better-auth
Bug Fixes
- Fixed sessions created by a
session.delete.afterhook being treated as revoked during "revoke all sessions" when usingsecondaryStoragewithstoreSessionInDatabase(#12212) - Fixed remembered sign-ins and sign-ups to refresh their session even if an earlier sign-in in the same browser used
rememberMe: false(#12181) - Fixed denying a device authorization request to reject a revoked session that is still in the cookie cache (#12216)
- Fixed IP wildcard trusted origins such as
exp://192.168.*.*:*matching custom-scheme hosts with out-of-range or zero-padded octets (#12217) - Fixed the phone number plugin storing an empty
phoneNumberon sign-up and replacing a verified number when linking an account with an empty phone number (#12219) - Fixed TOTP verification rejecting API key sessions so they can now finish two-factor enrollment (#12211)
- Fixed trusted devices being ignored when an app runs the two-factor sign-in step from its own hook on another sign-in path, such as email OTP (#12228)
For detailed changes, see CHANGELOG
@better-auth/expo
Bug Fixes
- Fixed Expo social sign-in to reject authorization URLs without a
stateparameter when OAuth state is stored in a cookie (#12218)
For detailed changes, see CHANGELOG
@better-auth/kysely-adapter
Bug Fixes
- Fixed MySQL
createwithgenerateId: "serial"leaving an inserted row behind when the table reports no auto-increment id (#12220)
For detailed changes, see CHANGELOG
@better-auth/passkey
Bug Fixes
- Fixed passkey registration and sign-in when one
passkey()plugin is shared between auth instances where only some setbaseURL(#12225)
For detailed changes, see CHANGELOG
Contributors
Thanks to everyone who contributed to this release:
Full changelog: v1.7.16...v1.7.17