[dependabot]

Bumps better-auth from 1.6.25 to 1.7.12.

Release notes

Sourced from better-auth's releases.

v1.7.12

[!IMPORTANT] Action required

• If you use ID token sign-in with a provider that has no clientId, set clientId to every client ID your apps sign in with. (#11931)

better-auth

Bug Fixes

• Fixed the JWT plugin to verify JWTs and session cookie-cache JWTs with the stored key's algorithm instead of the token header's, and to warn when signing or verifying a JWT without an issuer or audience (#11925)
• Fixed OAuth callbacks completed through the OAuth proxy to run the same checks as the standard OAuth callback, including issuer and ID token nonce validation (#11930)
• Fixed auth.api.getSession() to keep the original database error as error.cause when the session lookup fails (#11924)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed mapProfileToUser failing to typecheck under exactOptionalPropertyTypes when it returns undefined for name, email, or image (#11918)
• Fixed ID token sign-in to reject tokens when the provider has no client ID, since their audience cannot be checked (#11931)
• Fixed a custom Facebook getUserInfo to no longer receive client-submitted access tokens issued to another Facebook app, and ID tokens missing exp or iat are now rejected (#11919)
• Restored the Twitch and Paybin ID token handling from before 1.7.11, which made account info fail once the ID token stored at sign-in expired (#11920)
• Added a cause option as a third argument to APIError.from() to keep the underlying error for server-side callers without exposing it in the response (#11924)

For detailed changes, see CHANGELOG

@better-auth/mcp

Bug Fixes

• Fixed requireMcpAuth to accept only OAuth access tokens and reject session JWTs from the JWT plugin, even when they share the issuer and audience (#11934)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed OIDC SSO sign-in to reject ID tokens missing exp or iat and providers with an empty client ID, matching social sign-in (#11935)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​alpcanaydin, @​bytaesu

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.12

Patch Changes

• #11925 fb48619 Thanks @​bytaesu! - The JWT plugin now verifies JWTs and session cookie-cache JWTs with the algorithm of the stored key instead of the one named in the token header, and logs a warning when it signs or verifies a JWT without an issuer or audience.

• #11924 681aa5c Thanks @​bytaesu! - auth.api.getSession() now keeps the original database error as error.cause when the session lookup fails, so server code can tell a transient failure from a bug.

• #11930 b18e3b8 Thanks @​bytaesu! - OAuth callbacks completed through the OAuth proxy now run the same checks as the standard OAuth callback, including issuer and ID token nonce validation.

• Updated dependencies [681aa5c, 4bc78ba, 876608d, 083a743, 492134a]:

  • @​better-auth/core@​1.7.12
  • @​better-auth/drizzle-adapter@​1.7.12
  • @​better-auth/kysely-adapter@​1.7.12
  • @​better-auth/memory-adapter@​1.7.12
  • @​better-auth/mongo-adapter@​1.7.12
  • @​better-auth/prisma-adapter@​1.7.12
  • @​better-auth/telemetry@​1.7.12

1.7.11

Patch Changes

• #10719 bd65db0 Thanks @​rendermani! - Recognize PostgreSQL int8 as a valid number type in migration diffs. Kysely's introspector reports pg_type.typname, so Better Auth's own bigint columns (such as the database-backed rate limiter's lastRequest) came back as int8 and were reported as a type mismatch on every run.

• #11521 37a75c9 Thanks @​aryan1306! - Fix database-backed rate limiting returning an excessively large X-Retry-After header instead of the remaining seconds in the rate-limit window.

• Updated dependencies [ce96569, 2f6ca3f, dfd8dd2]:

  • @​better-auth/core@​1.7.11
  • @​better-auth/drizzle-adapter@​1.7.11
  • @​better-auth/kysely-adapter@​1.7.11
  • @​better-auth/memory-adapter@​1.7.11
  • @​better-auth/mongo-adapter@​1.7.11
  • @​better-auth/prisma-adapter@​1.7.11
  • @​better-auth/telemetry@​1.7.11

1.7.10

Patch Changes

• #11393 eebd47a Thanks @​breken-ai! - If you use the lastLoginMethod plugin with oneTap, signing in through Google One Tap now records "google", the same value as signing in with the Google button. Before, a One Tap sign-in recorded nothing: the better-auth.last_used_login_method cookie kept its previous value or stayed unset, and so did user.lastLoginMethod with storeInDatabase.

  If your customResolveMethod includes a /one-tap/callback → "google" workaround, remove that mapping; keep the resolver if it handles other routes.

• #11821 09d07e6 Thanks @​gustavovalverde! - The Google One Tap prompt (authClient.oneTap() without button) no longer calls getSkippedReason(), which Google's FedCM migration guide says to remove. Before, it called it under any promptOptions.fedCM setting.

  A skipped prompt now ends the flow and calls onPromptNotification right away instead of retrying. Google doesn't report why a prompt was skipped, and a prompt the user closed stays hidden for Google's cooldown period, so the retries could not bring it back. Dismissed prompts still retry as before.

  Google Identity Services still logs its FedCM migration warning, because it does so whenever prompt() receives a listener. The plugin needs the listener to track dismissals and skips, so the warning is expected and safe to ignore.

... (truncated)

Commits

• f4260a9 chore: release v1.7.12 (#11922)
• b18e3b8 fix(oauth-proxy): run the standard callback checks on proxied callbacks (#11930)
• fb48619 fix(jwt): verify tokens with the stored key's algorithm (#11925)
• 681aa5c fix(session): keep the cause of session lookup failures (#11924)
• 52ab801 chore: release v1.7.11 (#11827)
• 37a75c9 fix(rate-limit): convert a string lastRequest before computing X-Retry-After ...
• bd65db0 fix(db): recognize postgres int8 as a number type in migration diffs (#10719)
• b734a41 chore: release v1.7.10 (#11795)
• eebd47a fix(last-login-method): record Google One Tap sign-ins (#11393)
• eaecb72 fix(one-tap): apply the Google provider's mapProfileToUser and getUserInfo (#...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Assignees

The following users could not be added as assignees: mavric-team. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.