better-auth/better-auth v1.7.19

on GitHub

better-auth

Bug Fixes

• Fixed /admin/create-user leaving a user without a credential account when creating that account failed, such as a database hook throwing, which made retrying with the same email fail with USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL (#12338)
• Fixed /admin/create-user leaving a user without a credential account when the password was rejected, such as by the Have I Been Pwned plugin, which made retrying with the same email fail with USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL (#12335)
• Fixed client actions ignoring the HTTP method passed in second-argument fetch options, and attaching a request body when the method was a lowercase get or HEAD (#12336)
• Fixed plugin schema overrides (modelName and field names) leaking into other instances of the same plugin in one process (#12319)
• Fixed /device/token returning invalid_grant instead of invalid_client when validateClient rejects the client_id, matching /device/code and RFC 6749 section 5.2 (#12246)
• Fixed OAuth sign-in failing with state_mismatch during the daylight saving time fall-back hour when OAuth state is stored in the database and the server's time zone observes daylight saving time (#12320)
• Fixed the OpenAPI schema to document query parameters for endpoints whose query schema is wrapped in z.optional(), such as /get-session and Stripe's /subscription/list (#12337)
• Fixed organization.getInvitation to return the INVITATION_NOT_FOUND code for a missing, expired, or non-pending invitation (#12332)
• Fixed listMembers failing with a syntax error on PostgreSQL and MSSQL when the filter matches no members or the offset is past the last member (#12318)
• Fixed the active-sessions list in secondary storage being stored without an expiry when every remaining session had less than a second left (#12323)
• Fixed SIWE sign-in leaving a user behind when creating its wallet address or account failed, which blocked that wallet from signing in again (#12366)
• Fixed social sign-up hanging on single-connection databases when the username plugin is enabled and the provider profile maps a username (#12340)

For detailed changes, see CHANGELOG

auth

Bug Fixes

• Fixed CLI commands hanging or exiting with code 0 at a prompt in CI or without a terminal. They now exit with code 2 and name what they need, such as --yes, and prompts appear on stderr so redirecting stdout no longer hides them (#12286)
• Fixed CLI notices mixing into command output. auth info --json --copy now prints valid JSON, auth secret prints only the BETTER_AUTH_SECRET line on stdout, auth login and auth logout messages go to stderr, and auth info shows tips only in an interactive terminal (#12287)
• Fixed CLI errors printing a stack trace instead of the cause. Config and database errors now show their message, and a mistyped --config path reports that the file doesn't exist. auth mcp and auth ai no longer report success after a failed step (#12305)
• Fixed the CLI exiting with code 0 after a canceled or failed run. Canceling or declining a prompt, or pressing Ctrl+C, now exits with 130, and failures such as a missing config file or a failed auth mcp setup exit with 1 (#12275)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed auth.api.oauth2Consent({ headers, body }) failing with request not found when called from a server route (#12325)
• Fixed a client secret without the configured prefix.clientSecret getting a different error than other wrong secrets. It now gets the standard invalid_client response: 401 with a WWW-Authenticate: Basic challenge for client_secret_basic, and 400 for client_secret_post (#12327)
• Fixed OAuth client metadata being stored as a JSON string in its json column. It is now written as an object, so Postgres jsonb operators such as -> and @> work with adapters that pass JSON through natively (Drizzle pg). Rows written as strings by earlier versions are still read (#12328)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed failed fallback join queries printing the raw database error, including SQL and bound values, with console.error in addition to the configured logger (#12317)
• Fixed getAccessToken and refreshToken returning the expired access token when a provider refuses a token refresh with a 200 status, as GitHub does (#12369)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

• Fixed the Expo authorization proxy logging a provider configuration error on every OAuth sign-in when a social provider is set up for ID token sign-in only, such as Apple without a client secret (#12368)

For detailed changes, see CHANGELOG

@better-auth/mcp

Bug Fixes

• Fixed MCP rejecting plain-HTTP resource URLs on .localhost subdomains as non-HTTPS (#12322)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@Adnan-Husayn, @AryaKesharwani, @binaryshrey, @bytaesu, @Faiziimam, @Gourav224, @jashkarangiya, @NoiceHax, @PhillJK, @Tushar-Khandelwal-2004, @Tyagiquamar, @umeraamir69, @unjica, @YIOYIOIOI

Full changelog: v1.7.18...v1.7.19