its cached profile, and a rolled-back bulk session revocation no longer invalidates sessions.

Features

• feat(db): add compound table indexes (#​10402)
• feat(sso): add transactional OIDC user resolution (#​10473)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

❗ Breaking Changes

• chore!: move joins to advanced.database.joins (#​10359)

  If you previously set experimental: { joins: true }, update your config to:

  advanced: {
    database: {
      joins: true,
    },
  }

  Adapters that support native joins use them when enabled. If an adapter cannot return joined data for a query, Better Auth falls back to additional queries and combines the results. Drizzle and Prisma users should ensure their schema includes the required relations (npx auth@latest generate).

Features

• feat(db): add compound table indexes (#​10402)
• feat(drizzle): generate drizzle schema with schema namespace (#​7169)

For detailed changes, see CHANGELOG

@better-auth/sso

❗ Breaking Changes

• feat(auth)!: scope accounts by issuer (#​10403)

  This release is breaking. Account.accountId is renamed to Account.providerAccountId, and Account.issuer is required. Account-specific APIs select the local Account.id through accountId; token and provider-profile APIs can instead select the signed account cookie with useAccountCookie: true. Credential accounts use local:credential and the linked user's stable id as their provider identity.

  OAuth provider identity now comes from raw verified profiles. OpenID Connect discovery uses sub, plain OAuth uses id, and providers can declare accountSubject for another immutable field; Better Auth no longer switches between sub and id at runtime. getUserInfo().user no longer carries provider identity, and mapProfileToUser cannot return id. Read the selected identity from accountInfo.account.providerAccountId instead of accountInfo.user.id. The generic microsoftEntraId helper now requires a concrete tenant GUID; use the built-in Microsoft provider for multi-tenant authorities.

  SSO account subjects are now protocol-defined. OIDC uses the verified sub claim, and SAML uses the signed NameID; mapping.id is removed from both configurations. A manual SAML configuration without metadata XML must set idpMetadata.entityID, because samlConfig.issuer identifies the service provider and no longer acts as the IdP identity.

  Apply the reviewed account-identity backfill in the Better Auth 1.7 upgrade guide before deploying. The generated schema migration cannot assign trusted issuers or resolve existing identity collisions automatically.

Features

• feat(sso): add transactional OIDC user resolution (#​10473)

Bug Fixes

• fix(sso): redirect idp initiated saml flows in split origin deployments (#​10388)

For detailed changes, see CHANGELOG

@better-auth/scim

❗ Breaking Changes

• feat(scim)!: decouple provisioning from the organization plugin (#​10390)

  This replaces the previous SCIM configuration, client APIs, database schema, and organization-backed Group model. Existing SCIM installations cannot migrate provisioning state in place. Follow the SCIM cutover in the 1.7 upgrade guide, including full directory reprovisioning, before resuming traffic.

  Deferred database side effects now run only after a successful transaction. A rolled-back User update no longer refreshes its cached profile, and a rolled-back bulk session revocation no longer invalidates sessions.

Features

• feat(scim): expose active provisioned user links (#​10474)

For detailed changes, see CHANGELOG

auth

Features

• feat(db): add compound table indexes (#​10402)

Bug Fixes

• fix: stub SvelteKit's explicit-environment-variables modules (#​10221)
• fix(cli): avoid duplicate unique indexes in drizzle schema (#​10333)
• fix(cli): disambiguate Drizzle relations with relationName (#​10352)
• fix(cli): recover when auth generate's config self-imports its own output (#​10302)

For detailed changes, see CHANGELOG

@better-auth/electron

Bug Fixes

• fix(electron): forward each Set-Cookie from /electron/init-oauth-proxy individually (#​9672)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• fix(kysely-adapter): restore local migration constants (#​10377)

For detailed changes, see CHANGELOG

@better-auth/mongo-adapter

Features

• feat(db): add compound table indexes (#​10402)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• fix(oauth-provider): defer logout effects until commit (#​10472)

For detailed changes, see CHANGELOG

@better-auth/stripe

Bug Fixes

• fix(organization): pass endpoint context to organization delete hooks (#​10190)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​akshatmalik-bruh, @​ayushman46, @​c-nicol, @​gaurav-init, @​gaurav0107, @​GautamBytes, @​gustavovalverde, @​momomuchu, @​OrangeManLi, @​paoloricciuti, @​ping-maxwell, @​shiminshen, @​swithek, @​Tushar-Khandelwal-2004, @​vinay-oppuri

Full changelog: v1.7.0-rc.1...v1.7.0-rc.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.