[dependabot]

Bumps the better-auth group with 6 updates:

Package	From	To
@better-auth/core	1.7.7	1.7.11
@better-auth/expo	1.7.7	1.7.11
@better-auth/i18n	1.7.7	1.7.11
@better-auth/oauth-provider	1.7.7	1.7.11
@better-auth/passkey	1.7.7	1.7.11
better-auth	1.7.7	1.7.11

Updates @better-auth/core from 1.7.7 to 1.7.11

Release notes

Sourced from @​better-auth/core's releases.

v1.7.11

better-auth

Bug Fixes

• Fixed repeated PostgreSQL migration diffs for int8 columns. (#10719)
• Fixed database-backed rate limiting returning an excessively large X-Retry-After value. (#11521)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed plugin init returns with options: undefined failing type checks under exactOptionalPropertyTypes. (#11907)
• Fixed ID token signature and claim validation for Twitch and Paybin sign-in. Custom Paybin issuers must publish RS256 signing keys at <issuer>/.well-known/jwks.json. (#11884)
• Reduced installation size while preserving OpenTelemetry instrumentation attributes. (#11623)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed OpenAPI schemas for /oauth2/consent and /oauth2/continue to match their redirect responses. (#10881)
• Fixed CIMD metadata refreshes overwriting concurrent administrator changes to discovered clients. (#11830)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

• Fixed Expo social account linking with ID tokens when a session cookie is present. (#10207)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​aryan1306, @​bytaesu, @​cpojer, @​gustavovalverde, @​noobnooc, @​rendermani, @​sahiljagtap08

Full changelog: v1.7.10...v1.7.11

v1.7.10

better-auth

Bug Fixes

... (truncated)

Changelog

Sourced from @​better-auth/core's changelog.

1.7.11

Patch Changes

• #11623 ce96569 Thanks @​cpojer! - Reduce installation size by removing the semantic conventions production dependency while preserving all instrumentation attribute keys.

• #11907 2f6ca3f Thanks @​bytaesu! - Fix plugins whose init returns options: undefined, such as testUtils(), failing to typecheck when exactOptionalPropertyTypes is enabled.

• #11884 dfd8dd2 Thanks @​bytaesu! - Twitch and Paybin sign-in now verify ID token signatures and identity claims before mapping profiles, with 30 seconds of clock tolerance. Custom Paybin issuers must expose RS256 signing keys at <issuer>/.well-known/jwks.json.

1.7.10

Patch Changes

• #11612 fedd055 Thanks @​vhinayindia! - If your resource server verifies access tokens with verifyAccessTokenRequest or verifyBearerToken and a jwksUrl, including through the MCP plugin, a key set that cannot be reached at all, for example a refused connection, now throws an error. Before, the token was rejected as invalid with 401 "no token payload", which hid the outage. A key set that answers with an HTTP error already threw.

  With remoteVerify configured, such a failure no longer falls back to remote introspection.

  The OAuth provider's /oauth2/introspect, /oauth2/userinfo and /oauth2/revoke behave the same way with the JWT plugin's jwks.remoteUrl: they return 500 instead of reporting the token as invalid.

• #11805 bbd0a19 Thanks @​gustavovalverde! - Servers that verify JWTs against a key set now refetch that key set at most once every 30 seconds per server process when a token names a key ID (kid) the cached set does not contain. This covers the OAuth provider plugin's introspection, revocation, UserInfo, and logout endpoints, and resource servers that call verifyAccessTokenRequest or verifyBearerToken with jwksUrl. Previously every such token caused a new fetch: a remote request with jwksUrl or jwks.remoteUrl, or otherwise a read of the jwks table. Anyone could send tokens with made-up kid values to force one fetch per request, and the UserInfo endpoint needs no client credentials.

  Concurrent verifications now share one fetch, and a key set fetch that takes longer than 5 seconds fails with a JWKSTimeout error instead of waiting indefinitely.

  A token signed with a newly published key still verifies without waiting for the 5-minute cache to expire. It can be rejected for up to 30 seconds if the key set was already refetched for another unknown kid in that time. No configuration change is needed.

1.7.9

1.7.8

Patch Changes

• #11512 4175b34 Thanks @​bytaesu! - Align the installed @better-auth/utils version with better-call while accepting ^0.4.2 || ^0.5.0 across official package peers.

• #11592 435645e Thanks @​drewsephski! - Fix Atlassian user info errors being logged as coming from Figma.

• #11625 369176e Thanks @​gustavovalverde! - Fixed single-use checks for apps that set advanced.database.generateId: "uuid". Default id generation is unaffected, and no migration is needed.

  • On SQLite and MySQL, SAML sign-in, DPoP-bound requests checked against the database replay store, private_key_jwt client authentication, and magic link or email OTP sign-ins that adopt an unverified account failed with a NOT NULL error on the id column. They now work. SIWE sign-in ignored the email field and used the wallet-derived address; it now uses the supplied email when no other account has it.
  • On Postgres and MongoDB, a reused SAML assertion, DPoP proof, or client assertion was accepted. Each one is now accepted only once.

  With generateId: "serial", behavior is unchanged: these checks need string ids, and Better Auth now logs a warning the first time one of these flows runs.

• #11749 e78f15a Thanks @​gustavovalverde! - ID token verification now allows 30 seconds of clock difference between your server and the identity provider when checking exp, nbf, and iat. Previously, a provider whose clock ran even slightly ahead (for example, an nbf set a fraction of a second in the future) made sign-in fail. This affected generic OAuth providers configured with discoveryUrl since 1.7.0, ID token sign-in with the built-in social providers, and Google One Tap. Tokens up to 30 seconds past exp are now also accepted. No configuration change is needed. A custom verifyIdToken replaces this check and must set its own tolerance, and the SSO plugin's OIDC sign-in is unchanged.

• #11663 60525e0 Thanks @​kaiizer777! - Fixed Microsoft Entra ID sign-in with an ID token (signIn.social with idToken, and linking an account with an ID token) rejecting every token. Microsoft publishes its signing keys without an alg field, which made verification fail. Those keys are now treated as RS256, and Microsoft ID tokens signed with any other algorithm are rejected. The redirect sign-in flow was not affected.

• #11515 916ef5c Thanks @​BilalAtique! - If you pass client to mongodbAdapter on a replica set, concurrent requests that write the same documents no longer fail with a 500. Before, MongoDB aborted all but one of them with a write conflict, so a SCIM directory that provisions several users at once returned 500 for most of them. The adapter now retries such a transaction, as MongoDB requires, for up to 120 seconds or until your MongoClient's timeoutMS. Under contention a request can take longer instead of failing.

  A retry runs the work again. databaseHooks before hooks can run more than once for one request, and after hooks still run once, after the commit. Work that the request does outside the database before it commits can also repeat on a retried request. For example, an email sign-up can send its verification email twice. Requests that succeed on the first attempt are unaffected, and so are other adapters.

... (truncated)

Commits

• 52ab801 chore: release v1.7.11 (#11827)
• 2f6ca3f fix(core): accept undefined plugin init options under exactOptionalPropertyTy...
• dfd8dd2 fix(oauth): verify Twitch and Paybin ID tokens (#11884)
• ce96569 perf(core): inline OpenTelemetry attribute constants (#11623)
• b734a41 chore: release v1.7.10 (#11795)
• bb5edcf fix(core): use a newer cached key set before joining a pending JWKS fetch (#1...
• fedd055 fix(oauth2): report an unreachable JWKS as an error, not an invalid token (#1...
• bbd0a19 fix(core): limit JWKS refetches for unknown key IDs (#11805)
• d2a5f83 chore: release v1.7.9 (#11761)
• c03ced5 chore: bump @biomejs/biome (#11760)
• Additional commits viewable in compare view

Updates @better-auth/expo from 1.7.7 to 1.7.11

Release notes

Sourced from @​better-auth/expo's releases.

v1.7.11

better-auth

Bug Fixes

• Fixed repeated PostgreSQL migration diffs for int8 columns. (#10719)
• Fixed database-backed rate limiting returning an excessively large X-Retry-After value. (#11521)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed plugin init returns with options: undefined failing type checks under exactOptionalPropertyTypes. (#11907)
• Fixed ID token signature and claim validation for Twitch and Paybin sign-in. Custom Paybin issuers must publish RS256 signing keys at <issuer>/.well-known/jwks.json. (#11884)
• Reduced installation size while preserving OpenTelemetry instrumentation attributes. (#11623)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed OpenAPI schemas for /oauth2/consent and /oauth2/continue to match their redirect responses. (#10881)
• Fixed CIMD metadata refreshes overwriting concurrent administrator changes to discovered clients. (#11830)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

• Fixed Expo social account linking with ID tokens when a session cookie is present. (#10207)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​aryan1306, @​bytaesu, @​cpojer, @​gustavovalverde, @​noobnooc, @​rendermani, @​sahiljagtap08

Full changelog: v1.7.10...v1.7.11

v1.7.10

better-auth

Bug Fixes

... (truncated)

Changelog

Sourced from @​better-auth/expo's changelog.

1.7.11

Patch Changes

• #10207 5d3d5c4 Thanks @​noobnooc! - Send the Expo origin header when linking social accounts with an ID token so native link flows that include a session cookie pass origin validation.

1.7.10

1.7.9

1.7.8

Commits

• 52ab801 chore: release v1.7.11 (#11827)
• da28c18 refactor(expo): narrow native scheme in request hooks (#11889)
• 5d3d5c4 fix(expo): send origin for id token link social (#10207)
• b734a41 chore: release v1.7.10 (#11795)
• d2a5f83 chore: release v1.7.9 (#11761)
• c03ced5 chore: bump @biomejs/biome (#11760)
• 5f4cc5c chore: release v1.7.8 (#11513)
• See full diff in compare view

Updates @better-auth/i18n from 1.7.7 to 1.7.11

Release notes

Sourced from @​better-auth/i18n's releases.

v1.7.11

better-auth

Bug Fixes

• Fixed repeated PostgreSQL migration diffs for int8 columns. (#10719)
• Fixed database-backed rate limiting returning an excessively large X-Retry-After value. (#11521)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed plugin init returns with options: undefined failing type checks under exactOptionalPropertyTypes. (#11907)
• Fixed ID token signature and claim validation for Twitch and Paybin sign-in. Custom Paybin issuers must publish RS256 signing keys at <issuer>/.well-known/jwks.json. (#11884)
• Reduced installation size while preserving OpenTelemetry instrumentation attributes. (#11623)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed OpenAPI schemas for /oauth2/consent and /oauth2/continue to match their redirect responses. (#10881)
• Fixed CIMD metadata refreshes overwriting concurrent administrator changes to discovered clients. (#11830)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

• Fixed Expo social account linking with ID tokens when a session cookie is present. (#10207)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​aryan1306, @​bytaesu, @​cpojer, @​gustavovalverde, @​noobnooc, @​rendermani, @​sahiljagtap08

Full changelog: v1.7.10...v1.7.11

v1.7.10

better-auth

Bug Fixes

... (truncated)

Changelog

Sourced from @​better-auth/i18n's changelog.

1.7.11

1.7.10

1.7.9

1.7.8

Commits

• 52ab801 chore: release v1.7.11 (#11827)
• b734a41 chore: release v1.7.10 (#11795)
• d2a5f83 chore: release v1.7.9 (#11761)
• 5f4cc5c chore: release v1.7.8 (#11513)
• See full diff in compare view

Updates @better-auth/oauth-provider from 1.7.7 to 1.7.11

Release notes

Sourced from @​better-auth/oauth-provider's releases.

v1.7.11

better-auth

Bug Fixes

• Fixed repeated PostgreSQL migration diffs for int8 columns. (#10719)
• Fixed database-backed rate limiting returning an excessively large X-Retry-After value. (#11521)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed plugin init returns with options: undefined failing type checks under exactOptionalPropertyTypes. (#11907)
• Fixed ID token signature and claim validation for Twitch and Paybin sign-in. Custom Paybin issuers must publish RS256 signing keys at <issuer>/.well-known/jwks.json. (#11884)
• Reduced installation size while preserving OpenTelemetry instrumentation attributes. (#11623)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed OpenAPI schemas for /oauth2/consent and /oauth2/continue to match their redirect responses. (#10881)
• Fixed CIMD metadata refreshes overwriting concurrent administrator changes to discovered clients. (#11830)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

• Fixed Expo social account linking with ID tokens when a session cookie is present. (#10207)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​aryan1306, @​bytaesu, @​cpojer, @​gustavovalverde, @​noobnooc, @​rendermani, @​sahiljagtap08

Full changelog: v1.7.10...v1.7.11

v1.7.10

better-auth

Bug Fixes

... (truncated)

Changelog

Sourced from @​better-auth/oauth-provider's changelog.

1.7.11

Patch Changes

• #11830 a1f6f0b Thanks @​gustavovalverde! - Apps using the CIMD plugin no longer lose an administrator's change to a discovered client when a metadata refresh is running at the same time. Before, disabling the client, setting skipConsent or enableEndSession, or assigning client_credentials scopes while its document was being fetched could be undone by the refresh. No action is needed.

• #10881 37debaa Thanks @​sahiljagtap08! - Corrected the OpenAPI response schemas for /oauth2/consent and /oauth2/continue to describe { redirect: true, url: string }, so generated clients no longer expect a nonexistent redirect_uri field. Runtime responses are unchanged.

1.7.10

Patch Changes

• #11786 cdd491b Thanks @​gustavovalverde! - DPoP proofs are accepted again for two setups that broke in v1.7.9:

  • Plugin endpoints with route params, such as /extension/:tenant/token, that issue tokens with a DPoP proof. A valid proof for /extension/acme/token was rejected with invalid_dpop_proof, because the expected htu contained the literal :tenant.
  • Token and UserInfo requests to a URL with a trailing slash, such as /api/auth/oauth2/token/, when advanced.skipTrailingSlashes is on. The proof was rejected because the expected htu dropped the slash.

  The expected htu still takes its origin and base path from baseURL, so keep baseURL set to the public URL clients call. Other setups are unaffected.

• #11815 44f14bb Thanks @​gustavovalverde! - Device-code clients that request offline_access and poll the token endpoint for only some of the RFC 8707 resources the user approved can now refresh for any approved resource. Previously, a refresh for an approved resource left out of the poll failed with invalid_target. Device codes polled without resource, or for every approved resource, are unaffected.

• #11695 fe550a9 Thanks @​gustavovalverde! - Confidential private_key_jwt clients that register inline jwks can now replace their own signing keys without a user session. Until now those keys were fixed at registration. The feature is off by default; set allowClientKeyRotation: true to enable it. No database migration is needed, but the provider refuses to start with it enabled on the memory adapter or with advanced.database.generateId: "serial", because neither enforces single-use client assertions.

  The client calls POST /oauth2/client/rotate-keys with its complete new jwks and a client assertion signed by one of its current keys, whose aud includes the rotation endpoint's URL. An assertion addressed only to the token endpoint or the issuer is rejected. Keys left out of the new set stop working at once, so roll a key in two steps: send the old and new keys together, then drop the old key once every instance signs with the new one.

• #11801 99cdfe7 Thanks @​gustavovalverde! - If postLogin.consentReferenceId returns no reference for some authorizations (for example, it returns an organization ID only for organization scopes), consent is now kept separate per reference. Approving consent without a reference no longer overwrites the consent stored for an organization, and an authorization without a reference no longer skips the consent prompt because the user consented under an organization. Previously, approving read write without a reference could replace an organization's stored read consent, so later authorizations for that organization were granted write without asking. For new authorizations, an empty string is treated the same as no reference, including the referenceId passed to token claim callbacks.

  Users may see the consent prompt once for authorizations that were previously approved through another reference's consent. Until they do, silent (prompt=none) authorizations in these setups return consent_required. Consent overwritten before this release is not repaired; users can review or revoke it through the consent management endpoints. Setups that never configured consentReferenceId, or that always return a reference, are unaffected.

• #11797 906c32f Thanks @​gustavovalverde! - If you enable dynamic client registration, Claude's MCP connector can now register. It requests urn:ietf:params:oauth:grant-type:jwt-bearer along with authorization_code and refresh_token, and Better Auth rejected the whole registration with invalid_client_metadata because one grant was unsupported. Dynamic registration now keeps the requested grants the server supports and lists them in the registration response. A request that shares no grant with the server is still rejected. Clients created with createOAuthClient or adminCreateOAuthClient still reject unsupported grants.

• #11798 2fa7e2f Thanks @​gustavovalverde! - With clientRegistrationDefaultApplicationType: "infer", clients that register an http callback on localhost, 127.0.0.1, or [::1] without application_type now register as native. This includes older Claude Code releases, which register http://127.0.0.1:<port>/callback. Current Claude Code releases send application_type: "native" and were not affected. Before, "infer" chose native only for callbacks whose scheme is not http or https, so these registrations were treated as web and rejected with invalid_redirect_uri. The "web" default and the "native" setting are unchanged, and an application_type the client sends is never overridden.

• #11176 8f3da46 Thanks @​Bekacru! - The token endpoint now returns invalid_client instead of invalid_grant when a request names a client_id that is not registered, for the authorization_code, refresh_token, and device code grants. MCP clients whose registration was deleted, for example by a database reset or an upgrade that dropped OAuth tables, now register again and prompt the user to sign in. Before, they kept the deleted client_id and stayed signed out until the user cleared their saved credentials by hand. A registered client that sends wrong credentials also gets invalid_client now, even when its code or refresh token is also invalid.

• #11596 963b7f9 Thanks @​mahoor! - /oauth2/userinfo, /oauth2/introspect and /oauth2/revoke now answer a JWT that fails verification the way they answer any unknown token. Before, they returned an empty 500. This covers an alg: none token, a tampered signature, an unknown kid and a wrong issuer: userinfo returns 401 invalid_token with a WWW-Authenticate challenge, introspection returns { "active": false }, and revocation returns its unknown-token error. Valid JWT and opaque access tokens are unaffected, including JWT-shaped tokens issued by generateOpaqueAccessToken.

  If you set disableJwtPlugin: true, a JWT-shaped token that is not a stored access token, such as an ID token, now gets the same unknown-token response instead of a 500.

  A key set the server cannot use, such as one where two keys share a kid, still returns 500.

• #11781 e34b828 Thanks @​gustavovalverde! - If you configure cachedTrustedClients, attempts to update, delete, or rotate the secret of one of those clients through the client management endpoints now fail with HTTP 400 instead of 500. The response body is unchanged (error: "invalid_client"), so only code that branches on the status code is affected. A 500 previously made a deliberate refusal look like a server failure.

• #11799 f42c0c2 Thanks @​gustavovalverde! - Requests that name a client_id the server does not know now fail with error_description set to client not found. Before, /oauth2/authorize said client_id is required, which read as a missing parameter, /oauth2/token, /oauth2/revoke, and /oauth2/introspect said missing client, and requests that authenticate with a private_key_jwt client assertion said unknown client. You would see this, for example, when an MCP client kept a registration the server had deleted. The invalid_client error code is unchanged.

• #11724 4d7da0b Thanks @​drewsephski! - Clients exchanging an authorization code with PKCE now get the token errors RFC 7636 and RFC 6749 specify. A code_verifier that does not match the authorization request's code_challenge returns HTTP 400 invalid_grant; it previously returned HTTP 401 invalid_request. For clients where PKCE is optional, a missing or unexpected code_verifier still returns invalid_request, now with HTTP 400 instead of 401. No request that failed before now succeeds.

1.7.9

Patch Changes

... (truncated)

Commits

• 52ab801 chore: release v1.7.11 (#11827)
• a1f6f0b fix(oauth-provider): keep admin changes made during a CIMD refresh (#11830)
• 37debaa fix(oauth-provider): correct consent and continue OpenAPI response schemas (#...
• b734a41 chore: release v1.7.10 (#11795)
• 61c913d fix(oauth-provider): report an unknown client in a client assertion as not fo...
• 4d7da0b fix(oauth-provider): return 400 invalid_grant on PKCE verifier mismatch (#11724)
• 8f3da46 fix(oauth-provider): return invalid_client for an unknown client at the token...
• 44f14bb fix(oauth-provider): keep approved resources refreshable after a narrowed dev...
• fedd055 fix(oauth2): report an unreachable JWKS as an error, not an invalid token (#1...
• 963b7f9 fix(oauth-provider): treat unverifiable JWT access tokens as invalid (#11596)
• Additional commits viewable in compare view

Updates @better-auth/passkey from 1.7.7 to 1.7.11

Release notes

Sourced from @​better-auth/passkey's releases.

v1.7.11

better-auth

Bug Fixes

• Fixed repeated PostgreSQL migration diffs for int8 columns. (#10719)
• Fixed database-backed rate limiting returning an excessively large X-Retry-After value. (#11521)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed plugin init returns with options: undefined failing type checks under exactOptionalPropertyTypes. (#11907)
• Fixed ID token signature and claim validation for Twitch and Paybin sign-in. Custom Paybin issuers must publish RS256 signing keys at <issuer>/.well-known/jwks.json. (#11884)
• Reduced installation size while preserving OpenTelemetry instrumentation attributes. (#11623)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed OpenAPI schemas for /oauth2/consent and /oauth2/continue to match their redirect responses. (#10881)
• Fixed CIMD metadata refreshes overwriting concurrent administrator changes to discovered clients. (#11830)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

• Fixed Expo social account linking with ID tokens when a session cookie is present. (#10207)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​aryan1306, @​bytaesu, @​cpojer, @​gustavovalverde, @​noobnooc, @​rendermani, @​sahiljagtap08

Full changelog: v1.7.10...v1.7.11

v1.7.10

better-auth

Bug Fixes

... (truncated)

Changelog

Sourced from @​better-auth/passkey's changelog.

1.7.11

1.7.10

1.7.9

1.7.8

Patch Changes

• #11512 4175b34 Thanks @​bytaesu! - Align the installed @better-auth/utils version with better-call while accepting ^0.4.2 || ^0.5.0 across official package peers.

Commits

• 52ab801 chore: release v1.7.11 (#11827)
• b734a41 chore: release v1.7.10 (#11795)
• d2a5f83 chore: release v1.7.9 (#11761)
• 5f4cc5c chore: release v1.7.8 (#11513)
• 4175b34 fix(deps): align @better-auth/utils with better-call (#11512)
• See full diff in compare view

Updates better-auth from 1.7.7 to 1.7.11

Release notes

Sourced from better-auth's releases.

v1.7.11

better-auth

Bug Fixes

• Fixed repeated PostgreSQL migration diffs for int8 columns. (#10719)
• Fixed database-backed rate limiting returning an excessively large X-Retry-After value. (#11521)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed plugin init returns with options: undefined failing type checks under exactOptionalPropertyTypes. (#11907)
• Fixed ID token signature and claim validation for Twitch and Paybin sign-in. Custom Paybin issuers must publish RS256 signing keys at <issuer>/.well-known/jwks.json. (#11884)
• Reduced installation size while preserving OpenTelemetry instrumentation attributes. (#11623)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed OpenAPI schemas for /oauth2/consent and /oauth2/continue to match their redirect responses. (#10881)
• Fixed CIMD metadata refreshes overwriting concurrent administrator changes to discovered clients. (#11830)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

• Fixed Expo social account linking with ID tokens when a session cookie is present. (#10207)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​aryan1306, @​bytaesu, @​cpojer, @​gustavovalverde, @​noobnooc, @​rendermani, @​sahiljagtap08

Full changelog: v1.7.10...v1.7.11

v1.7.10

better-auth

Bug Fixes

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.11

Patch Changes

• #10719 bd65db0 Thanks @​rendermani! - Recognize PostgreSQL int8 as a valid number type in migration diffs. Kysely's introspector reports pg_type.typname, so Better Auth's own bigint columns (such as the database-backed rate limiter's lastRequest) came back as int8 and were reported as a type mismatch on every run.

• #11521 37a75c9 Thanks @​aryan1306! - Fix database-backed rate limiting returning an excessively large X-Retry-After header instead of the remaining seconds in the rate-limit window.

• Updated dependencies [ce96569, 2f6ca3f, dfd8dd2]:

  • @​better-auth/core@​1.7.11
  • @​better-auth/drizzle-adapter@​1.7.11
  • @​better-auth/kysely-adapter@​1.7.11
  • @​better-auth/memory-adapter@​1.7.11
  • @​better-auth/mongo-adapter@​1.7.11
  • @​better-auth/prisma-adapter@​1.7.11
  • @​better-auth/telemetry@​1.7.11

1.7.10

Patch Changes

• #11393 eebd47a Thanks @​breken-ai! - If you use the lastLoginMethod plugin with oneTap, signing in through Google One Tap now records "google", the same value as signing in with the Google button. Before, a One Tap sign-in recorded nothing: the better-auth.last_used_login_method cookie kept its previous value or stayed unset, and so did user.lastLoginMethod with storeInDatabase.

  If your customResolveMethod includes a /one-tap/callback → "google" workaround, remove that mapping; keep the resolver if it handles other routes.

• #11821 09d07e6 Thanks @​gustavovalverde! - The Google One Tap prompt (authClient.oneTap() without button) no longer calls getSkippedReason(), which Google's FedCM migration guide says to remove. Before, it called it under any promptOptions.fedCM setting.

  A skipped prompt now ends the flow and calls onPromptNotification right away instead of retrying. Google doesn't report why a prompt was skipped, and a prompt the user closed stays hidden for Google's cooldown period, so the retries could not bring it back. Dismissed prompts still retry as before.

  Google Identity Services still logs its FedCM migration warning, because it does so whenever prompt() receives a listener. The plugin needs the listener to track dismissals and skips, so the warning is expected and safe to ignore.

• #11819 eaecb72 Thanks @​gustavovalverde! - Google One Tap now applies your socialProviders.google.mapProfileToUser and custom getUserInfo, the same as the standard Google sign-in. Before, One Tap ignored both and always stored the token's name, email, email_verified, and picture claims.

  If you configured either one, users created through One Tap now get the fields it returns, including any extra fields such as a first name from given_name. Returning users are updated from it on each One Tap sign-in when socialProviders.google.overrideUserInfoOnSignIn is on, and so are existing users that One Tap links when account.accountLinking.updateUserInfoOnLink is on. Check that your mapper suits One...

  Description has been truncated

[dependabot]

Looks like these dependencies are no longer updatable, so this is no longer needed.