[dependabot]

Bumps @better-auth/core from 1.7.14 to 1.7.17.

Release notes

Sourced from @​better-auth/core's releases.

v1.7.17

better-auth

Bug Fixes

• Fixed sessions created by a session.delete.after hook being treated as revoked during "revoke all sessions" when using secondaryStorage with storeSessionInDatabase (#12212)
• Fixed remembered sign-ins and sign-ups to refresh their session even if an earlier sign-in in the same browser used rememberMe: false (#12181)
• Fixed denying a device authorization request to reject a revoked session that is still in the cookie cache (#12216)
• Fixed IP wildcard trusted origins such as exp://192.168.*.*:* matching custom-scheme hosts with out-of-range or zero-padded octets (#12217)
• Fixed the phone number plugin storing an empty phoneNumber on sign-up and replacing a verified number when linking an account with an empty phone number (#12219)
• Fixed TOTP verification rejecting API key sessions so they can now finish two-factor enrollment (#12211)
• Fixed trusted devices being ignored when an app runs the two-factor sign-in step from its own hook on another sign-in path, such as email OTP (#12228)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

• Fixed Expo social sign-in to reject authorization URLs without a state parameter when OAuth state is stored in a cookie (#12218)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• Fixed MySQL create with generateId: "serial" leaving an inserted row behind when the table reports no auto-increment id (#12220)

For detailed changes, see CHANGELOG

@better-auth/passkey

Bug Fixes

• Fixed passkey registration and sign-in when one passkey() plugin is shared between auth instances where only some set baseURL (#12225)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​aliamanatali, @​bytaesu

Full changelog: v1.7.16...v1.7.17

v1.7.16

better-auth

... (truncated)

Changelog

Sourced from @​better-auth/core's changelog.

1.7.17

1.7.16

Patch Changes

• #12198 f25081a Thanks @​bytaesu! - Generic OAuth providers whose discovery document has a jwks_uri now reject a user profile whose sub differs from the ID token's sub. Direct ID-token sign-in and linking with a generic OAuth provider now resolve the profile from the verified ID token only and ignore a submitted access or refresh token.

• #12198 f25081a Thanks @​bytaesu! - Account linking and new OAuth users now count an email as verified only when the provider claim is true or the string "true", which covers generic OAuth, Cognito, and Microsoft Entra ID claims sent as strings. Any other emailVerified value, including a non-boolean value returned from mapProfileToUser such as 1, now reads as unverified.

• #12198 f25081a Thanks @​bytaesu! - The Zoom social provider now applies its configured provider options, so disableSignUp, requireEmailVerification, and overrideUserInfoOnSignIn take effect for Zoom sign-ins.

1.7.15

Patch Changes

• #12106 9ef0c5b Thanks @​bytaesu! - Built-in social providers no longer follow HTTP redirects on token exchange, refresh, verification, and signing key (JWKS) requests, matching the other server-side OAuth requests.

Commits

• e3ae9e1 chore: release v1.7.17 (#12214)
• e0d6185 docs(rate-limit): explain how Better Auth finds the client IP (#12226)
• 93edae1 chore: release v1.7.16 (#12199)
• f25081a fix: harden authentication flows (#12198)
• e556c07 chore: release v1.7.15 (#12101)
• 9ef0c5b fix(core): refuse redirects on built-in provider token and key requests (#12106)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)