v1.7.2

better-auth

Bug Fixes

• Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
• Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
• Added warnings for invalid signed session data in the cookie cache. (#10934)
• Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
• Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
• Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
• Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
• Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
• Improved getTestInstance performance with a faster default password hasher. (#10879)
• Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
• Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
• Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
• Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
• Added synchronous and optional access to the current auth endpoint context. (#10938)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
• Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
• Fixed relative redirect URLs containing fragments. (#10983)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
• Added validation for missing Drizzle schema fields in compound where clauses. (#10859)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@bytaesu, @GautamBytes, @heliohm, @sosyz, @starslingdev[bot]

Full changelog: v1.7.1...v1.7.2