npm better-auth 1.7.17
v1.7.17

5 hours ago

better-auth

Bug Fixes

  • Fixed sessions created by a session.delete.after hook being treated as revoked during "revoke all sessions" when using secondaryStorage with storeSessionInDatabase (#12212)
  • Fixed remembered sign-ins and sign-ups to refresh their session even if an earlier sign-in in the same browser used rememberMe: false (#12181)
  • Fixed denying a device authorization request to reject a revoked session that is still in the cookie cache (#12216)
  • Fixed IP wildcard trusted origins such as exp://192.168.*.*:* matching custom-scheme hosts with out-of-range or zero-padded octets (#12217)
  • Fixed the phone number plugin storing an empty phoneNumber on sign-up and replacing a verified number when linking an account with an empty phone number (#12219)
  • Fixed TOTP verification rejecting API key sessions so they can now finish two-factor enrollment (#12211)
  • Fixed trusted devices being ignored when an app runs the two-factor sign-in step from its own hook on another sign-in path, such as email OTP (#12228)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

  • Fixed Expo social sign-in to reject authorization URLs without a state parameter when OAuth state is stored in a cookie (#12218)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

  • Fixed MySQL create with generateId: "serial" leaving an inserted row behind when the table reports no auto-increment id (#12220)

For detailed changes, see CHANGELOG

@better-auth/passkey

Bug Fixes

  • Fixed passkey registration and sign-in when one passkey() plugin is shared between auth instances where only some set baseURL (#12225)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@aliamanatali, @bytaesu

Full changelog: v1.7.16...v1.7.17

Don't miss a new better-auth release

NewReleases is sending notifications on new releases.