v1.7.0-rc.5 release

better-auth

❗ Breaking Changes

• Refactored OAuth device grant ownership to use oauthDeviceAuthorization() alongside oauthProvider() or mcp() (#10746)

Migration: Replace the standalone deviceCodeGrant() plugin with oauthDeviceAuthorization() used alongside oauthProvider() or mcp(). Regenerate and apply the schema (resource column is replaced by oauthClientId and resources). Let any pending device codes expire or delete them before upgrading, as they cannot be exchanged through the new integration.

Features

• Added option to disable displayName in the username plugin (#10330)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

❗ Breaking Changes

• Refactored OAuth device grant ownership to use oauthDeviceAuthorization() alongside oauthProvider() or mcp() (#10746)

Migration: Replace the standalone deviceCodeGrant() plugin with oauthDeviceAuthorization() used alongside oauthProvider() or mcp(). Regenerate and apply the schema (resource column is replaced by oauthClientId and resources). Let any pending device codes expire or delete them before upgrading, as they cannot be exchanged through the new integration.

Features

• Removed the silenceWarnings config option and startup warnings for well-known metadata endpoints (#10703)

Bug Fixes

• Fixed device authorization flow to enforce RFC requirements (#10752)

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

• Fixed type alignment between auth endpoints and better-call (#10657)

For detailed changes, see CHANGELOG

auth

Bug Fixes

• Fixed CLI to align installed packages with the running CLI version (#10743)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@bytaesu, @gustavovalverde, @ping-maxwell

Full changelog: v1.7.0-rc.4...v1.7.0-rc.5