v1.7.21

Important

Action required

• If you use SCIM with an adapter that has no native transactions, switch to an adapter with native transactions to provision users and groups. (#12413)
• If you use the MongoDB adapter and an index build fails because of duplicate values, missing createIndex permission, or a conflicting index on the same field, fix the cause and restart. (#12299)
• If you rely on update changing every row that matches a non-unique filter, use updateMany instead. (#12390)
• If you set discoveryHeaders and your discoveryUrl redirects to another origin, set discoveryUrl to the final URL, because discovery now fails on cross-origin redirects. (#12179)
• If your clients match on the invalid_client_metadata error code for rejected post_logout_redirect_uris, update them to check for invalid_redirect_uri. (#12391)
• If you throw from sendVerificationEmail to reject a sign-up, use a databaseHooks.user.create.before hook instead, because a thrown error is now logged and the sign-up still succeeds. (#12052)
• If a wildcard in baseURL.allowedHosts covers your passkey rpID, you don't set origin, and you add tenants at runtime, return their origins from a trustedOrigins function that checks your tenant records. (#12388)

better-auth

Bug Fixes

• Fixed plugin packages importing from the better-auth root, so bundlers no longer emit unused Kysely chunks when used with better-auth/minimal (#12404)
• Fixed magic link and email OTP sign-in failing with a 500 for users with an unverified email on Prisma with MongoDB when id columns use @db.ObjectId (#12126)
• Fixed the device approval page showing a valid code as invalid when the same signed-in user looked it up twice at once, such as under React Strict Mode (#12392)
• Fixed sign-ins with a genericOAuth provider using discoveryUrl and OAuth provider requests using resources hanging on Cloudflare Workers (#12395)
• Fixed Generic OAuth to send authorizationHeaders on access token refresh, added an optional headers input to refreshAccessToken and refreshAccessTokenRequest, and prevented invalid combined headers with differently cased client authentication headers (#12401)
• Fixed generic OAuth to send discoveryHeaders when fetching same-origin jwks_uri keys, and to follow discovery redirects only within the discoveryUrl origin (#12179)
• Fixed intermittent schema does not exist and relation does not exist errors on PostgreSQL during the startup schema check and npx auth@latest migrate when other schemas are dropped concurrently (#11912)
• Fixed email sign-up to keep database writes made while sending verification emails or running onExistingUserSignUp when using a background task handler with a transactional adapter (#12052)
• Fixed SIWE verification to stop exposing internal error messages in its 401 response and log them on the server instead (#12403)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed the OAuth provider returning [object Promise] instead of the refresh token when formatRefreshToken.encrypt is async (#12409)
• Fixed magic link and email OTP sign-in failing with a 500 for users with an unverified email on Prisma with MongoDB when id columns use @db.ObjectId (#12126)
• Fixed sign-ins with a genericOAuth provider using discoveryUrl and OAuth provider requests using resources hanging on Cloudflare Workers (#12395)
• Changed OAuth provider client registration and updates to return invalid_redirect_uri instead of invalid_client_metadata for rejected post_logout_redirect_uris entries (#12391)
• Fixed OAuth provider returning a 500 on near-simultaneous refresh token reuse for opaque access tokens on databases that enforce foreign keys (#11911)
• Fixed OAuth provider consent denial to redirect to the client only while the client is enabled and its redirect_uri is still valid (#12385)
• Fixed OAuth provider to revoke in-flight opaque access tokens after refresh token reuse or a replayed authorization code on databases without foreign keys (#12389)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed null filters on id and reference fields being coerced to 0 when advanced.database.generateId is "serial" (#12402)
• Fixed authentication requests hanging on Cloudflare Workers when the request that started schema validation ended before validation finished (#11716)
• Fixed magic link and email OTP sign-in failing with a 500 for users with an unverified email on Prisma with MongoDB when id columns use @db.ObjectId (#12126)
• Fixed Generic OAuth to send authorizationHeaders on access token refresh, added an optional headers input to refreshAccessToken and refreshAccessTokenRequest, and prevented invalid combined headers with differently cased client authentication headers (#12401)
• Fixed telemetry to report Cloudflare Workers as workerd instead of node when nodejs_compat is enabled, and exported the runtime detection from @better-auth/core/env (#12425)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed plugin packages importing from the better-auth root, so bundlers no longer emit unused Kysely chunks when used with better-auth/minimal (#12404)
• Fixed SAML Single Logout so refreshing a session extends that session's own logout record, for users signed in more than once with the same NameID on the Prisma or MongoDB adapter (#12424)
• Fixed SAML Single Logout (saml.enableSingleLogout) for users who stay signed in past their session's first expiry, for both IdP-initiated and SP-initiated logout (#12417)
• Fixed SAML replay protection to reject a signed response resubmitted with its assertion ID written as XML character references when allowIdpInitiated: true or enableInResponseToValidation: false is set (#12421)

For detailed changes, see CHANGELOG

@better-auth/prisma-adapter

Bug Fixes

• Fixed magic link and email OTP sign-in failing with a 500 for users with an unverified email on Prisma with MongoDB when id columns use @db.ObjectId (#12126)
• Fixed Prisma adapter updates comparing a unique field with null failing with a validation error, and update now changes only one matching row (#12390)
• Fixed the Prisma adapter with provider: "mongodb" to match contains, starts_with, ends_with, and case-insensitive filters as literal text instead of regex patterns (#11807)

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

• Fixed plugin packages importing from the better-auth root, so bundlers no longer emit unused Kysely chunks when used with better-auth/minimal (#12404)
• Fixed SCIM Groups with more than 100 members to sync in full, including Group creation, updates, deletion, role mapping, and managed connection listings (#12070)
• Fixed apps using the SCIM plugin on adapters without native transactions, such as Cloudflare D1, failing at startup; /scim/v2 requests now return 501 Not Implemented on those adapters (#12413)

For detailed changes, see CHANGELOG

@better-auth/electron

Bug Fixes

• Fixed failed deep link authentication in Electron to be logged instead of causing an unhandled promise rejection in the main process (#12409)
• Fixed plugin packages importing from the better-auth root, so bundlers no longer emit unused Kysely chunks when used with better-auth/minimal (#12404)

For detailed changes, see CHANGELOG

@better-auth/api-key

Bug Fixes

• Fixed plugin packages importing from the better-auth root, so bundlers no longer emit unused Kysely chunks when used with better-auth/minimal (#12404)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

• Fixed plugin packages importing from the better-auth root, so bundlers no longer emit unused Kysely chunks when used with better-auth/minimal (#12404)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• Fixed intermittent schema does not exist and relation does not exist errors on PostgreSQL during the startup schema check and npx auth@latest migrate when other schemas are dropped concurrently (#11912)

For detailed changes, see CHANGELOG

@better-auth/mongo-adapter

Bug Fixes

• Added indexes in the MongoDB adapter for schema fields marked unique or index, preventing duplicate users from concurrent sign-ups with the same email (#12299)

For detailed changes, see CHANGELOG

@better-auth/passkey

Bug Fixes

• Fixed passkey startup to no longer require origin when a wildcard in baseURL.allowedHosts covers your rpID, accepting exact trusted origins instead (#12388)

For detailed changes, see CHANGELOG

@better-auth/stripe

Bug Fixes

• Fixed plugin packages importing from the better-auth root, so bundlers no longer emit unused Kysely chunks when used with better-auth/minimal (#12404)

For detailed changes, see CHANGELOG

@better-auth/telemetry

Bug Fixes

• Fixed telemetry to report Cloudflare Workers as workerd instead of node when nodejs_compat is enabled, and exported the runtime detection from @better-auth/core/env (#12425)

For detailed changes, see CHANGELOG

@better-auth/test-utils

Bug Fixes

• Fixed the adapter test for findMany with multiple operators to create users from generated data like other adapter tests (#12409)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@ArjunCodess, @bytaesu, @ghazy2001, @gustavovalverde, @hardikguptaofficialgit, @ItzSudhan, @lakshya-dhariwal, @mallachari, @umeraamir69

Full changelog: v1.7.20...v1.7.21