megachangelog
Fix1.6.26

v1.6.26 Release

This release includes multiple bug fixes across session management, OTP authentication, JWT handling, OAuth proxy, and database operations, along with performance improvements for Next.js applications and utilities for placeholder email generation.

better-auth

Bug Fixes

  • Fixed session cleanup on user deletion to also remove sessions from secondary storage (#10520)
  • Fixed findSessions to skip invalid secondary-storage session entries without discarding other valid sessions (#10580)
  • Fixed email OTP sign-up to pass the verification type to custom OTP generators (#10608)
  • Fixed email OTP password reset to allow retrying after entering an invalid password (#10552)
  • Fixed email OTP verification to no longer reveal whether an email is registered before the OTP is verified (#10605)
  • Fixed jwtClient() collapsing createAuthClient type inference when combined with other client plugins (#10513)
  • Fixed JWT key minting inside database transactions to use the transaction-scoped adapter, preventing deadlocks on SQLite and ensuring keys commit with their surrounding transaction on Postgres and MySQL (#10623)
  • Fixed oAuthProxy to preserve Apple user data from form_post callbacks (#10599)
  • Fixed oneTapClient() collapsing createAuthClient type inference when combined with other client plugins (#10635)
  • Fixed database rate-limit cleanup to complete when no background task handler is configured (#10619)
  • Improved nextCookies performance in instrumented Next.js applications by reusing the next/headers import promise (#10467)

For detailed changes, see CHANGELOG

@better-auth/core

Features

  • Added a utility for creating stable, namespaced placeholder emails on the reserved placeholder.invalid domain (#10576)

For detailed changes, see CHANGELOG

@better-auth/redis-storage

Bug Fixes

  • Fixed listKeys() and clear() to use SCAN instead of KEYS so large keyspaces no longer block the Redis server (#10507)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@bytaesu, @Emmaccen, @gustavovalverde, @jashkarangiya, @jeroenvandermerwe, @jlucaso1, @krish-vachhani, @mrosberghaus, @XXMOHAMED012

Full changelog: v1.6.25...v1.6.26

sessionauthbug-fixesotpjwtperformance

Source: original entry ↗

More from Better Auth

Follow Better Auth to get its new changes in your feed and email digest.

Security1.7.7

Magic Link upgrade and critical security fixes

Better Auth v1.7.7 addresses a critical Magic Link account-takeover vulnerability and multiple security issues including OAuth/SAML sign-in bugs and missing JSON headers in error responses. Magic Link requires a server upgrade with verification storage coordination, but no database migration is needed.

securityauthmagic-linkoauthbug-fix
Improvement1.7.6

v1.7.6

Better Auth v1.7.6 adds support for customizable banned user messages and Vercel BotID captcha provider for authentication. This release fixes critical bugs including React hydration mismatches, password length validation, overlapping auth query requests, model identity issues across multiple adapters, and OAuth social account linking.

authcaptchasecurityadaptersbug-fixes
Improvement1.7.5

v1.7.5 Release

This release adds database schema name support for direct PostgreSQL connections and includes multiple bug fixes across better-auth packages, including improvements to server-side logging, database migrations, index validation, and adapter initialization.

postgresqldatabasebug-fixesadapterslogging
See all Better Auth changes →