better-auth 1.7.16

v1.7.16

on Node.js NPM

better-auth

Bug Fixes

• Fixed revoked sessions staying usable with secondary storage or the cookie cache. Bulk revocation now ends sessions missing from the cached list, and passkey registration, device authorization, two-factor, social account linking, and phone number changes check the session store (#12198)
• Fixed phone numbers being stored before they are verified. Sign-up and sign-in reject a phoneNumber in the request, social profiles no longer set an unverified number, and verification codes use their own namespace (#12198)
• Fixed /admin/update-user changing phone numbers without permission. It now requires user:set-phone, so add set-phone to custom access control statements (#12198)
• Fixed email OTP accepting more guesses than allowedAttempts under concurrent requests, and bound email change codes to the requesting account (#12198)
• Fixed user lookup by email matching a different address on accent-insensitive database collations (#12198)
• Fixed email verification and change email links working for an account other than the one they were issued to (#12198)
• Fixed OAuth sign-in treating a string email_verified value such as "false" as verified, and bound generic OAuth profiles to the ID token subject (#12198)
• Fixed organization roles with extra whitespace passing role checks, and limited pending invitations to members who can manage them (#12198)
• Fixed wildcard trusted origins matching URLs outside the intended scheme, host, or path (#12198)
• Fixed anonymous users being linked on a sign-in still waiting for a second factor (#12198)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed the Zoom provider ignoring disableSignUp, requireEmailVerification, and overrideUserInfoOnSignIn (#12198)
• Fixed string email_verified claims from Cognito and Microsoft Entra ID being read as verified (#12198)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

• Fixed the authorization proxy signing a state the server did not issue and redirecting to hosts that are not configured providers (#12198)

For detailed changes, see CHANGELOG

@better-auth/electron

Bug Fixes

• Fixed sign-in returning the internal auth context when the transfer cookie is not a transfer request, and bound desktop authorization codes to the browser session that issued them (#12198)

For detailed changes, see CHANGELOG

@better-auth/passkey

Bug Fixes

• Fixed the expected WebAuthn origin coming from the request instead of server configuration. Set origin when rpID is set and a wildcard in baseURL.allowedHosts covers it (#12198)
• Fixed userVerification: "required" not being enforced, and applied it to authentication as well as registration (#12198)

For detailed changes, see CHANGELOG

@better-auth/stripe

Bug Fixes

• Fixed sign-up and update-user requests setting stripeCustomerId. Server code that sets it through auth.api.updateUser must write it through the database adapter instead (#12198)
• Fixed webhooks attributing a subscription to the wrong record when several records share a Stripe customer ID (#12198)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• Fixed MySQL with generateId: "serial" returning another request's record on connection pools (#12198)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed MySQL with generateId: "serial" returning another request's record on connection pools (#12198)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@bytaesu @Bekacru @gustavovalverde @Abhishek-B-R

Full changelog: v1.7.15...v1.7.16