v1.7.0-rc.4 release with OAuth fixes and security improvements

better-auth

Features

• Added a placeholder email utility for generating temporary email addresses (#10576)

Bug Fixes

• Fixed sessions not being cleaned up when a user is deleted (#10520)
• Fixed missing PKCE challenge in Apple OAuth flows (#10294)
• Fixed duplicate in-flight session requests when React retries a suspended component (#10676)
• Fixed cookie cache to work independently of the JWT plugin internals (#10666)
• Fixed findSessions to skip null-parsed session tokens instead of returning early (#10580)
• Fixed missing verification type when sending email OTP during sign-up (#10608)
• Fixed OTP being cleared after password validation errors in email OTP flows (#10552)
• Fixed email OTP to verify the code before revealing whether the email exists (#10605)
• Fixed client plugin type inference when using jwtClient (#10513)
• Fixed JWT signing to use the transaction-scoped adapter (#10623)
• Fixed Apple user data being lost when using the OAuth proxy (#10599)
• Fixed Google One Tap to enforce provider signup restrictions (#10479)
• Fixed client plugin type inference when using oneTapClient (#10635)
• Fixed rate limit database cleanup to be awaited by default (#10619)
• Fixed $fetch and $store not being exposed on the Solid client (#10444)
• Improved Next.js performance by reusing the next/headers import promise in production (#10467)

For detailed changes, see CHANGELOG

@better-auth/expo

❗ Breaking Changes

• Switched to async secure storage access to prevent crashes when iOS Keychain is unavailable (#10438)

Migration: getCookie() now returns a Promise. Custom storage implementations must provide both sync and async SecureStore methods, and should use setItemAsync() when the write must be awaited.

For detailed changes, see CHANGELOG

@better-auth/redis-storage

Bug Fixes

• Fixed Redis storage to use SCAN instead of KEYS to avoid blocking the server (#10507)

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

• Fixed SCIM PATCH to create filtered attribute values when no target matches, instead of rejecting with a noTarget error (#10682)

For detailed changes, see CHANGELOG

auth

Bug Fixes

• Fixed issuer-scoped account identities being overwritten during OAuth flows (#10668)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@birkskyum, @bytaesu, @Emmaccen, @gustavovalverde, @jashkarangiya, @jeroenvandermerwe, @jlucaso1, @jsj, @krish-vachhani, @mrosberghaus, @XXMOHAMED012

Full changelog: v1.7.0-rc.3...v1.7.0-rc.4