v1.7.10 – Bug fixes and improvements across auth packages

better-auth

Bug Fixes

• Fixed Captcha and OpenAPI plugin subpath imports and type resolution for better-auth/plugins/multi-session and better-auth/test. (#11822)
• Fixed Google One Tap sign-ins not recording google as the last login method. (#11393)
• Fixed imports from better-auth/plugins/one-tap failing with a not-exported error. (#11696)
• Fixed Google One Tap ignoring plugin-level autoSelect and cancelOnTapOutside settings. (#11820)
• Fixed Google One Tap sign-ins ignoring configured Google profile mapping and user info updates. (#11819)
• Fixed Google One Tap calling a prompt method unsupported by FedCM and retrying skipped prompts. (#11821)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

• Added optional self-service signing key rotation for private_key_jwt clients. (#11695)

Bug Fixes

• Fixed valid DPoP proofs being rejected for parameterized routes and URLs with trailing slashes. (#11786)
• Fixed native clients with HTTP loopback callbacks being rejected when application type inference is enabled. (#11798)
• Fixed device-code clients being unable to refresh access for approved resources omitted from a token poll. (#11815)
• Fixed OAuth consent without a reference overwriting or reusing consent for a different reference. (#11801)
• Fixed dynamic client registration rejecting requests that include both supported and unsupported grants. (#11797)
• Fixed attempts to change cached trusted clients returning HTTP 500 instead of HTTP 400. (#11781)
• Improved errors for unknown OAuth client_id values to say client not found. (#11799)
• Fixed PKCE verifier errors to return the specified HTTP 400 response and error code. (#11724)
• Fixed unknown OAuth clients receiving invalid_grant instead of invalid_client at the token endpoint. (#11176)
• Fixed unverifiable JWT access tokens causing server errors at /oauth2/userinfo, /oauth2/introspect, and /oauth2/revoke. (#11596)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Limited JWKS refetches for unknown key IDs to protect servers from repeated requests. (#11805)
• Fixed unreachable JWKS endpoints being reported as invalid tokens instead of server errors. (#11612)

For detailed changes, see CHANGELOG

@better-auth/mongo-adapter

Bug Fixes

• Fixed MongoDB findMany ignoring ID sorting and potentially repeating or skipping paginated results. (#11801)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@Bekacru, @breken-ai, @drewsephski, @gustavovalverde, @mahoor, @vhinayindia

Full changelog: v1.7.9...v1.7.10