Better Auth v1.7.2

v1.7.2
Added 3
  • Added warnings for invalid signed session data in the cookie cache
  • Added synchronous and optional access to the current auth endpoint context
  • Added validation for missing Drizzle schema fields in compound where clauses
Changed 2
  • Improved getTestInstance performance with a faster default password hasher
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format
Fixed 12
  • Fixed permanent user bans to clear expiration dates from previous temporary bans
  • Fixed client types with more plugins being assignable to types declaring fewer plugins
  • Fixed disabled MyISAM indexes from satisfying migration index checks
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation
  • Allowed ~ in relative callback URLs validated by trusted-origin checks
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments

From Better Auth

better-auth
Bug Fixes
  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)

For detailed changes, see CHANGELOG

@better-auth/core
Bug Fixes
  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider
Bug Fixes
  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter
Bug Fixes
  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter
Bug Fixes
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)

For detailed changes, see CHANGELOG

@better-auth/sso
Bug Fixes
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@bytaesu, @GautamBytes, @heliohm, @sosyz, @starslingdev[bot]

Full changelog: v1.7.1...v1.7.2

View original

Upgraded? How did it go?

Discussion