Bump better-auth from 1.7.5 to 1.7.7

[dependabot]

Bumps better-auth from 1.7.5 to 1.7.7.

Release notes

Sourced from better-auth's releases.

v1.7.7

better-auth

Magic Link upgrade: Upgrade servers sharing verification storage together, request new Magic Links, and restart pending OAuth/SAML sign-ins. No database migration is required. See the critical advisory for affected configurations and custom storage changes.

Bug Fixes

• Fixed a critical Magic Link account-takeover vulnerability. (#11494)
• Fixed ID-token sign-in ignoring the social provider’s disableSignUp setting. (#11491)
• Fixed OAuth Proxy accepting sign-in state as a provider profile. (#11494) Upgrade all OAuth Proxy participants together; see the OAuth Proxy upgrade guidance.
• Fixed CAPTCHA errors missing the JSON Content-Type header. (#11476)
• Fixed the active organization failing to refresh after sign-in when a session hook selects the initial organization. (#11375)
• Fixed rate-limit errors missing the JSON Content-Type header. (#11469)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

• Added optional validateRedirectUri validation for trusted deployments with dynamic OAuth redirect URIs. (#8686)
• Added verifyOAuthQueryParams to verify signed authorization queries before rendering a custom consent page. (#11402)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed concurrent PostgreSQL requests exceeding database-backed rate limits. (#11331)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• Fixed consumeOne deleting a record after a concurrent write invalidates its original condition. (#11495)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​aryan1306, @​bytaesu, @​gitmotion, @​gustavovalverde, @​lennondotw

Full changelog: v1.7.6...v1.7.7

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.7

Patch Changes

• #11476 4186e36 Thanks @​bytaesu! - Return CAPTCHA errors with the correct JSON Content-Type header.

• #11469 8620aa9 Thanks @​aryan1306! - Return rate limit errors with a JSON Content-Type header.

• #11491 55cb92e Thanks @​bytaesu! - Respect social provider disableSignUp when signing in with an ID token.

• #11375 69defbc Thanks @​bytaesu! - Refresh the active organization after sign-in when a session hook selects the initial organization.

• #11494 ac54bfd Thanks @​gustavovalverde! - Isolate OAuth state cookies and each OAuth Proxy payload with purpose-specific encryption keys. The oAuthProxy options and supported configuration remain unchanged.

  Upgrade all Better Auth nodes that handle the same cookie-backed OAuth or SAML relay-state flow together. Upgrade every OAuth Proxy participant, including production and preview or development deployments, in the same cutover. OAuth sign-in, account-linking, and cookie-backed SAML sign-in flows started before the upgrade must be restarted. Mixed old and new participants cannot exchange existing state or proxy payloads, and there is no fallback to the previous shared key.

• #11494 ac54bfd Thanks @​gustavovalverde! - Magic Link verification now accepts only records issued for Magic Link. Magic Link records and database-backed OAuth or SAML state use separate verification identifier prefixes. Links and database-backed sign-ins started before the upgrade cannot complete; request new Magic Links and restart those sign-ins. Upgrade servers sharing verification storage together, and update verification.storeIdentifier.overrides rules for these flows to match the new magic-link: and auth-state: prefixes. The link token, callback state, endpoints, and public option types are unchanged.

  Upgrade installed Better Auth adapters, plugins, and integrations released with better-auth alongside it so participating packages use the same release version.

• Updated dependencies [35d7cd3, 07bdf7e]:

  • @​better-auth/drizzle-adapter@​1.7.7
  • @​better-auth/kysely-adapter@​1.7.7
  • @​better-auth/core@​1.7.7
  • @​better-auth/memory-adapter@​1.7.7
  • @​better-auth/mongo-adapter@​1.7.7
  • @​better-auth/prisma-adapter@​1.7.7
  • @​better-auth/telemetry@​1.7.7

1.7.6

Patch Changes

• #11325 af88385 Thanks @​Wadiou! - Admin plugin bannedUserMessage can now be a function that receives the banned user, so sign-in errors can include details such as the ban reason.

• #11268 2fa501c Thanks @​bytaesu! - Support linking social accounts through the OAuth Proxy plugin.

• #11366 d41e2ca Thanks @​bytaesu! - Use targeted PRAGMA queries when a Kysely dialect cannot introspect Cloudflare D1.

• #11016 3d0efa3 Thanks @​davbrito! - Support Vercel BotID checks on protected authentication routes in Vercel-hosted applications.

... (truncated)

Commits

• db02f23 chore: release v1.7.7 (#11413)
• ac54bfd fix(auth): isolate verification records and encryption purposes (#11494)
• 69defbc fix(organization): refresh active organization after email sign-in (#11375)
• 55cb92e fix(auth): honor social disableSignUp for ID token sign-in (#11491)
• 4186e36 fix(captcha): return JSON content type for errors (#11476)
• 8620aa9 fix(rate-limit): set JSON content type on 429 responses (#11469)
• 229a02a chore: release v1.7.6 (#11322)
• dcaa5a7 feat(cli): add check command for schema validation (#11314)
• fc45d08 fix(client): prevent stale query overwrites (#11376)
• 8853419 fix: enforce maxPasswordLength before hashing on password verification endpoi...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	better-auth@​1.7.5 ⏵ 1.7.7			+1

View full report