better-auth 1.7.22

v1.7.22

on Node.js NPM

better-auth

Bug Fixes

• Fixed verification value consumption hanging on Cloudflare Workers when an earlier request for the same identifier ended mid-query (#12451)
• Fixed module-scope auth instances on Cloudflare Workers logging a schema validation error on every cold start by validating on first use (#12448)
• Fixed deferSessionRefresh refresh requests failing with a 415 error in Next.js and Nuxt (#12330)
• Fixed ReferenceError: window is not defined when a client session subscription is cleaned up after a test environment tears down its globals (#12324)
• Fixed client session refresh listeners piling up on the server during SSR (#12324)
• Fixed session polling never firing when the runtime's navigator does not report connectivity (#12462)
• Fixed OAuth sign-up rejected by a user.create.before hook returning false logging a TypeError (#12331)
• Fixed deleteOrganization clearing the session's active organization when a beforeDeleteOrganization hook rejected the delete (#12334)
• Fixed revokeSession, revokeSessions, and deleteUser({ token }) to expire session cookies when revoking the current session or deleting the user (#12321)
• Fixed getSession to no longer leave an expired session in the request context after returning null (#12459)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed introspected access tokens that fail aud, iss, exp, or nbf claim checks to return a 401 instead of a 500 (#12432)
• Fixed getSession failing with "Failed to get session" when a user.additionalFields entry references a table outside the Better Auth schema (#12333)
• Fixed resource-server challenges turning rejected requests into 500 errors, and added invalid_token error details when a presented token fails verification (#12445)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed failed requests using the DPoP authorization scheme to receive a DPoP challenge instead of a Bearer challenge (#12447)
• Fixed resource-server challenges turning rejected requests into 500 errors, and added invalid_token error details when a presented token fails verification (#12445)
• Fixed /oauth2/userinfo to send a WWW-Authenticate challenge on every 401 response, including DPoP failures and requests with no token (#12446)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed getSession failing with "Failed to get session" when a user.additionalFields entry references a table outside the Better Auth schema (#12333)

For detailed changes, see CHANGELOG

@better-auth/mcp

Bug Fixes

• Fixed failed requests using the DPoP authorization scheme to receive a DPoP challenge instead of a Bearer challenge (#12447)

For detailed changes, see CHANGELOG

@better-auth/prisma-adapter

Bug Fixes

• Fixed getSession failing with "Failed to get session" when a user.additionalFields entry references a table outside the Better Auth schema (#12333)

For detailed changes, see CHANGELOG

@better-auth/stripe

Bug Fixes

• Fixed Stripe customer.subscription.updated webhooks for customers with no local subscription to log a clear warning instead of failing with a TypeError (#12473)

For detailed changes, see CHANGELOG

@better-auth/telemetry

Bug Fixes

• Fixed requests failing on Cloudflare Workers for module-scope auth instances when telemetry is enabled without a static baseURL (#12448)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@AmalkrishnaAS, @Bekacru, @bytaesu, @choksi2212, @flcrom, @ghazy2001, @gustavovalverde, @mrpmohiburrahman, @umeraamir69

Full changelog: v1.7.21...v1.7.22