better-auth 1.7.15

v1.7.15

on Node.js NPM

better-auth

Bug Fixes

• Fixed organization and API key metadata, and OAuth proxy sign-ins with a constructor field in additionalData, failing with a prototype pollution error (#12142)
• Improved BETTER_AUTH_SECRETS error messages to report the entry position instead of including the entry value (#12098)
• Fixed the admin update-user endpoint to reject data.id with a 400 error instead of attempting to change the user's primary key (#12099)
• Fixed the admin plugin to reject banned users when a session is created outside an endpoint, such as through internalAdapter.createSession (#12100)
• Fixed headers and cookies set by a non-returning hooks.before hook being dropped from the response, with the endpoint's value winning when both set the same header or cookie (#12145)
• Fixed the Vue client's useSession(useFetch) returning no session during Nuxt SSR when baseURL is inferred from the environment (#12109)
• Fixed the genericOAuth HubSpot helper truncating access tokens with reserved characters and now returning null instead of requesting /access-tokens/undefined when no token is present (#12108)
• Fixed /sign-in/username and /is-username-available rejecting usernames that sign-up accepts when validationOrder.username is post-normalization (#12097)

For detailed changes, see CHANGELOG

auth

Bug Fixes

• Fixed auth init for Remix and React Router v7 to generate an app/routes/api.auth.$.ts resource route that mounts auth.handler instead of a second auth instance with an unsupported database option (#12118)
• Fixed auth ai overwriting MCP config files it cannot parse, such as those with comments or trailing commas, by leaving them unchanged and printing the config to add manually (#12111)
• Fixed auth login and auth logout re-launching the CLI through npx auth@latest in an endless loop (#12110)
• Fixed auth init hanging during database migration and removed a stray debug line about path aliases (#12148)

For detailed changes, see CHANGELOG

@better-auth/stripe

Bug Fixes

• Fixed /subscription/success returning a 500 for non-string callbackURL and checkoutSessionId query values by rejecting them with a 400 (#12105)
• Fixed /subscription/success to validate callbackURL against trusted origins after replacing {CHECKOUT_SESSION_ID}, preventing redirects to untrusted origins via checkoutSessionId (#12102)

For detailed changes, see CHANGELOG

@better-auth/api-key

Bug Fixes

• Fixed API keys in secondary storage failing to verify, load, and list when the storage client returns already-parsed JSON, such as @upstash/redis (#12107)

For detailed changes, see CHANGELOG

@better-auth/cimd

Bug Fixes

• Fixed the Node metadata transport crashing the process on responses with an out-of-range status or invalid reason phrase by reporting the client as invalid_client (#12103)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed built-in social providers following HTTP redirects on token exchange, refresh, verification, and JWKS signing key requests (#12106)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@bytaesu

Full changelog: v1.7.14...v1.7.15