megachangelog
Announcement1.7.0-rc.5

v1.7.0-rc.5 release

Release candidate 5 for v1.7.0 includes breaking OAuth device grant refactoring, new username plugin options, bug fixes across OAuth provider and SCIM, and CLI package alignment improvements.

better-auth

❗ Breaking Changes

  • Refactored OAuth device grant ownership to use oauthDeviceAuthorization() alongside oauthProvider() or mcp() (#10746)

Migration: Replace the standalone deviceCodeGrant() plugin with oauthDeviceAuthorization() used alongside oauthProvider() or mcp(). Regenerate and apply the schema (resource column is replaced by oauthClientId and resources). Let any pending device codes expire or delete them before upgrading, as they cannot be exchanged through the new integration.

Features

  • Added option to disable displayName in the username plugin (#10330)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

❗ Breaking Changes

  • Refactored OAuth device grant ownership to use oauthDeviceAuthorization() alongside oauthProvider() or mcp() (#10746)

Migration: Replace the standalone deviceCodeGrant() plugin with oauthDeviceAuthorization() used alongside oauthProvider() or mcp(). Regenerate and apply the schema (resource column is replaced by oauthClientId and resources). Let any pending device codes expire or delete them before upgrading, as they cannot be exchanged through the new integration.

Features

  • Removed the silenceWarnings config option and startup warnings for well-known metadata endpoints (#10703)

Bug Fixes

  • Fixed device authorization flow to enforce RFC requirements (#10752)

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

  • Fixed type alignment between auth endpoints and better-call (#10657)

For detailed changes, see CHANGELOG

auth

Bug Fixes

  • Fixed CLI to align installed packages with the running CLI version (#10743)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@bytaesu, @gustavovalverde, @ping-maxwell

Full changelog: v1.7.0-rc.4...v1.7.0-rc.5

oauthbreaking-changedevice-grantbug-fixscim

Source: original entry ↗

More from Better Auth

Follow Better Auth to get its new changes in your feed and email digest.

Security1.7.7

Magic Link upgrade and critical security fixes

Better Auth v1.7.7 addresses a critical Magic Link account-takeover vulnerability and multiple security issues including OAuth/SAML sign-in bugs and missing JSON headers in error responses. Magic Link requires a server upgrade with verification storage coordination, but no database migration is needed.

securityauthmagic-linkoauthbug-fix
Improvement1.7.6

v1.7.6

Better Auth v1.7.6 adds support for customizable banned user messages and Vercel BotID captcha provider for authentication. This release fixes critical bugs including React hydration mismatches, password length validation, overlapping auth query requests, model identity issues across multiple adapters, and OAuth social account linking.

authcaptchasecurityadaptersbug-fixes
Improvement1.7.5

v1.7.5 Release

This release adds database schema name support for direct PostgreSQL connections and includes multiple bug fixes across better-auth packages, including improvements to server-side logging, database migrations, index validation, and adapter initialization.

postgresqldatabasebug-fixesadapterslogging
See all Better Auth changes →