v1.6.24 Release

better-auth

Features

• Added request context (ctx) as a third argument to verifyIdToken, enabling custom ID token verifiers to read request headers (#10376)
• Added beforeStoreCookie option to the last-login-method plugin for GDPR compliance (#5753)

Bug Fixes

• Replaced flaky MongoDB where-coercion integration test with a direct unit test for more reliable test runs (#10369)
• Fixed the get-session endpoint to include no-store cache control headers, preventing stale session data from being served (#10222)
• Fixed SQLite migration diffs to recognize BIGINT as a valid number type, preventing spurious pending changes on rate limiter columns (#10316)
• Fixed auth requests failing when request cloning throws an error inside verification callbacks (#10336)
• Fixed useSession({ throw: true }) incorrectly excluding null from its data type (#9787)
• Fixed auth query revalidation and signal listeners not being restored after a client component remounts (#10379)
• Fixed the CookieAttributes index signature type to be more precise (#10442)
• Fixed silent misrouting of adapter queries when user.modelName was set to a value that collides with another schema key (#10235)
• Fixed Kysely migration generation producing duplicate indexes for fields marked both unique and index (#10357)
• Fixed magic-link and email-OTP send endpoints to validate the Origin header on cookieless requests, preventing cross-origin abuse (#10368)
• Fixed remote MCP auth 401 challenge headers being hidden from browser clients due to missing CORS exposure (#10290)
• Fixed OpenAPI schema to include plugin user fields (such as username and displayUsername) in /sign-up/email and /update-user request bodies (#10453)
• Fixed organization.listMembers failing with "User not found for member" for organizations with more than ~100 members (#10342)
• Fixed organization invitations to use database-generated IDs when advanced.database.generateId is configured, matching the behavior of other models (#10040)
• Fixed getDefaultModelName to prefer exact schema key matches over modelName aliases, preventing adapter queries from being misrouted when a built-in table's name collides with another schema key

For detailed changes, see CHANGELOG

auth

Bug Fixes

• Fixed SvelteKit builds by stubbing explicit-environment-variables modules (#10221)
• Fixed Drizzle schema generation producing duplicate indexes for fields marked both unique and index (#10333)
• Fixed Drizzle schema generation for tables with multiple foreign keys to the same model by adding disambiguating relationName values (#10352)
• Fixed auth generate failing when the config file imports the not-yet-generated output file (e.g. on a Convex first run) (#10302)

For detailed changes, see CHANGELOG

@better-auth/electron

Bug Fixes

• Updated compatibility testing to include Electron 43 (peer range unchanged at >=36.0.0) (#10440)
• Fixed /electron/init-oauth-proxy forwarding multiple Set-Cookie headers as a single comma-joined string, which caused the browser to drop the transfer-token cookie during OAuth handoff (#9672)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed an intermittent "No request state found" error caused by a race condition in AsyncLocalStorage initialization on serverless cold starts (e.g. Cloudflare Workers) (#9862)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed IdP-initiated SAML sign-ins in split-origin deployments to redirect users to the configured application URL instead of the authentication server, using idpInitiatedCallbackUrl (#10388)

For detailed changes, see CHANGELOG

@better-auth/stripe

Bug Fixes

• Fixed beforeDeleteOrganization and afterDeleteOrganization hooks not receiving the endpoint context as the second argument (#10190)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@akshatmalik-bruh, @ayushman46, @c-nicol, @gaurav-init, @gaurav0107, @GautamBytes, @momomuchu, @OrangeManLi, @paoloricciuti, @ping-maxwell, @shiminshen, @swithek, @Tushar-Khandelwal-2004, @vinay-oppuri

Full changelog: v1.6.23...v1.6.24