better-auth 1.7.12 on Node.js NPM

Important

Action required

If you use ID token sign-in with a provider that has no clientId, set clientId to every client ID your apps sign in with. (#11931)

`better-auth`

Fixed the JWT plugin to verify JWTs and session cookie-cache JWTs with the stored key's algorithm instead of the token header's, and to warn when signing or verifying a JWT without an issuer or audience (#11925)
Fixed OAuth callbacks completed through the OAuth proxy to run the same checks as the standard OAuth callback, including issuer and ID token nonce validation (#11930)
Fixed auth.api.getSession() to keep the original database error as error.cause when the session lookup fails (#11924)

For detailed changes, see CHANGELOG

Fixed mapProfileToUser failing to typecheck under exactOptionalPropertyTypes when it returns undefined for name, email, or image (#11918)
Fixed ID token sign-in to reject tokens when the provider has no client ID, since their audience cannot be checked (#11931)
Fixed a custom Facebook getUserInfo to no longer receive client-submitted access tokens issued to another Facebook app, and ID tokens missing exp or iat are now rejected (#11919)
Restored the Twitch and Paybin ID token handling from before 1.7.11, which made account info fail once the ID token stored at sign-in expired (#11920)
Added a cause option as a third argument to APIError.from() to keep the underlying error for server-side callers without exposing it in the response (#11924)

For detailed changes, see CHANGELOG

Fixed requireMcpAuth to accept only OAuth access tokens and reject session JWTs from the JWT plugin, even when they share the issuer and audience (#11934)

For detailed changes, see CHANGELOG

Fixed OIDC SSO sign-in to reject ID tokens missing exp or iat and providers with an empty client ID, matching social sign-in (#11935)

For detailed changes, see CHANGELOG

Thanks to everyone who contributed to this release:

Full changelog: v1.7.11...v1.7.12