[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@better-auth/passkey (source)	^1.7.7 → ^1.7.10
@better-auth/redis-storage (source)	^1.7.7 → ^1.7.10
@hono/node-server	^2.1.4 → ^2.1.5
better-auth (source)	^1.7.7 → ^1.7.10
resend	^6.32.1 → ^6.33.0
typescript-eslint (source)	^8.71.1 → ^8.71.2
zod (source)	^4.6.5 → ^4.6.7

---

Release Notes

better-auth/better-auth (@​better-auth/passkey)

v1.7.10

Compare Source

v1.7.9

Compare Source

v1.7.8

Compare Source

Patch Changes

• #​11512 4175b34 Thanks @​bytaesu! - Align the installed @better-auth/utils version with better-call while accepting ^0.4.2 || ^0.5.0 across official package peers.

better-auth/better-auth (@​better-auth/redis-storage)

v1.7.10

Compare Source

v1.7.9

Compare Source

v1.7.8

Compare Source

better-auth/better-auth (better-auth)

v1.7.10

Compare Source

Patch Changes

• #​11393 eebd47a Thanks @​breken-ai! - If you use the lastLoginMethod plugin with oneTap, signing in through Google One Tap now records "google", the same value as signing in with the Google button. Before, a One Tap sign-in recorded nothing: the better-auth.last_used_login_method cookie kept its previous value or stayed unset, and so did user.lastLoginMethod with storeInDatabase.

  If your customResolveMethod includes a /one-tap/callback → "google" workaround, remove that mapping; keep the resolver if it handles other routes.

• #​11821 09d07e6 Thanks @​gustavovalverde! - The Google One Tap prompt (authClient.oneTap() without button) no longer calls getSkippedReason(), which Google's FedCM migration guide says to remove. Before, it called it under any promptOptions.fedCM setting.

  A skipped prompt now ends the flow and calls onPromptNotification right away instead of retrying. Google doesn't report why a prompt was skipped, and a prompt the user closed stays hidden for Google's cooldown period, so the retries could not bring it back. Dismissed prompts still retry as before.

  Google Identity Services still logs its FedCM migration warning, because it does so whenever prompt() receives a listener. The plugin needs the listener to track dismissals and skips, so the warning is expected and safe to ignore.

• #​11819 eaecb72 Thanks @​gustavovalverde! - Google One Tap now applies your socialProviders.google.mapProfileToUser and custom getUserInfo, the same as the standard Google sign-in. Before, One Tap ignored both and always stored the token's name, email, email_verified, and picture claims.

  If you configured either one, users created through One Tap now get the fields it returns, including any extra fields such as a first name from given_name. Returning users are updated from it on each One Tap sign-in when socialProviders.google.overrideUserInfoOnSignIn is on, and so are existing users that One Tap links when account.accountLinking.updateUserInfoOnLink is on. Check that your mapper suits One Tap users too.

  If you set socialProviders.google.overrideUserInfoOnSignIn, One Tap sign-ins now update returning users' name, image, and email from Google, as the redirect sign-in already does.

  Setups that configure none of these, including oneTap({ clientId }) with no Google provider, are unaffected.

• #​11820 88c9a37 Thanks @​gustavovalverde! - If you set autoSelect or cancelOnTapOutside on oneTapClient(), the One Tap prompt and the Sign in with Google button now use them. Before, only values passed to authClient.oneTap() took effect, so with autoSelect: true on the plugin, returning users still had to pick an account. Values passed to oneTap() still override the plugin's. Apps that set these options only on oneTap(), or not at all, are unaffected.

• #​11696 0cf1f7c Thanks @​drewsephski! - You can now import the One Tap plugin from better-auth/plugins/one-tap, as you can for other plugins. Previously this import failed with a "not exported" error. Imports from better-auth/plugins and better-auth/client/plugins are unchanged.

• #​11822 414e845 Thanks @​gustavovalverde! - You can now import the Captcha and OpenAPI plugins from better-auth/plugins/captcha and better-auth/plugins/open-api, as you can for other plugins. Previously these imports failed with a "not exported" error. Imports from better-auth/plugins are unchanged.

  If your TypeScript config uses "moduleResolution": "node" (or node10), better-auth/plugins/multi-session and better-auth/test now resolve their types. Previously TypeScript reported that it could not find their declarations. Projects using bundler, node16, or nodenext resolution are unaffected.

• Updated dependencies [fedd055, bbd0a19, 99cdfe7]:

  • @​better-auth/core@1.7.10
  • @​better-auth/mongo-adapter@1.7.10
  • @​better-auth/drizzle-adapter@1.7.10
  • @​better-auth/kysely-adapter@1.7.10
  • @​better-auth/memory-adapter@1.7.10
  • @​better-auth/prisma-adapter@1.7.10
  • @​better-auth/telemetry@1.7.10

v1.7.9

Compare Source

Patch Changes

• #​11766 6edaa61 Thanks @​bytaesu! - An onAPIError.onError handler that throws or rejects no longer fails the request or causes an unhandled promise rejection. The error is logged and the original error response is returned. Async handlers now finish before the response is sent.

• Updated dependencies []:

  • @​better-auth/core@1.7.9
  • @​better-auth/drizzle-adapter@1.7.9
  • @​better-auth/kysely-adapter@1.7.9
  • @​better-auth/memory-adapter@1.7.9
  • @​better-auth/mongo-adapter@1.7.9
  • @​better-auth/prisma-adapter@1.7.9
  • @​better-auth/telemetry@1.7.9

v1.7.8

Compare Source

Patch Changes

• #​11512 4175b34 Thanks @​bytaesu! - Align the installed @better-auth/utils version with better-call while accepting ^0.4.2 || ^0.5.0 across official package peers.

• #​11565 b1cfc1e Thanks @​bytaesu! - Omit non-returned custom fields from inferred output schema types.

• #​11540 678c555 Thanks @​bytaesu! - Align cookie security attributes with RFC 6265bis.

• #​10591 193efff Thanks @​kdelay! - Expired or revoked sessions now clear stale cookies when using customSession.

• #​11625 369176e Thanks @​gustavovalverde! - Fixed single-use checks for apps that set advanced.database.generateId: "uuid". Default id generation is unaffected, and no migration is needed.

  • On SQLite and MySQL, SAML sign-in, DPoP-bound requests checked against the database replay store, private_key_jwt client authentication, and magic link or email OTP sign-ins that adopt an unverified account failed with a NOT NULL error on the id column. They now work. SIWE sign-in ignored the email field and used the wallet-derived address; it now uses the supplied email when no other account has it.
  • On Postgres and MongoDB, a reused SAML assertion, DPoP proof, or client assertion was accepted. Each one is now accepted only once.

  With generateId: "serial", behavior is unchanged: these checks need string ids, and Better Auth now logs a warning the first time one of these flows runs.

• #​11391 352d04c Thanks @​breken-ai! - Fix customSession treating session lookup failures as signed-out users. Server-side getSession now throws an API error, and HTTP clients receive an error response.

• #​11750 e9d9921 Thanks @​gustavovalverde! - Generic OAuth providers configured with discoveryUrl now recover without a restart when discovery fails at startup. Since 1.7.3, a provider whose discovery request failed at boot (for example, because the identity provider was still starting) was skipped, and every sign-in returned PROVIDER_NOT_FOUND until the app restarted. Better Auth now retries discovery on the next sign-in, callback, or account-linking request for that provider, and the provider works as soon as discovery succeeds. While discovery keeps failing, sign-in and account linking still return PROVIDER_NOT_FOUND and callbacks redirect with error=oauth_provider_not_found, and each request may wait up to 10 seconds for the retry.

• #​11549 1bd5c37 Thanks @​bytaesu! - Fix lastLoginMethod failing sign-in when cookieName or maxAge is explicitly undefined.

• #​11174 766cfb3 Thanks @​Bekacru! - Stop double-decoding callbackURL, newUserCallbackURL and errorCallbackURL on magic link verify so percent-encoded characters in callback query params are preserved.

• #​11505 c46992f Thanks @​bytaesu! - Preserve the referenced model and field keys when generating Kysely migrations, so custom table names that match another model key produce the intended foreign keys.

• #​11718 1d95ebf Thanks @​bytaesu! - Fix missing device sessions and failed automatic session switching after cache eviction when storeSessionInDatabase is enabled and preserveSessionInDatabase is disabled. Automatic switching now follows the order of held sessions, and large lists or sessions whose users no longer exist no longer cause valid sessions to disappear.

• #​10266 c68b2cd Thanks @​shiminshen! - Projects that enable exactOptionalPropertyTypes can use the oauthProvider() and mcp() plugins again. Since 1.7.0, adding either plugin to betterAuth() failed to type-check with a TS2322 error.

• #​11637 2627237 Thanks @​gustavovalverde! - Projects using the organization plugin with skipLibCheck: false no longer get TS2536: Type '"role"' cannot be used to index type ... from crud-members.d.mts. The role returned by getActiveMemberRole is now typed as the organization's role names directly. Projects with skipLibCheck: true (the default in most templates) were unaffected.

• #​10866 3d1f008 Thanks @​heliohm! - The organization plugin no longer pulls every zod locale into server bundles.

• #​11626 67743ed Thanks @​gustavovalverde! - Password resets and password changes no longer keep the new password when revoking the user's sessions fails. With revokeSessionsOnPasswordReset or revokeOtherSessions, database sessions are revoked and the password is saved in one transaction when transactions are enabled for the adapter, so a failure leaves the old password and sessions in place. Sessions in secondary storage are still removed after commit, on a best-effort basis. This covers /reset-password, the email OTP and phone number reset endpoints, and /change-password. onPasswordReset now runs after sessions are revoked, so a throwing callback no longer leaves them active, and a callback that lists the user's sessions no longer sees the revoked ones.

• #​10698 f0ce580 Thanks @​jashkarangiya! - If you set the phone number plugin's verifyOTP option, /phone-number/reset-password now checks the code with it, as /phone-number/verify already does. Before, password reset always compared the code with the one Better Auth generated, so apps that verify codes through a provider such as Twilio Verify could not reset passwords. If your sendPasswordResetOTP sends the code Better Auth generates, make sure verifyOTP accepts that code. Apps that don't set verifyOTP are unaffected.

• #​11646 07a0938 Thanks @​gustavovalverde! - A failed password reset no longer spends the reset link or OTP. /reset-password, /email-otp/reset-password and /phone-number/reset-password now check the token or code without consuming it, validate and hash the new password, then consume it in the same transaction as the session revocation and password write. A rejected password, such as one refused by haveIBeenPwned, always leaves the link or OTP usable. A later failure, such as a failed session revocation or password write, also leaves it usable when the adapter's transactions are enabled and verification values are stored in the database (the default without secondary storage, or verification.storeInDatabase: true). Wrong codes still count against the OTP attempt limit.

• #​11643 92dfcea Thanks @​gustavovalverde! - A sign-up that fails after its session is created no longer leaves that session in secondary storage. With storeSessionInDatabase enabled and preserveSessionInDatabase off, the secondary-storage copy is written only after the sign-up commits, and listing a user's sessions now reads the database, so a session whose cached copy failed to write is still listed and revoked. With other secondary-storage settings, sign-up, passkey registration and SSO sign-in with resolveUser keep the session write inside their transaction, so a storage failure rolls back the new user, passkey or account instead of keeping them without a session. A session revoked by a session.create.after database hook also stays revoked.

• #​11488 e15625f Thanks @​Bekacru! - SvelteKit 3 projects can now install Better Auth without --legacy-peer-deps. The @sveltejs/kit peer range now includes ^3.0.0; SvelteKit 2 projects are unaffected.

• Updated dependencies [4175b34, 435645e, 369176e, 0cfe07d, 9904b29, e78f15a, 60525e0, 8133265, ea85d13, 916ef5c, 1d95ebf, 6214610, 67743ed, c46d2a6, 92dfcea, a9f455d, 9725f1b]:

  • @​better-auth/core@1.7.8
  • @​better-auth/drizzle-adapter@1.7.8
  • @​better-auth/kysely-adapter@1.7.8
  • @​better-auth/memory-adapter@1.7.8
  • @​better-auth/mongo-adapter@1.7.8
  • @​better-auth/prisma-adapter@1.7.8
  • @​better-auth/telemetry@1.7.8

resend/resend-node (resend)

v6.33.0

Compare Source

What's Changed

• feat: inboxes endpoints by @​isabellaaquino in #​1088

Full Changelog: resend/resend-node@v6.32.1...v6.33.0

colinhacks/zod (zod)

v4.6.7

Compare Source

Commits:

• b500a2e 4.6.7

v4.6.6

Compare Source

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #​6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243f, the pre-rewrite copy of 9c21983 with identical contents.

Commits:

• 0cd3af5 docs: load the en locale directly in Zod Mini
• 9d5e60f docs: import locales from zod/locales, not z.locales
• 34a626f docs: tighten the z.locales tree-shaking note
• 74304ce release: stage npm versions instead of publishing them (#​6622)
• b2ef983 docs: add Code for Japan to bronze sponsors
• 8fb2faf docs: crop the Code for Japan logo and list it first in bronze
• bacad51 docs: square the Code for Japan logo to match the other bronze tiles
• c42596b release: hold the run on the release-approval environment until the staged versions are approved (#​6638)
• a2ba4a6 fix(types): declare record output and input as members, not base type arguments (#​6645)
• a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#​6652)
• 529f78d 4.6.6
• 9c21983 ci: stage at verbose so a failed OIDC token exchange says why

---

Configuration

📅 Schedule: (in timezone Europe/London)

• Branch creation
  • "before 6am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.