better-auth 1.7.23

v1.7.23

on Node.js NPM

better-auth

Bug Fixes

• Fixed getTestInstance sharing one MongoDB database across test files, so parallel tests no longer delete each other's data (#12543)

For detailed changes, see CHANGELOG

@better-auth/mcp

Bug Fixes

• Improved the dpop.replayStore documentation on createMcpProtectedRequestHandler to explain the in-memory default and when to use a shared store (#12504)
• Fixed requireMcpAuth to accept tokens when the JWT plugin publishes its keys at jwks.remoteUrl (#12501)
• Fixed requireMcpAuth returning a 500 on runtimes that block requests to their own hostname, such as a single Cloudflare Worker (#12501)
• Fixed cross-origin browser clients being unable to read WWW-Authenticate challenges from OAuth resource servers and MCP helpers (#12521)
• Fixed OAuth resource servers to answer DPoP requests lacking a required scope with a DPoP insufficient_scope challenge instead of Bearer (#12525)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed cross-origin browser clients being unable to read WWW-Authenticate challenges from OAuth resource servers and MCP helpers (#12521)
• Fixed protected resource requests using an unsupported authorization scheme or no scheme to receive a Bearer challenge with resource_metadata (#12515)
• Fixed OAuth resource servers to answer DPoP requests lacking a required scope with a DPoP insufficient_scope challenge instead of Bearer (#12525)
• Fixed OAuth token requests that fail PKCE, redirect_uri, resource, or DPoP validation consuming the authorization or device code (#12499)
• Added a warning in the OAuth provider when two extensions contribute the same discovery metadata key (#12500)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Improved the advanced.database.validateSchema documentation to explain when validation runs and which adapters skip it (#12480)
• Fixed requireMcpAuth returning a 500 on runtimes that block requests to their own hostname, such as a single Cloudflare Worker (#12501)

For detailed changes, see CHANGELOG

@better-auth/electron

Bug Fixes

• Fixed Electron sign-in callbacks being missed on Windows and Linux when Chromium reorders or appends launch arguments (#12490)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• Fixed the Kysely adapter on PostgreSQL failing to save json fields whose value is an array (#12530)

For detailed changes, see CHANGELOG

@better-auth/memory-adapter

Bug Fixes

• Fixed the memory adapter reusing the ids of stored rows when generateId is "serial" after a delete (#12544)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@bytaesu, @grant0417, @gustavovalverde

Full changelog: v1.7.22...v1.7.23