Skip to content

chore(deps): bump the better-auth group across 1 directory with 4 updates - #311

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/better-auth-1e0a2f2031
Open

chore(deps): bump the better-auth group across 1 directory with 4 updates#311
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/better-auth-1e0a2f2031

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the better-auth group with 4 updates in the / directory: better-auth, @better-auth/cimd, @better-auth/mcp and @better-auth/oauth-provider.

Updates better-auth from 1.7.13 to 1.7.18

Release notes

Sourced from better-auth's releases.

v1.7.18

[!IMPORTANT] Action required

  • If you use getTestInstance with testWith: "mysql", run a MySQL server at 127.0.0.1:3306 with the root password set to root_password. (#12244)

better-auth

Bug Fixes

  • Fixed "revoke all sessions" with secondaryStorage and storeSessionInDatabase to also revoke sessions created while the revocation is running, except sessions created by a session.delete.after hook, which stay active (#12259)
  • Fixed getTestInstance from better-auth/test to close its own Postgres connection pool and SQLite database when the test file finishes, while with Vitest's default sequence.hooks: "stack" your afterAll hooks still run first and can keep using the instance (#12250)
  • Fixed getTestInstance with testWith: "mysql" hanging, and added a separate database per instance so several instances can run in one test file (#12244)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • fix(core): accept introspected tokens when verifyOptions.typ is set (#12249)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​gustavovalverde

Full changelog: v1.7.17...v1.7.18

v1.7.17

better-auth

Bug Fixes

  • Fixed sessions created by a session.delete.after hook being treated as revoked during "revoke all sessions" when using secondaryStorage with storeSessionInDatabase (#12212)
  • Fixed remembered sign-ins and sign-ups to refresh their session even if an earlier sign-in in the same browser used rememberMe: false (#12181)
  • Fixed denying a device authorization request to reject a revoked session that is still in the cookie cache (#12216)
  • Fixed IP wildcard trusted origins such as exp://192.168.*.*:* matching custom-scheme hosts with out-of-range or zero-padded octets (#12217)
  • Fixed the phone number plugin storing an empty phoneNumber on sign-up and replacing a verified number when linking an account with an empty phone number (#12219)
  • Fixed TOTP verification rejecting API key sessions so they can now finish two-factor enrollment (#12211)
  • Fixed trusted devices being ignored when an app runs the two-factor sign-in step from its own hook on another sign-in path, such as email OTP (#12228)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.18

Patch Changes

  • #12259 9e2a0ec Thanks @​gustavovalverde! - Fixed "revoke all sessions" with secondaryStorage and storeSessionInDatabase so that sessions created while the revocation runs are revoked too. Sessions created by a session.delete.after hook still stay active.

  • #12244 85f4342 Thanks @​gustavovalverde! - getTestInstance with testWith: "mysql" no longer hangs. It expects a MySQL server at 127.0.0.1:3306 whose root password is root_password, and it creates and drops a separate database for each instance, so several instances can run in one test file.

  • #12250 278bb28 Thanks @​gustavovalverde! - getTestInstance from better-auth/test now closes the Postgres connection pool and the SQLite database it created when the test file finishes. Previously both stayed open until the test worker exited. With Vitest's default sequence.hooks: "stack", afterAll hooks in your test files still run before this cleanup and can keep using the instance.

  • Updated dependencies [9342a73]:

    • @​better-auth/core@​1.7.18
    • @​better-auth/drizzle-adapter@​1.7.18
    • @​better-auth/kysely-adapter@​1.7.18
    • @​better-auth/memory-adapter@​1.7.18
    • @​better-auth/mongo-adapter@​1.7.18
    • @​better-auth/prisma-adapter@​1.7.18
    • @​better-auth/telemetry@​1.7.18

1.7.17

Patch Changes

  • #12181 b6a87ad Thanks @​aliamanatali! - A remembered sign-in or sign-up now refreshes its session like any other remembered session, even if an earlier sign-in in the same browser used rememberMe: false. Previously the earlier choice stayed in a dont_remember cookie until the browser closed, so the new session stopped sliding and expired expiresIn after it was created.

  • #12216 cff7c1c Thanks @​bytaesu! - Denying a device authorization request now rejects a session that was revoked but still present in the cookie cache, matching the behavior of approving a request.

  • #12217 16aa412 Thanks @​bytaesu! - IP wildcard trusted origins such as exp://192.168.*.*:* no longer match custom-scheme hosts with out-of-range or zero-padded octets like 192.168.999.999.

  • #12219 9150314 Thanks @​bytaesu! - Signing up with an empty phoneNumber with the phone number plugin no longer stores the empty string or makes later sign-ups fail. Linking an account whose profile maps an empty phone number no longer replaces the user's verified number.

  • #12212 f5be351 Thanks @​bytaesu! - Fixed sessions created by a session.delete.after hook during "revoke all sessions" being treated as revoked immediately when secondaryStorage is used with storeSessionInDatabase.

  • #12211 98bcd98 Thanks @​bytaesu! - Fixed TOTP verification rejecting sessions created from an API key, so API-key sessions can now finish two-factor enrollment.

  • #12228 fbff537 Thanks @​bytaesu! - Trusted devices are honored again when an app runs the two-factor sign-in step from its own hook on another sign-in path, such as email OTP.

  • Updated dependencies [fc2e00b]:

    • @​better-auth/kysely-adapter@​1.7.17
    • @​better-auth/core@​1.7.17
    • @​better-auth/drizzle-adapter@​1.7.17
    • @​better-auth/memory-adapter@​1.7.17
    • @​better-auth/mongo-adapter@​1.7.17
    • @​better-auth/prisma-adapter@​1.7.17
    • @​better-auth/telemetry@​1.7.17

1.7.16

Patch Changes

... (truncated)

Commits
  • 38f43e3 chore: release v1.7.18 (#12252)
  • 9e2a0ec fix(session): revoke sessions created while bulk revocation runs (#12259)
  • 278bb28 fix(test-utils): close the instance's own Postgres and SQLite handles (#12250)
  • 85f4342 fix(test-utils): make testWith mysql work and run it in CI (#12244)
  • e3ae9e1 chore: release v1.7.17 (#12214)
  • b6a87ad fix(cookies): clear the dont_remember marker on a remembered sign-in (#12181)
  • fbff537 fix(two-factor): honor trusted devices when the sign-in step runs on custom p...
  • 16aa412 fix(origin-check): validate IPv4 octets in IP wildcard trusted origins (#12217)
  • 9150314 fix(phone-number): treat empty phone number as missing (#12219)
  • cff7c1c fix(device-authorization): reject revoked cached sessions on deny (#12216)
  • Additional commits viewable in compare view

Updates @better-auth/cimd from 1.7.13 to 1.7.18

Release notes

Sourced from @​better-auth/cimd's releases.

v1.7.18

[!IMPORTANT] Action required

  • If you use getTestInstance with testWith: "mysql", run a MySQL server at 127.0.0.1:3306 with the root password set to root_password. (#12244)

better-auth

Bug Fixes

  • Fixed "revoke all sessions" with secondaryStorage and storeSessionInDatabase to also revoke sessions created while the revocation is running, except sessions created by a session.delete.after hook, which stay active (#12259)
  • Fixed getTestInstance from better-auth/test to close its own Postgres connection pool and SQLite database when the test file finishes, while with Vitest's default sequence.hooks: "stack" your afterAll hooks still run first and can keep using the instance (#12250)
  • Fixed getTestInstance with testWith: "mysql" hanging, and added a separate database per instance so several instances can run in one test file (#12244)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • fix(core): accept introspected tokens when verifyOptions.typ is set (#12249)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​gustavovalverde

Full changelog: v1.7.17...v1.7.18

v1.7.17

better-auth

Bug Fixes

  • Fixed sessions created by a session.delete.after hook being treated as revoked during "revoke all sessions" when using secondaryStorage with storeSessionInDatabase (#12212)
  • Fixed remembered sign-ins and sign-ups to refresh their session even if an earlier sign-in in the same browser used rememberMe: false (#12181)
  • Fixed denying a device authorization request to reject a revoked session that is still in the cookie cache (#12216)
  • Fixed IP wildcard trusted origins such as exp://192.168.*.*:* matching custom-scheme hosts with out-of-range or zero-padded octets (#12217)
  • Fixed the phone number plugin storing an empty phoneNumber on sign-up and replacing a verified number when linking an account with an empty phone number (#12219)
  • Fixed TOTP verification rejecting API key sessions so they can now finish two-factor enrollment (#12211)
  • Fixed trusted devices being ignored when an app runs the two-factor sign-in step from its own hook on another sign-in path, such as email OTP (#12228)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

... (truncated)

Changelog

Sourced from @​better-auth/cimd's changelog.

1.7.18

1.7.17

1.7.16

1.7.15

Patch Changes

  • #12103 4592923 Thanks @​bytaesu! - The Node metadata transport now rejects responses with an out-of-range status or an invalid reason phrase, so the client is reported as invalid_client instead of the error escaping the request and crashing the process.

1.7.14

Commits

Updates @better-auth/mcp from 1.7.13 to 1.7.18

Release notes

Sourced from @​better-auth/mcp's releases.

v1.7.18

[!IMPORTANT] Action required

  • If you use getTestInstance with testWith: "mysql", run a MySQL server at 127.0.0.1:3306 with the root password set to root_password. (#12244)

better-auth

Bug Fixes

  • Fixed "revoke all sessions" with secondaryStorage and storeSessionInDatabase to also revoke sessions created while the revocation is running, except sessions created by a session.delete.after hook, which stay active (#12259)
  • Fixed getTestInstance from better-auth/test to close its own Postgres connection pool and SQLite database when the test file finishes, while with Vitest's default sequence.hooks: "stack" your afterAll hooks still run first and can keep using the instance (#12250)
  • Fixed getTestInstance with testWith: "mysql" hanging, and added a separate database per instance so several instances can run in one test file (#12244)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • fix(core): accept introspected tokens when verifyOptions.typ is set (#12249)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​gustavovalverde

Full changelog: v1.7.17...v1.7.18

v1.7.17

better-auth

Bug Fixes

  • Fixed sessions created by a session.delete.after hook being treated as revoked during "revoke all sessions" when using secondaryStorage with storeSessionInDatabase (#12212)
  • Fixed remembered sign-ins and sign-ups to refresh their session even if an earlier sign-in in the same browser used rememberMe: false (#12181)
  • Fixed denying a device authorization request to reject a revoked session that is still in the cookie cache (#12216)
  • Fixed IP wildcard trusted origins such as exp://192.168.*.*:* matching custom-scheme hosts with out-of-range or zero-padded octets (#12217)
  • Fixed the phone number plugin storing an empty phoneNumber on sign-up and replacing a verified number when linking an account with an empty phone number (#12219)
  • Fixed TOTP verification rejecting API key sessions so they can now finish two-factor enrollment (#12211)
  • Fixed trusted devices being ignored when an app runs the two-factor sign-in step from its own hook on another sign-in path, such as email OTP (#12228)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

... (truncated)

Changelog

Sourced from @​better-auth/mcp's changelog.

1.7.18

Patch Changes

  • Updated dependencies []:
    • @​better-auth/oauth-provider@​1.7.18

1.7.17

Patch Changes

  • Updated dependencies []:
    • @​better-auth/oauth-provider@​1.7.17

1.7.16

Patch Changes

  • Updated dependencies []:
    • @​better-auth/oauth-provider@​1.7.16

1.7.15

Patch Changes

  • Updated dependencies []:
    • @​better-auth/oauth-provider@​1.7.15

1.7.14

Patch Changes

  • Updated dependencies []:
    • @​better-auth/oauth-provider@​1.7.14
Commits

Updates @better-auth/oauth-provider from 1.7.13 to 1.7.18

Release notes

Sourced from @​better-auth/oauth-provider's releases.

v1.7.18

[!IMPORTANT] Action required

  • If you use getTestInstance with testWith: "mysql", run a MySQL server at 127.0.0.1:3306 with the root password set to root_password. (#12244)

better-auth

Bug Fixes

  • Fixed "revoke all sessions" with secondaryStorage and storeSessionInDatabase to also revoke sessions created while the revocation is running, except sessions created by a session.delete.after hook, which stay active (#12259)
  • Fixed getTestInstance from better-auth/test to close its own Postgres connection pool and SQLite database when the test file finishes, while with Vitest's default sequence.hooks: "stack" your afterAll hooks still run first and can keep using the instance (#12250)
  • Fixed getTestInstance with testWith: "mysql" hanging, and added a separate database per instance so several instances can run in one test file (#12244)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • fix(core): accept introspected tokens when verifyOptions.typ is set (#12249)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​gustavovalverde

Full changelog: v1.7.17...v1.7.18

v1.7.17

better-auth

Bug Fixes

  • Fixed sessions created by a session.delete.after hook being treated as revoked during "revoke all sessions" when using secondaryStorage with storeSessionInDatabase (#12212)
  • Fixed remembered sign-ins and sign-ups to refresh their session even if an earlier sign-in in the same browser used rememberMe: false (#12181)
  • Fixed denying a device authorization request to reject a revoked session that is still in the cookie cache (#12216)
  • Fixed IP wildcard trusted origins such as exp://192.168.*.*:* matching custom-scheme hosts with out-of-range or zero-padded octets (#12217)
  • Fixed the phone number plugin storing an empty phoneNumber on sign-up and replacing a verified number when linking an account with an empty phone number (#12219)
  • Fixed TOTP verification rejecting API key sessions so they can now finish two-factor enrollment (#12211)
  • Fixed trusted devices being ignored when an app runs the two-factor sign-in step from its own hook on another sign-in path, such as email OTP (#12228)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

... (truncated)

Changelog

Sourced from @​better-auth/oauth-provider's changelog.

1.7.18

1.7.17

1.7.16

1.7.15

1.7.14

Commits

@dependabot dependabot Bot added area:infra Infra: CI, Docker, imagem multi-arch, releases, templates de deploy dependencies Pull requests that update a dependency file labels Nov 2, 2026
@dependabot
chore(deps): bump the better-auth group across 1 directory with 4 upd…
8b44559 
…ates

Bumps the better-auth group with 4 updates in the / directory: [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth), [@better-auth/cimd](https://github.com/better-auth/better-auth/tree/HEAD/packages/cimd), [@better-auth/mcp](https://github.com/better-auth/better-auth/tree/HEAD/packages/mcp) and [@better-auth/oauth-provider](https://github.com/better-auth/better-auth/tree/HEAD/packages/oauth-provider).


Updates `better-auth` from 1.7.13 to 1.7.18
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.18/packages/better-auth)

Updates `@better-auth/cimd` from 1.7.13 to 1.7.18
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/cimd/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.18/packages/cimd)

Updates `@better-auth/mcp` from 1.7.13 to 1.7.18
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/mcp/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.18/packages/mcp)

Updates `@better-auth/oauth-provider` from 1.7.13 to 1.7.18
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/oauth-provider/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.18/packages/oauth-provider)

---
updated-dependencies:
- dependency-name: "@better-auth/cimd"
  dependency-version: 1.7.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: better-auth
- dependency-name: "@better-auth/mcp"
  dependency-version: 1.7.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: better-auth
- dependency-name: "@better-auth/oauth-provider"
  dependency-version: 1.7.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: better-auth
- dependency-name: better-auth
  dependency-version: 1.7.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: better-auth
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps): Bump the better-auth group with 4 updates chore(deps): bump the better-auth group across 1 directory with 4 updates Nov 9, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/better-auth-1e0a2f2031 branch from 9604fa4 to 8b44559 Compare November 9, 2026 22:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area:infra Infra: CI, Docker, imagem multi-arch, releases, templates de deploy dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants