chore(deps): bump the better-auth group with 6 updates by dependabot[bot] · Pull Request #334 · OpenMapX/openmapx

dependabot · 2026-09-14T04:29:04Z

Bumps the better-auth group with 6 updates:

Package	From	To
@better-auth/core	`1.7.2`	`1.7.3`
@better-auth/expo	`1.7.2`	`1.7.3`
@better-auth/i18n	`1.7.2`	`1.7.3`
@better-auth/oauth-provider	`1.7.2`	`1.7.3`
@better-auth/passkey	`1.7.2`	`1.7.3`
better-auth	`1.7.2`	`1.7.3`

Updates @better-auth/core from 1.7.2 to 1.7.3

Release notes

Sourced from @better-auth/core's releases.

v1.7.3

Upgrading from 1.7.0–1.7.2:

We restored the 1.6 account core schema to avoid requiring a disruptive backfill for existing users. We recognize the cost to users who already migrated and are committed to keeping the core schema stable throughout v1.

If you applied the 1.7 issuer schema, follow the upgrade guide for the required cleanup. No backfill is needed.

better-auth

Features

Added Cloudflare as a built-in social provider with client-secret and PKCE support. (#9908)

Enabled schema validation during initialization by default, including in production, and rejected authentication requests on detected mismatches. (#11178)

Added isPasswordCompromised for checking passwords against Have I Been Pwned in custom server-side flows. (#11147)

Bug Fixes

Aligned generated OpenAPI required fields with runtime validation. (#11066)

Handled malformed custom-scheme callback URLs without excessive processing. (#11060)

Improved Auth0 domain normalization to avoid slow trailing-slash processing. (#11188)

Prevented generic OAuth discovery failures from taking down the authentication API. (#10978)

Tracked email OTP sign-ins in the last login method plugin. (#10963)

Fixed callback hooks being skipped after proxied OAuth sign-ins and preserved server state when callback cookies are unavailable. The legacy /oauth-proxy-callback endpoint is deprecated and will be removed in the next minor release. (#10988)

Fixed getSession failures when cookie caching is disabled and cached session cookies remain. (#11120)

Fixed TOTP re-enrollment replacing an active authenticator and its backup codes. (#11037)

Prevented duplicate session requests and hydration mismatches in Nuxt useFetch. (#11084)

Improved dynamic organization role permission check performance. (#11069)

Added type-safe Nuxt useFetch integration for the Vue client's useSession hook. (#11085)

Restored compatibility with 1.6 account schemas by identifying accounts with (providerId, accountId) instead of issuer. (#11153)

For detailed changes, see CHANGELOG

@better-auth/core

Features

Added Cloudflare as a built-in social provider with client-secret and PKCE support. (#9908)

Added initialization-time schema validation and actionable mismatch guidance for Drizzle and Prisma adapters. (#11179)

Enabled schema validation during initialization by default, including in production, and rejected authentication requests on detected mismatches. (#11178)

Added custom token endpoint authentication strategies for providers with non-standard request parameters. (#11101)

Bug Fixes

Restored optional consumeOne and incrementOne methods for custom database adapters. (#11189)

Fixed TikTok sign-in and token refresh with the documented clientKey and clientSecret options. (#11102)

Improved request IP validation performance. (#11068)

Improved PayPal authorization code and refresh token requests, including PKCE handling. (#11129)

Improved Reddit token requests with OAuth-compliant Basic authentication and redirect protection. (#11134)

Restored compatibility with 1.6 account schemas by identifying accounts with (providerId, accountId) instead of issuer. (#11153)

... (truncated)

Changelog

Sourced from @better-auth/core's changelog.

1.7.3

Patch Changes

#11179 352d012 Thanks @bytaesu! - Validate Drizzle schema objects and generated Prisma client models during initialization, including in production, and report mismatches with guidance for fixing them. These checks do not query the database and cannot detect unapplied migrations.

For Prisma clients whose model metadata omits nullability, auth generate reports required fields that Better Auth never writes by reading the existing Prisma schema. Set advanced.database.validateSchema: false to disable runtime validation.

#9908 76d311f Thanks @harshil1712! - Add Cloudflare as a built-in social provider, with support for client-secret authentication and PKCE clients without a secret.

#11101 3e9e197 Thanks @bytaesu! - Add a custom token endpoint authentication strategy for providers that require non-standard request parameters.

#11068 157ec8d Thanks @bytaesu! - Improve request IP validation performance.

#11102 baa08f4 Thanks @bytaesu! - Fix TikTok sign-in and token refresh failing when configured with the documented clientKey and clientSecret options.

#11129 9e36635 Thanks @bytaesu! - Improve PayPal authorization code and refresh token requests, including PKCE parameter handling.

#11178 be0e007 Thanks @bytaesu! - Report missing tables, missing columns, and required columns Better Auth never writes during initialization, with guidance for fixing them. Kysely checks the live database schema. Authentication requests await the same check and are rejected if the schema does not match.

Validation is enabled by default, including in production. Set advanced.database.validateSchema: false to disable runtime validation. auth migrate refuses to apply changes when required unwritten columns need manual repair.

#11134 a2bae0c Thanks @bytaesu! - Improve Reddit token requests with OAuth-compliant Basic authentication and redirect protection.

#11189 1a1b7d5 Thanks @bytaesu! - Make consumeOne and incrementOne optional again for custom database adapters, using guarded fallbacks when native methods are absent. Fallbacks require atomic conditional writes and accurate affected-row counts. Fallback increments can fail when contention exhausts their retries.

#11153 2220ee7 Thanks @bytaesu! - Restore sign-in compatibility with 1.6 databases by identifying accounts with (providerId, accountId) and removing the issuer requirement introduced in 1.7.0. Upgrading from 1.6 no longer requires an account schema migration. Ambiguous account keys are rejected instead of selecting an arbitrary account.

If you applied the 1.7.0 through 1.7.2 account schema, remove its issuer unique index before upgrading. For SQL databases, also make issuer nullable or remove the column so sign-ups and account linking can succeed. auth migrate does not perform this cleanup. Follow the upgrade guide for database-specific steps.

Commits

597d39c chore: release v1.7.3 (#11032)
1a1b7d5 fix(core): restore optional atomic adapter methods (#11189)
76d311f feat: add Cloudflare social provider (#9908)
352d012 feat(adapters): register Drizzle and Prisma schema checks (#11179)
be0e007 feat(db): check the database schema on initialization (#11178)
2220ee7 revert: drop the issuer column and resolve accounts by provider id (#11153)
a2bae0c refactor(oauth): use shared token flow for Reddit (#11134)
9e36635 refactor(oauth): use shared token flow for PayPal (#11129)
baa08f4 fix(tiktok): authenticate token requests with client_key (#11102)
3e9e197 feat(oauth): support custom token request authentication (#11101)
Additional commits viewable in compare view

Updates @better-auth/expo from 1.7.2 to 1.7.3

Release notes

Sourced from @better-auth/expo's releases.

v1.7.3

Upgrading from 1.7.0–1.7.2:

We restored the 1.6 account core schema to avoid requiring a disruptive backfill for existing users. We recognize the cost to users who already migrated and are committed to keeping the core schema stable throughout v1.

If you applied the 1.7 issuer schema, follow the upgrade guide for the required cleanup. No backfill is needed.

better-auth

Features

Added Cloudflare as a built-in social provider with client-secret and PKCE support. (#9908)

Enabled schema validation during initialization by default, including in production, and rejected authentication requests on detected mismatches. (#11178)

Added isPasswordCompromised for checking passwords against Have I Been Pwned in custom server-side flows. (#11147)

Bug Fixes

Aligned generated OpenAPI required fields with runtime validation. (#11066)

Handled malformed custom-scheme callback URLs without excessive processing. (#11060)

Improved Auth0 domain normalization to avoid slow trailing-slash processing. (#11188)

Prevented generic OAuth discovery failures from taking down the authentication API. (#10978)

Tracked email OTP sign-ins in the last login method plugin. (#10963)

Fixed callback hooks being skipped after proxied OAuth sign-ins and preserved server state when callback cookies are unavailable. The legacy /oauth-proxy-callback endpoint is deprecated and will be removed in the next minor release. (#10988)

Fixed getSession failures when cookie caching is disabled and cached session cookies remain. (#11120)

Fixed TOTP re-enrollment replacing an active authenticator and its backup codes. (#11037)

Prevented duplicate session requests and hydration mismatches in Nuxt useFetch. (#11084)

Improved dynamic organization role permission check performance. (#11069)

Added type-safe Nuxt useFetch integration for the Vue client's useSession hook. (#11085)

Restored compatibility with 1.6 account schemas by identifying accounts with (providerId, accountId) instead of issuer. (#11153)

For detailed changes, see CHANGELOG

@better-auth/core

Features

Added Cloudflare as a built-in social provider with client-secret and PKCE support. (#9908)

Added initialization-time schema validation and actionable mismatch guidance for Drizzle and Prisma adapters. (#11179)

Enabled schema validation during initialization by default, including in production, and rejected authentication requests on detected mismatches. (#11178)

Added custom token endpoint authentication strategies for providers with non-standard request parameters. (#11101)

Bug Fixes

Restored optional consumeOne and incrementOne methods for custom database adapters. (#11189)

Fixed TikTok sign-in and token refresh with the documented clientKey and clientSecret options. (#11102)

Improved request IP validation performance. (#11068)

Improved PayPal authorization code and refresh token requests, including PKCE handling. (#11129)

Improved Reddit token requests with OAuth-compliant Basic authentication and redirect protection. (#11134)

Restored compatibility with 1.6 account schemas by identifying accounts with (providerId, accountId) instead of issuer. (#11153)

... (truncated)

Changelog

Sourced from @better-auth/expo's changelog.

1.7.3

Patch Changes

#11099 fb7c018 Thanks @bytaesu! - Prevent Expo apps from sending unauthenticated requests while large stored cookies are being updated, and recover the previous cookie value when an update is interrupted or incomplete.

Commits

597d39c chore: release v1.7.3 (#11032)
fb7c018 fix(expo): prevent torn cookie storage writes (#11099)
c0444dc fix: align OpenAPI required fields with Zod 4.5 (#11066)
See full diff in compare view

Updates @better-auth/i18n from 1.7.2 to 1.7.3

Release notes

Sourced from @better-auth/i18n's releases.

v1.7.3

Upgrading from 1.7.0–1.7.2:

We restored the 1.6 account core schema to avoid requiring a disruptive backfill for existing users. We recognize the cost to users who already migrated and are committed to keeping the core schema stable throughout v1.

If you applied the 1.7 issuer schema, follow the upgrade guide for the required cleanup. No backfill is needed.

better-auth

Features

Added Cloudflare as a built-in social provider with client-secret and PKCE support. (#9908)

Enabled schema validation during initialization by default, including in production, and rejected authentication requests on detected mismatches. (#11178)

Added isPasswordCompromised for checking passwords against Have I Been Pwned in custom server-side flows. (#11147)

Bug Fixes

Aligned generated OpenAPI required fields with runtime validation. (#11066)

Handled malformed custom-scheme callback URLs without excessive processing. (#11060)

Improved Auth0 domain normalization to avoid slow trailing-slash processing. (#11188)

Prevented generic OAuth discovery failures from taking down the authentication API. (#10978)

Tracked email OTP sign-ins in the last login method plugin. (#10963)

Fixed callback hooks being skipped after proxied OAuth sign-ins and preserved server state when callback cookies are unavailable. The legacy /oauth-proxy-callback endpoint is deprecated and will be removed in the next minor release. (#10988)

Fixed getSession failures when cookie caching is disabled and cached session cookies remain. (#11120)

Fixed TOTP re-enrollment replacing an active authenticator and its backup codes. (#11037)

Prevented duplicate session requests and hydration mismatches in Nuxt useFetch. (#11084)

Improved dynamic organization role permission check performance. (#11069)

Added type-safe Nuxt useFetch integration for the Vue client's useSession hook. (#11085)

Restored compatibility with 1.6 account schemas by identifying accounts with (providerId, accountId) instead of issuer. (#11153)

For detailed changes, see CHANGELOG

@better-auth/core

Features

Added Cloudflare as a built-in social provider with client-secret and PKCE support. (#9908)

Added initialization-time schema validation and actionable mismatch guidance for Drizzle and Prisma adapters. (#11179)

Enabled schema validation during initialization by default, including in production, and rejected authentication requests on detected mismatches. (#11178)

Added custom token endpoint authentication strategies for providers with non-standard request parameters. (#11101)

Bug Fixes

Restored optional consumeOne and incrementOne methods for custom database adapters. (#11189)

Fixed TikTok sign-in and token refresh with the documented clientKey and clientSecret options. (#11102)

Improved request IP validation performance. (#11068)

Improved PayPal authorization code and refresh token requests, including PKCE handling. (#11129)

Improved Reddit token requests with OAuth-compliant Basic authentication and redirect protection. (#11134)

Restored compatibility with 1.6 account schemas by identifying accounts with (providerId, accountId) instead of issuer. (#11153)

... (truncated)

Changelog

Sourced from @better-auth/i18n's changelog.

1.7.3

Commits

597d39c chore: release v1.7.3 (#11032)
See full diff in compare view

Updates @better-auth/oauth-provider from 1.7.2 to 1.7.3

Release notes

Sourced from @better-auth/oauth-provider's releases.

v1.7.3

Upgrading from 1.7.0–1.7.2:

We restored the 1.6 account core schema to avoid requiring a disruptive backfill for existing users. We recognize the cost to users who already migrated and are committed to keeping the core schema stable throughout v1.

If you applied the 1.7 issuer schema, follow the upgrade guide for the required cleanup. No backfill is needed.

better-auth

Features

Added Cloudflare as a built-in social provider with client-secret and PKCE support. (#9908)

Enabled schema validation during initialization by default, including in production, and rejected authentication requests on detected mismatches. (#11178)

Added isPasswordCompromised for checking passwords against Have I Been Pwned in custom server-side flows. (#11147)

Bug Fixes

Aligned generated OpenAPI required fields with runtime validation. (#11066)

Handled malformed custom-scheme callback URLs without excessive processing. (#11060)

Improved Auth0 domain normalization to avoid slow trailing-slash processing. (#11188)

Prevented generic OAuth discovery failures from taking down the authentication API. (#10978)

Tracked email OTP sign-ins in the last login method plugin. (#10963)

Fixed callback hooks being skipped after proxied OAuth sign-ins and preserved server state when callback cookies are unavailable. The legacy /oauth-proxy-callback endpoint is deprecated and will be removed in the next minor release. (#10988)

Fixed getSession failures when cookie caching is disabled and cached session cookies remain. (#11120)

Fixed TOTP re-enrollment replacing an active authenticator and its backup codes. (#11037)

Prevented duplicate session requests and hydration mismatches in Nuxt useFetch. (#11084)

Improved dynamic organization role permission check performance. (#11069)

Added type-safe Nuxt useFetch integration for the Vue client's useSession hook. (#11085)

Restored compatibility with 1.6 account schemas by identifying accounts with (providerId, accountId) instead of issuer. (#11153)

For detailed changes, see CHANGELOG

@better-auth/core

Features

Added Cloudflare as a built-in social provider with client-secret and PKCE support. (#9908)

Added initialization-time schema validation and actionable mismatch guidance for Drizzle and Prisma adapters. (#11179)

Enabled schema validation during initialization by default, including in production, and rejected authentication requests on detected mismatches. (#11178)

Added custom token endpoint authentication strategies for providers with non-standard request parameters. (#11101)

Bug Fixes

Restored optional consumeOne and incrementOne methods for custom database adapters. (#11189)

Fixed TikTok sign-in and token refresh with the documented clientKey and clientSecret options. (#11102)

Improved request IP validation performance. (#11068)

Improved PayPal authorization code and refresh token requests, including PKCE handling. (#11129)

Improved Reddit token requests with OAuth-compliant Basic authentication and redirect protection. (#11134)

Restored compatibility with 1.6 account schemas by identifying accounts with (providerId, accountId) instead of issuer. (#11153)

... (truncated)

Changelog

Sourced from @better-auth/oauth-provider's changelog.

1.7.3

Patch Changes

#11090 4d09d50 Thanks @Salman-Arshad! - Allow native OAuth clients with localhost loopback redirect URIs to use ephemeral callback ports, and ensure loopback port variance changes only the port.

Commits

597d39c chore: release v1.7.3 (#11032)
2220ee7 revert: drop the issuer column and resolve accounts by provider id (#11153)
4d09d50 fix(oauth-provider): extend RFC 8252 loopback port variance to localhost (#11...
c0444dc fix: align OpenAPI required fields with Zod 4.5 (#11066)
See full diff in compare view

Updates @better-auth/passkey from 1.7.2 to 1.7.3

Release notes

Sourced from @better-auth/passkey's releases.

v1.7.3

Upgrading from 1.7.0–1.7.2:

We restored the 1.6 account core schema to avoid requiring a disruptive backfill for existing users. We recognize the cost to users who already migrated and are committed to keeping the core schema stable throughout v1.

If you applied the 1.7 issuer schema, follow the upgrade guide for the required cleanup. No backfill is needed.

better-auth

Features

Added Cloudflare as a built-in social provider with client-secret and PKCE support. (#9908)

Enabled schema validation during initialization by default, including in production, and rejected authentication requests on detected mismatches. (#11178)

Added isPasswordCompromised for checking passwords against Have I Been Pwned in custom server-side flows. (#11147)

Bug Fixes

Aligned generated OpenAPI required fields with runtime validation. (#11066)

Handled malformed custom-scheme callback URLs without excessive processing. (#11060)

Improved Auth0 domain normalization to avoid slow trailing-slash processing. (#11188)

Prevented generic OAuth discovery failures from taking down the authentication API. (#10978)

Tracked email OTP sign-ins in the last login method plugin. (#10963)

Fixed callback hooks being skipped after proxied OAuth sign-ins and preserved server state when callback cookies are unavailable. The legacy /oauth-proxy-callback endpoint is deprecated and will be removed in the next minor release. (#10988)

Fixed getSession failures when cookie caching is disabled and cached session cookies remain. (#11120)

Fixed TOTP re-enrollment replacing an active authenticator and its backup codes. (#11037)

Prevented duplicate session requests and hydration mismatches in Nuxt useFetch. (#11084)

Improved dynamic organization role permission check performance. (#11069)

Added type-safe Nuxt useFetch integration for the Vue client's useSession hook. (#11085)

Restored compatibility with 1.6 account schemas by identifying accounts with (providerId, accountId) instead of issuer. (#11153)

For detailed changes, see CHANGELOG

@better-auth/core

Features

Added Cloudflare as a built-in social provider with client-secret and PKCE support. (#9908)

Added initialization-time schema validation and actionable mismatch guidance for Drizzle and Prisma adapters. (#11179)

Enabled schema validation during initialization by default, including in production, and rejected authentication requests on detected mismatches. (#11178)

Added custom token endpoint authentication strategies for providers with non-standard request parameters. (#11101)

Bug Fixes

Restored optional consumeOne and incrementOne methods for custom database adapters. (#11189)

Fixed TikTok sign-in and token refresh with the documented clientKey and clientSecret options. (#11102)

Improved request IP validation performance. (#11068)

Improved PayPal authorization code and refresh token requests, including PKCE handling. (#11129)

Improved Reddit token requests with OAuth-compliant Basic authentication and redirect protection. (#11134)

Restored compatibility with 1.6 account schemas by identifying accounts with (providerId, accountId) instead of issuer. (#11153)

... (truncated)

Changelog

Sourced from @better-auth/passkey's changelog.

1.7.3

Commits

597d39c chore: release v1.7.3 (#11032)
c0444dc fix: align OpenAPI required fields with Zod 4.5 (#11066)
See full diff in compare view

Updates better-auth from 1.7.2 to 1.7.3

Release notes

Sourced from better-auth's releases.

v1.7.3

Upgrading from 1.7.0–1.7.2:

We restored the 1.6 account core schema to avoid requiring a disruptive backfill for existing users. We recognize the cost to users who already migrated and are committed to keeping the core schema stable throughout v1.

If you applied the 1.7 issuer schema, follow the upgrade guide for the required cleanup. No backfill is needed.

better-auth

Features

Added Cloudflare as a built-in social provider with client-secret and PKCE support. (#9908)

Enabled schema validation during initialization by default, including in production, and rejected authentication requests on detected mismatches. (#11178)

Added isPasswordCompromised for checking passwords against Have I Been Pwned in custom server-side flows. (#11147)

Bug Fixes

Aligned generated OpenAPI required fields with runtime validation. (#11066)

Handled malformed custom-scheme callback URLs without excessive processing. (#11060)

Improved Auth0 domain normalization to avoid slow trailing-slash processing. (#11188)

Prevented generic OAuth discovery failures from taking down the authentication API. (#10978)

Tracked email OTP sign-ins in the last login method plugin. (#10963)

Fixed callback hooks being skipped after proxied OAuth sign-ins and preserved server state when callback cookies are unavailable. The legacy /oauth-proxy-callback endpoint is deprecated and will be removed in the next minor release. (#10988)

Fixed getSession failures when cookie caching is disabled and cached session cookies remain. (#11120)

Fixed TOTP re-enrollment replacing an active authenticator and its backup codes. (#11037)

Prevented duplicate session requests and hydration mismatches in Nuxt useFetch. (#11084)

Improved dynamic organization role permission check performance. (#11069)

Added type-safe Nuxt useFetch integration for the Vue client's useSession hook. (#11085)

Restored compatibility with 1.6 account schemas by identifying accounts with (providerId, accountId) instead of issuer. (#11153)

For detailed changes, see CHANGELOG

@better-auth/core

Features

Added Cloudflare as a built-in social provider with client-secret and PKCE support. (#9908)

Added initialization-time schema validation and actionable mismatch guidance for Drizzle and Prisma adapters. (#11179)

Enabled schema validation during initialization by default, including in production, and rejected authentication requests on detected mismatches. (#11178)

Added custom token endpoint authentication strategies for providers with non-standard request parameters. (#11101)

Bug Fixes

Restored optional consumeOne and incrementOne methods for custom database adapters. (#11189)

Fixed TikTok sign-in and token refresh with the documented clientKey and clientSecret options. (#11102)

Improved request IP validation performance. (#11068)

Improved PayPal authorization code and refresh token requests, including PKCE handling. (#11129)

Improved Reddit token requests with OAuth-compliant Basic authentication and redirect protection. (#11134)

Restored compatibility with 1.6 account schemas by identifying accounts with (providerId, accountId) instead of issuer. (#11153)

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.3

Patch Changes

#11060 3660f06 Thanks @bytaesu! - Handle malformed custom-scheme callback URLs without excessive processing.

#11037 5bd7096 Thanks @bytaesu! - Prevent repeated TOTP enrollment from replacing an active authenticator and its backup codes.

#11120 7ec7146 Thanks @onmax! - Prevent getSession from failing when cookie caching is disabled while clients still have cached session cookies.

#9908 76d311f Thanks @harshil1712! - Add Cloudflare as a built-in social provider, with support for client-secret authentication and PKCE clients without a secret.

#11188 c47b765 Thanks @bytaesu! - Normalize Auth0 domains without a potentially slow trailing-slash regular expression.

#11084 2d5c63d Thanks @bytaesu! - Prevent duplicate session requests and hydration mismatches when using the Vue client with Nuxt useFetch.

#11147 a9d8c12 Thanks @bytaesu! - Add isPasswordCompromised for checking passwords against Have I Been Pwned in custom server-side flows, while ignoring padded response entries with zero occurrences.

#10988 9fc7498 Thanks @bytaesu! - Run callback hooks after proxied OAuth sign-ins and preserve server state when callback cookies are unavailable. The legacy /oauth-proxy-callback endpoint is deprecated and will be removed in the next minor release.

#11178 be0e007 Thanks @bytaesu! - Report missing tables, missing columns, and required columns Better Auth never writes during initialization, with guidance for fixing them. Kysely checks the live database schema. Authentication requests await the same check and are rejected if the schema does not match.

Validation is enabled by default, including in production. Set advanced.database.validateSchema: false to disable runtime validation. auth migrate refuses to apply changes when required unwritten columns need manual repair.

#11069 0bb0dbf Thanks @bytaesu! - Improve dynamic organization role permission check performance.

#11153 2220ee7 Thanks @bytaesu! - Restore sign-in compatibility with 1.6 databases by identifying accounts with (providerId, accountId) and removing the issuer requirement introduced in 1.7.0. Upgrading from 1.6 no longer requires an account schema migration. Ambiguous account keys are rejected instead of selecting an arbitrary account.

If you applied the 1.7.0 through 1.7.2 account schema, remove its issuer unique index before upgrading. For SQL databases, also make issuer nullable or remove the column so sign-ups and account linking can succeed. auth migrate does not perform this cleanup. Follow the upgrade guide for database-specific steps.

#10978 5fe5bc2 Thanks @BetterAndBetterII! - Skip a generic OAuth provider when discovery fails instead of taking down the rest of the auth API.

#10963 74a7369 Thanks @thisismert! - Track email OTP sign-ins in the last login method plugin.

#11085 e16b40a Thanks @bytaesu! - Provide type-safe Nuxt useFetch integration for the Vue client's useSession hook.

#11066 c0444dc Thanks @bytaesu! - Upgrade the packaged Zod dependency to 4.5. Generated OpenAPI schemas now mark required request fields consistently with runtime validation, including passkey registration responses.

Updated dependencies [352d012, 76d311f, 3e9e197, 157ec8d, baa08f4, 9e36635, be0e007, a2bae0c, 1a1b7d5, 2220ee7]:

@better-auth/core@1.7.3

@better-auth/drizzle-adapter@1.7.3

@better-auth/prisma-adapter@1.7.3

@better-auth/kysely-adapter@1.7.3

@better-auth/memory-adapter@1.7.3

@better-auth/mongo-adapter@1.7.3

@better-auth/telemetry@1.7.3

Commits

597d39c chore: release v1.7.3 (#11032)
1a1b7d5 fix(core): restore optional atomic adapter methods (#11189)
76d311f feat: add Cloudflare social provider (#9908)
7ec7146 fix(session): skip cache cookie when disabled (#11120)
c47b765 fix(generic-oauth): harden Auth0 domain normalization (#11188)
be0e007 feat(db): check the database schema on initialization (#11178)
2220ee7 revert: drop the issuer column and resolve accounts by provider id (#11153)
5fe5bc2 fix(generic-oauth): skip providers whose discovery fails (#10978)
a9d8c12 feat(haveibeenpwned): expose password compromise check (#11147)
74a7369 fix(last-login-method): handle email otp logins (#10963)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself....

Description has been truncated

Bumps the better-auth group with 6 updates: | Package | From | To | | --- | --- | --- | | [@better-auth/core](https://github.com/better-auth/better-auth/tree/HEAD/packages/core) | `1.7.2` | `1.7.3` | | [@better-auth/expo](https://github.com/better-auth/better-auth/tree/HEAD/packages/expo) | `1.7.2` | `1.7.3` | | [@better-auth/i18n](https://github.com/better-auth/better-auth/tree/HEAD/packages/i18n) | `1.7.2` | `1.7.3` | | [@better-auth/oauth-provider](https://github.com/better-auth/better-auth/tree/HEAD/packages/oauth-provider) | `1.7.2` | `1.7.3` | | [@better-auth/passkey](https://github.com/better-auth/better-auth/tree/HEAD/packages/passkey) | `1.7.2` | `1.7.3` | | [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.2` | `1.7.3` | Updates `@better-auth/core` from 1.7.2 to 1.7.3 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/core/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.3/packages/core) Updates `@better-auth/expo` from 1.7.2 to 1.7.3 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/expo/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.3/packages/expo) Updates `@better-auth/i18n` from 1.7.2 to 1.7.3 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/i18n/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.3/packages/i18n) Updates `@better-auth/oauth-provider` from 1.7.2 to 1.7.3 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/oauth-provider/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.3/packages/oauth-provider) Updates `@better-auth/passkey` from 1.7.2 to 1.7.3 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/passkey/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.3/packages/passkey) Updates `better-auth` from 1.7.2 to 1.7.3 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.3/packages/better-auth) --- updated-dependencies: - dependency-name: "@better-auth/core" dependency-version: 1.7.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: better-auth - dependency-name: "@better-auth/expo" dependency-version: 1.7.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: better-auth - dependency-name: "@better-auth/i18n" dependency-version: 1.7.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: better-auth - dependency-name: "@better-auth/oauth-provider" dependency-version: 1.7.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: better-auth - dependency-name: "@better-auth/passkey" dependency-version: 1.7.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: better-auth - dependency-name: better-auth dependency-version: 1.7.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: better-auth ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added the dependencies label Sep 14, 2026

dependabot Bot requested a review from Medformatik as a code owner September 14, 2026 04:29

dependabot Bot added the dependencies label Sep 14, 2026

github-actions Bot enabled auto-merge (squash) September 14, 2026 04:29

Navigation Menu

chore(deps): bump the better-auth group with 6 updates - #334

chore(deps): bump the better-auth group with 6 updates#334
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/better-auth-6713621424

dependabot Bot commented on behalf of github Sep 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 14, 2026

v1.7.3

better-auth

Features

Bug Fixes

@better-auth/core

Features

Bug Fixes

1.7.3

Patch Changes

v1.7.3

better-auth

Features

Bug Fixes

@better-auth/core

Features

Bug Fixes

1.7.3

Patch Changes

v1.7.3

better-auth

Features

Bug Fixes

@better-auth/core

Features

Bug Fixes

1.7.3

v1.7.3

better-auth

Features

Bug Fixes

@better-auth/core

Features

Bug Fixes

1.7.3

Patch Changes

v1.7.3

better-auth

Features

Bug Fixes

@better-auth/core

Features

Bug Fixes

1.7.3

v1.7.3

better-auth

Features

Bug Fixes

@better-auth/core

Features

Bug Fixes

1.7.3

Patch Changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`better-auth`

`@better-auth/core`

`better-auth`

`@better-auth/core`

`better-auth`

`@better-auth/core`

`better-auth`

`@better-auth/core`

`better-auth`

`@better-auth/core`

`better-auth`

`@better-auth/core`