v1.7.8 Bug Fixes and Minor Features

better-auth

Bug Fixes

• Aligned cookie security attributes with RFC 6265bis (#11540)
• Added SvelteKit 3 to the supported peer dependency range (#11488)
• Fixed stale cookies persisting after customSession sessions expire or are revoked (#10591)
• Fixed customSession treating session lookup errors as signed-out users (#11391)
• Fixed sign-in failures, replay checks, and SIWE email handling with generateId: "uuid" (#11625)
• Removed non-returned custom fields from inferred output schema types (#11565)
• Fixed Kysely migration foreign keys when custom table names match another model key (#11505)
• Reduced organization plugin server bundles by excluding unused Zod locales (#10866)
• Aligned @better-auth/utils and better-call dependency versions across official packages (#11512)
• Fixed generic OAuth providers remaining unavailable after discovery fails at startup by retrying on subsequent requests (#11750)
• Fixed lastLoginMethod sign-in failures when cookieName or maxAge is explicitly undefined (#11549)
• Fixed magic link verification changing percent-encoded characters in callback URLs (#11174)
• Fixed type errors when using oauthProvider() or mcp() with exactOptionalPropertyTypes (#10266)
• Fixed organization plugin type errors in projects with skipLibCheck: false (#11637)
• Fixed failed password resets consuming reset links or OTPs before the new password is saved (#11646)
• Fixed password resets and changes retaining the new password when database session revocation fails (#11626)
• Fixed phone number password resets to use a configured verifyOTP callback (#10698)
• Fixed secondary-storage session failures leaving sign-ups, passkey registrations, or SSO sign-ins in an inconsistent state (#11643)
• Fixed missing device sessions and failed automatic session switching after cache eviction (#11718)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed ID token sign-in failures caused by up to 30 seconds of clock difference with identity providers (#11749)
• Fixed Atlassian user info errors being mislabeled as Figma errors in logs (#11592)
• Fixed authentication requests hanging after interrupted async context initialization (#11711)
• Fixed recognition of valid AsyncLocalStorage initialized after importing Better Auth but before first use, and corrected misleading errors for invalid runtime-provided values in edge and browser fallbacks. (#11712)
• Fixed after hooks being skipped for writes retained after a failed request on adapters without transactions (#11645)
• Fixed Microsoft Entra ID sign-in and account linking with ID tokens when signing keys omit alg (#11663)
• Fixed sign-in failures, replay checks, and SIWE email handling with generateId: "uuid" (#11625)
• Aligned @better-auth/utils and better-call dependency versions across official packages (#11512)
• Fixed concurrent MongoDB writes failing with transaction conflicts by retrying transient errors (#11515)
• Added support for host-bearing custom-scheme redirect URIs for native OAuth clients (#10956)
• Fixed password resets and changes retaining the new password when database session revocation fails (#11626)
• Fixed secondary-storage session failures leaving sign-ups, passkey registrations, or SSO sign-ins in an inconsistent state (#11643)
• Fixed missing device sessions and failed automatic session switching after cache eviction (#11718)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

• Added support for pausing and resuming OAuth clients through adminUpdateOAuthClient (#11654)
• Added support for linking protected resources when registering a client with adminCreateOAuthClient (#11655)
• Added resource identifier validation for adminCreateOAuthResource and configured resources (#11655)
• Added clientId to clientPrivileges checks for actions on existing OAuth clients (#11658)

Bug Fixes

• Fixed sign-in failures, replay checks, and SIWE email handling with generateId: "uuid" (#11625)
• Aligned @better-auth/utils and better-call dependency versions across official packages (#11512)
• Added support for host-bearing custom-scheme redirect URIs for native OAuth clients (#10956)
• Fixed startup resource-seeding failures from blocking authentication routes until restart (#11726)
• Fixed type errors when using oauthProvider() or mcp() with exactOptionalPropertyTypes (#10266)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Aligned @better-auth/utils and better-call dependency versions across official packages (#11512)
• Fixed SSO provider registration and updates rejecting partial mapping values that omit defaulted fields (#11378)
• Fixed SAML providers with linked accounts rejecting IdP signing certificate rotation (#11687)
• Rejected OIDC SSO providers whose configured issuer does not match discovery, preventing later sign-in failures (#11438)
• Fixed SAML providers with linked accounts rejecting changes to their post-login callbackUrl (#11743)
• Fixed OIDC sign-in when the mapped email claim contains a list of addresses (#11640)

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

• Fixed SCIM reprovisioning of inactive users with an existing externalId (#11167)
• Aligned @better-auth/utils and better-call dependency versions across official packages (#11512)
• Fixed SCIM requests silently ignoring attribute names with different letter case (#11644)
• Fixed concurrent SCIM updates to return 409 instead of 500 when a unique value is already claimed (#11669)
• Fixed SCIM User and Group requests rejecting nullable attributes sent as JSON null (#11638)

For detailed changes, see CHANGELOG

@better-auth/mongo-adapter

Bug Fixes

• Aligned @better-auth/utils and better-call dependency versions across official packages (#11512)
• Fixed failed MongoDB transaction commits leaving transactions open and blocking other writes (#11602)
• Fixed concurrent MongoDB writes failing with transaction conflicts by retrying transient errors (#11515)
• Fixed MongoDB authentication errors masking the original transaction commit failure (#11014)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Aligned @better-auth/utils and better-call dependency versions across official packages (#11512)
• Fixed Drizzle sign-in, session refresh, and date filtering with string-based date columns (#11731)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• Aligned @better-auth/utils and better-call dependency versions across official packages (#11512)
• Fixed cross-request I/O errors from concurrent D1 queries on a shared auth instance with Kysely 0.29 (#11490)

For detailed changes, see CHANGELOG

@better-auth/mcp

Bug Fixes

• Fixed @better-auth/mcp type errors with exactOptionalPropertyTypes and skipLibCheck: false (#11635)
• Fixed type errors when using oauthProvider() or mcp() with exactOptionalPropertyTypes (#10266)

For detailed changes, see CHANGELOG

@better-auth/api-key

Bug Fixes

• Aligned @better-auth/utils and better-call dependency versions across official packages (#11512)

For detailed changes, see CHANGELOG

@better-auth/cimd

Bug Fixes

• Added support for host-bearing custom-scheme redirect URIs for native OAuth clients (#10956)

For detailed changes, see CHANGELOG

@better-auth/electron

Bug Fixes

• Aligned @better-auth/utils and better-call dependency versions across official packages (#11512)

For detailed changes, see CHANGELOG

@better-auth/memory-adapter

Bug Fixes

• Aligned @better-auth/utils and better-call dependency versions across official packages (#11512)

For detailed changes, see CHANGELOG

@better-auth/passkey

Bug Fixes

• Aligned @better-auth/utils and better-call dependency versions across official packages (#11512)

For detailed changes, see CHANGELOG

@better-auth/prisma-adapter

Bug Fixes

• Aligned @better-auth/utils and better-call dependency versions across official packages (#11512)

For detailed changes, see CHANGELOG

@better-auth/stripe

Bug Fixes

• Stopped reporting completed one-time Stripe checkouts as webhook failures (#9684)

For detailed changes, see CHANGELOG

@better-auth/telemetry

Bug Fixes

• Aligned @better-auth/utils and better-call dependency versions across official packages (#11512)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@aryan1306, @Bekacru, @BilalAtique, @breken-ai, @bytaesu, @codewithbharat, @disbell, @drewsephski, @gustavovalverde, @heliohm, @jashkarangiya, @jonathansamines, @kaiizer777, @kdelay, @maxnze1, @nikhilgupta58, @Sandipxg, @shiminshen, @Tushar-Khandelwal-2004

Full changelog: v1.7.7...v1.7.8