better-auth 1.8.0-beta.5 on Node.js NPM

Important

Action required

If you write plugin after-hooks for credential sign-in routes, handle a null new session while two-factor verification is pending. (#12202)
If you set authenticatorSelection.userVerification to required, passkey sign-in now rejects responses without user verification. (#12202)
If you use phone sign-in with requireVerification, configure sendOTP. Without it the route returns SEND_OTP_NOT_IMPLEMENTED. (#12202)
If users reset passwords by phone, they must verify the number first. Otherwise resetPassword returns PHONE_NUMBER_PENDING_VERIFICATION. (#12202)
If you use sessions from enableSessionForAPIKeys on passkey registration, device-code approval, two-factor enrollment, phone number changes, social account linking, or organization invitations, those requests are now refused. If you call linkOAuthAccount directly, pass the session that started the link in OAuth state. (#12202)

`better-auth`

Changed passkey registration, device-code approval, two-factor enrollment, phone number changes, social account linking, and organization invitations to require a session still active in the store when a server-side session store is used, even with cookie caching (#12202)
Changed phone number verification to require ownership of the account that holds an unverified number, and sign-up and sign-in to reject a phoneNumber with PHONE_NUMBER_CANNOT_BE_SET (#12202)
Changed phone password reset to work only for a number already verified on the account (#12202)
Changed credential sign-in after-hooks to run after the built-in two-factor challenge, so Electron desktop sign-in completes only after two-factor verification (#12202)

For detailed changes, see CHANGELOG

Changed Electron desktop sign-in to complete only after two-factor verification and the other sign-in after-hooks, regardless of plugin order, and to require the issuing browser session until the code is exchanged (#12202)

For detailed changes, see CHANGELOG

Changed authenticatorSelection.userVerification to apply to authentication as well as registration, rejecting responses without user verification when it is required (#12202)
Changed passkey registration to require a session still active in the store when a server-side session store is used, even with cookie caching (#12202)

For detailed changes, see CHANGELOG

Changed credential sign-in after-hooks to run after the built-in two-factor challenge and to receive a null new session while verification is pending (#12202)

For detailed changes, see CHANGELOG

Changed device-code approval to require a session still active in the store when a server-side session store is used, even with cookie caching (#12202)

For detailed changes, see CHANGELOG

Thanks to everyone who contributed to this release:

Full changelog: v1.8.0-beta.4...v1.8.0-beta.5