Update Routine updates

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@better-auth/core (source)	1.6.15 → 1.6.25			devDependencies	patch
@better-auth/test-utils (source)	1.6.15 → 1.6.25			devDependencies	patch
@better-fetch/fetch (source)	1.1.21 → 1.3.1			dependencies	minor
@eslint/eslintrc	3.3.5 → 3.3.6			devDependencies	patch
@eslint/js (source)	9.39.4 → 9.39.5			devDependencies	patch
@playwright/test (source)	1.60.0 → 1.62.0			dependencies	minor	1.62.1
@tailwindcss/postcss (source)	4.3.0 → 4.3.3			devDependencies	patch
@tanstack/react-start (source)	1.167.65 → 1.168.32			devDependencies	minor	1.168.34 (+1)
@types/mdx (source)	2.0.13 → 2.0.14			devDependencies	patch
@types/node (source)	24.12.3 → 24.13.3			devDependencies	minor
@types/react (source)	19.2.14 → 19.2.17			devDependencies	patch	19.2.18
actions/setup-node (changelog)	48b55a0 → 2499707			action	digest
adm-zip	^0.5.16 → ^0.6.0			dependencies	minor
better-auth (source)	1.6.15 → 1.6.25			devDependencies	patch
concurrently	10.0.3 → 10.0.4			devDependencies	patch
convex (source)	1.41.0 → 1.42.3			devDependencies	minor	1.43.0
convex-helpers (source)	0.1.116 → 0.1.120			dependencies	patch
convex-test (source)	0.0.51 → 0.0.54			devDependencies	patch
eslint (source)	9.39.4 → 9.39.5			devDependencies	patch
eslint (source)	10.3.0 → 10.8.0			devDependencies	minor
eslint-config-next (source)	16.2.6 → 16.2.12			devDependencies	patch
eslint-plugin-react-refresh	0.5.2 → 0.5.3			devDependencies	patch
fumadocs-core	16.8.8 → 16.13.0			dependencies	minor	16.14.0
fumadocs-ui	16.8.8 → 16.13.0			dependencies	minor	16.14.0
globals	17.6.0 → 17.8.0			devDependencies	minor
jose	6.2.3 → 6.2.4			dependencies	patch	6.2.6 (+1)
next (source)	16.2.6 → 16.2.12			devDependencies	patch
next (source)	16.2.6 → 16.2.12			dependencies	patch
pkg-pr-new (source)	0.0.71 → 0.0.82			devDependencies	patch	0.0.86 (+2)
postcss (source)	8.5.14 → 8.5.24			devDependencies	patch	8.5.25
prettier (source)	3.8.3 → 3.9.6			devDependencies	minor
raven-actions/actionlint	v2.1.2 → v2.2.0			action	minor
react (source)	19.2.6 → 19.2.8			devDependencies	patch
react (source)	19.2.6 → 19.2.8			dependencies	patch
react-dom (source)	19.2.6 → 19.2.8			devDependencies	patch
react-dom (source)	19.2.6 → 19.2.8			dependencies	patch
remeda (source)	2.34.0 → 2.39.0			dependencies	minor
semver	7.8.0 → 7.8.5			dependencies	patch
tailwindcss (source)	4.3.0 → 4.3.3			devDependencies	patch
type-fest	5.6.0 → 5.8.0			dependencies	minor
typescript-eslint (source)	8.59.2 → 8.65.0			devDependencies	minor
vitest (source)	4.1.5 → 4.1.10			devDependencies	patch
zizmorcore/zizmor-action	v0.5.6 → v0.6.0			action	minor	v0.6.1

---

Release Notes

better-auth/better-auth (@​better-auth/core)

v1.6.25

Compare Source

Patch Changes

• #​10294 0ffd1fb Thanks @​jsj! - Send Apple OAuth PKCE code challenges during authorization so callback token exchanges include a matching code verifier.

v1.6.24

Compare Source

Patch Changes

• #​9862 54fab08 Thanks @​OrangeManLi! - Fix a request-state AsyncLocalStorage initialization race that could intermittently throw No request state found. Please make sure you are calling this function within a runWithRequestState callback. ensureAsyncStorage() now memoizes its in-flight initialization so concurrent first-callers share a single AsyncLocalStorage instance instead of each constructing one and the last write winning. This surfaced on serverless cold start (e.g. Cloudflare Workers) where the first requests arrive before the lazy node:async_hooks import settles, causing runWithRequestState().run() and a nested getCurrentRequestState() to land on different instances.

• #​10376 c4d1dda Thanks @​ping-maxwell! - Pass the request endpoint context as a third argument to verifyIdToken, so custom ID token verifiers can read request headers (for example Apple's user-agent requirement).

v1.6.23

Compare Source

v1.6.22

Compare Source

Patch Changes

• #​10241 8bd43d9 Thanks @​gustavovalverde! - Refuse HTTP redirects on server-side OAuth requests

  Better Auth refuses HTTP redirects on the server-side OAuth requests it makes: the token exchange, token refresh, client-credentials, token introspection, and JWKS requests. A provider endpoint cannot redirect one of these requests to an unintended internal address. Conformant OAuth providers answer these endpoints with a direct response and never redirect, so standard integrations are unaffected.

v1.6.21

Compare Source

Patch Changes

• #​10180 90d509e Thanks @​ping-maxwell! - adapter.update now returns null when no row matches or when it is called without a predicate. Use updateMany for intentional bulk updates.

  The Kysely MySQL adapter no longer returns a row after a guarded update misses. Updates with an id guard also return the targeted row when id is not the first predicate. Keep MySQL rows-matched semantics enabled, which mysql2 does by default through FOUND_ROWS; disabling it can make idempotent updates look like misses.

  The Prisma adapter now returns null when an update guard excludes the targeted row instead of surfacing Prisma's not-found exception. The shared adapter test suite now asserts the same fail-closed update behavior for adapter implementations.

• #​10197 816d7f9 Thanks @​Paola3stefania! - Google sign-in now accepts hd: "*" to allow any Google Workspace hosted domain while still rejecting tokens with no hosted-domain claim.

  Google One Tap now applies the configured Google hosted-domain restriction before creating a session.

• #​10198 570267c Thanks @​rachit367! - Honor disableMigration on plugin schema tables. Tables flagged with disableMigration: true are now skipped by better-auth generate (Drizzle and Prisma output) and by the runtime migrator, instead of being emitted and created anyway. The flag was previously dropped while assembling the table list, so it had no effect.

• #​10203 5953157 Thanks @​bytaesu! - Rate limiting no longer trusts multi-hop X-Forwarded-For chains, preventing a client behind an appending proxy from spoofing the leftmost hop to bypass the per-IP rate limit. Single-value IP headers continue to work. To key the real client behind a proxy chain, set advanced.ipAddress.trustedProxies to your reverse-proxy IPs or CIDR ranges (the chain is walked right to left, skipping trusted hops), or point advanced.ipAddress.ipAddressHeaders at a single trusted client-IP header.

v1.6.20

Compare Source

v1.6.19

Compare Source

Patch Changes

• #​10086 5bd5e1c Thanks @​gustavovalverde! - Refresh-token rotation and token revocation, two-factor backup-code regeneration, device-code claiming, and organization invitation acceptance now work on Prisma. Concurrent or repeat requests in these flows could previously return an error on Prisma instead of the expected result.

  On MongoDB servers older than 5.0, these flows and other guarded value updates (rate-limit window resets, API-key refills) no longer fail with an empty-update error.

  @better-auth/core: incrementOne now reports a clear error when called with no increment and no set.

• #​10070 a787e0b Thanks @​gustavovalverde! - Single-use verification flows no longer hang on database adapters that use a one-connection pool. This fixes magic-link verification and similar token checks in connection-limited serverless database setups.

v1.6.18

Compare Source

Patch Changes

• #​9583 b21a5f7 Thanks @​GautamBytes! - Fix plugin-provided client methods and additional session fields not being inferred in composite monorepos.

v1.6.17

Compare Source

Patch Changes

• #​9993 baeaa00 Thanks @​gustavovalverde! - Add the optional incrementOne adapter method and the optional SecondaryStorage.increment method. incrementOne atomically applies signed numeric deltas to a single row under a where-clause guard (for example, decrementing a remaining-uses counter only while it is still positive) and returns the updated row, or null when the guard matched no row. Adapters that do not implement it natively keep working through a transaction-based fallback. SecondaryStorage.increment atomically increments a counter and sets its time-to-live only when the key is first created.

• #​9987 7343284 Thanks @​bytaesu! - Fixed a memory leak where the JWKS cache could grow on every access token verification.

• #​10003 fdef997 Thanks @​gustavovalverde! - Microsoft Entra ID sign-in now honors the configured tenant restriction. tenantId: "organizations" rejects personal Microsoft accounts, and tenantId: "consumers" rejects work and school accounts. Both were accepted before.

• #​9993 baeaa00 Thanks @​gustavovalverde! - Concurrent requests can no longer slip past the configured rate limit. The in-memory rate-limit store no longer grows without bound, and the database backend removes expired entries on its own. A custom rate-limit storage may implement a new optional consume method for strict enforcement; without it, the previous behavior is kept and a one-time warning is logged.

• #​10003 fdef997 Thanks @​gustavovalverde! - A Reddit user with no email now receives a non-routable placeholder address (<id>@&#8203;reddit.invalid) instead of one on the real reddit.com domain, so it cannot match a deliverable mailbox. The address stays unverified, and mapProfileToUser can supply a real email.

• #​9993 baeaa00 Thanks @​gustavovalverde! - Add internalAdapter.reserveVerificationValue. It atomically records a single-use marker (such as a replay tombstone) so that exactly one of several concurrent callers succeeds and the rest observe that the marker is already taken. Database-backed verification storage is atomic; secondary-storage-only verification is best-effort.

• #​9990 1dbf5bb Thanks @​gustavovalverde! - Hardens how requests are trusted across several flows. Rate limiting is now enforced even when a client IP cannot be determined, instead of being skipped. When baseURL is not configured, password-reset and verification links use the current request's host rather than the host of the first request the server handled, and a request-scoped trustedOrigins callback no longer affects other concurrent requests. The OAuth proxy, Google One Tap, and the Expo authorization proxy reject redirect and callback targets that are not in trustedOrigins. Google reCAPTCHA and Cloudflare Turnstile accept optional expectedAction and allowedHostnames to reject tokens minted for a different action or hostname. Server-side fetches reject additional reserved IPv6 ranges, and malformed redirect parameters return a 400 instead of a 500.

• #​10003 fdef997 Thanks @​gustavovalverde! - WeChat sign-in now succeeds with the documented default setup, which previously failed because WeChat returns no email address. The created user receives a stable, unverified placeholder email; supply a real one with mapProfileToUser.

v1.6.16

Compare Source

Patch Changes

• #​9974 cb1cbfa Thanks @​Bekacru! - Validate Facebook opaque access tokens against the configured app. Previously verifyIdToken returned true for any non-JWT token and getUserInfo called Graph /me with the caller-supplied token without checking which app issued it, so tokens issued for other Facebook apps were not distinguished on the direct sign-in path. Facebook tokens are now inspected via the debug_token endpoint, requiring is_valid, an app_id that matches one of the configured client ids, and a user_id that matches the returned profile, before the token is accepted. A client secret must be configured for access-token sign-in to work.

• #​9974 cb1cbfa Thanks @​Bekacru! - Enforce the Google hd (hosted domain) option against the id token. Previously hd was only sent to Google as an authorization hint, which does not by itself restrict sign-in to the configured Workspace domain. When hd is set, the hd claim on the verified id token (verifyIdToken) and the decoded callback profile (getUserInfo) must be present and match, otherwise sign-in is rejected.

• #​9974 cb1cbfa Thanks @​Bekacru! - Scope the JWKS cache per source. Access-token verification previously kept a single global key set and reused it whenever it contained a key matching the token's kid, without considering which JWKS source the verification was for. When verifying tokens against more than one source, a token could end up matched against keys fetched for a different source if the two shared a kid. The cache is now keyed per JWKS source and honors a TTL, so each verification uses the keys for its own source and rotated or removed keys are no longer used after the TTL elapses.

• #​9974 cb1cbfa Thanks @​Bekacru! - Cryptographically verify PayPal ID tokens on direct sign-in. Previously verifyIdToken only decoded the JWT and checked that a sub claim was present, performing no signature, issuer, audience, or expiration checks, so any well-formed token paired with a valid access token would be accepted. The token is now verified against PayPal's issuer and published JWKS (RS256) or the client secret (HS256), with the aud pinned to the configured clientId, a maxTokenAge bound, and the nonce checked when supplied.

• #​9974 cb1cbfa Thanks @​Bekacru! - Stop mapping the Reddit oauth_client_id to the user's email. Reddit's identity scope does not return an email address, and the provider previously stored oauth_client_id (which identifies the OAuth application and is the same for every user of the app) as user.email with has_verified_email as emailVerified. This collapsed all Reddit users of the same app onto a single "verified" email, which could enable implicit account linking/takeover. The Reddit provider now uses the email returned from mapProfileToUser when provided, otherwise falls back to a unique per-user synthetic address (<reddit-user-id>@&#8203;reddit.com), and no longer marks it as verified. Provide a real email via mapProfileToUser if you need the actual address.

• #​9974 cb1cbfa Thanks @​Bekacru! - Fix verifyAccessToken silently dropping the configured audience check during remote introspection. Previously, when a required audience was set in verifyOptions but the introspection response omitted the aud claim, audience validation was skipped and any active token from the issuer was accepted — so a token issued for a different resource or client on the same issuer could also pass verification. Verification now requires the claim: a missing or mismatching aud is rejected. Authorization servers that legitimately omit aud from introspection responses (it is OPTIONAL per RFC 7662) can opt back into the old behavior with the new remoteVerify.allowMissingAudience: true flag, which still rejects mismatching audiences.

better-auth/better-auth (@​better-auth/test-utils)

v1.6.25

Compare Source

Patch Changes

• Updated dependencies [5124c34, 0ffd1fb, 7439359]:
  • better-auth@​1.6.25
  • @​better-auth/core@​1.6.25

v1.6.24

Compare Source

Patch Changes

• Updated dependencies [03dc5a0, 7508940, bae7198, ef4d273, 6758231, 99dbdd7, 086ca91, 8f2dedd, 4e685ee, 3bf0e49, f59a0ee, 54fab08, 0f2cc1b, ae78109, 46d2bf0, 29a373e, f6d18fa, f23ce50, c4d1dda]:
  • better-auth@​1.6.24
  • @​better-auth/core@​1.6.24

v1.6.23

Compare Source

Patch Changes

• Updated dependencies [8581f97]:
  • better-auth@​1.6.23
  • @​better-auth/core@​1.6.23

v1.6.22

Compare Source

Patch Changes

• Updated dependencies [c06a56d, 8bd43d9, 3a035e9]:
  • better-auth@​1.6.22
  • @​better-auth/core@​1.6.22

v1.6.21

Compare Source

Patch Changes

• #​10180 90d509e Thanks @​ping-maxwell! - adapter.update now returns null when no row matches or when it is called without a predicate. Use updateMany for intentional bulk updates.

  The Kysely MySQL adapter no longer returns a row after a guarded update misses. Updates with an id guard also return the targeted row when id is not the first predicate. Keep MySQL rows-matched semantics enabled, which mysql2 does by default through FOUND_ROWS; disabling it can make idempotent updates look like misses.

  The Prisma adapter now returns null when an update guard excludes the targeted row instead of surfacing Prisma's not-found exception. The shared adapter test suite now asserts the same fail-closed update behavior for adapter implementations.

• Updated dependencies [e0762a1, 882cf9e, f52e1ab, 90d509e, b5bec19, 816d7f9, 239bcc8, 1bc370a, 570267c, 461ca6f, 88409b0, 5953157, b046f9e, ae647b4]:

  • better-auth@​1.6.21
  • @​better-auth/core@​1.6.21

v1.6.20

Compare Source

Patch Changes

• Updated dependencies [21448b1, 8ecf238, 930f534]:
  • better-auth@​1.6.20
  • @​better-auth/core@​1.6.20

v1.6.19

Compare Source

Patch Changes

• #​10081 0895993 Thanks @​gustavovalverde! - Password reset tokens now work with the Drizzle MySQL adapter after they are consumed during reset.

  Adapter auth-flow tests now cover password reset and replay rejection, and wrapped adapters exercise their native single-use consume and guarded increment behavior when available.

• Updated dependencies [de4aa52, b4b0266, 5bd5e1c, 581f827, 8407885, c1a8a64, 635f190, a787e0b, c2f718f, 7d18175]:

  • better-auth@​1.6.19
  • @​better-auth/core@​1.6.19

v1.6.18

Compare Source

Patch Changes

• Updated dependencies [9ef7240, b21a5f7]:
  • better-auth@​1.6.18
  • @​better-auth/core@​1.6.18

v1.6.17

Compare Source

Patch Changes

• Updated dependencies [baeaa00, 3e99e6c, 96c78c3, baeaa00, baeaa00, 0c3856f, baeaa00, baeaa00, ed7b6c9, e0a768c, 7343284, 0c3856f, baeaa00, baeaa00, 7343284, 7343284, 0c3856f, fdef997, 0c3856f, d9c526b, 0c3856f, fdef997, baeaa00, baeaa00, baeaa00, baeaa00, fdef997, 7343284, baeaa00, 8960f5f, baeaa00, 5c289b5, 1dbf5bb, baeaa00, baeaa00, 59e0ccb, b803c61, fdef997]:
  • better-auth@​1.6.17
  • @​better-auth/core@​1.6.17

v1.6.16

Compare Source

Patch Changes

• Updated dependencies [cb1cbfa, cb1cbfa, cb1cbfa, cb1cbfa, cb1cbfa, cb1cbfa, 87e7aa5, cb1cbfa, cb1cbfa, cb1cbfa, 893cf6c, cb1cbfa, cb1cbfa, 5e49c56, cb1cbfa]:
  • better-auth@​1.6.16
  • @​better-auth/core@​1.6.16

better-auth/better-fetch (@​better-fetch/fetch)

v1.3.1

Compare Source

   🐞 Bug Fixes

• fetch:
  • Normalize repeated leading slashes in request paths  -  by @​bytaesu in #​109 (40e69)
  • Encode dynamic path params  -  by @​bytaesu in #​110 (87fc5)

    [View changes on GitHub](https://redirect.github.com/better-auth/better-fetch/compare/v1.3.0...

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • Monday through Friday (* * * * 1-5)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
better-auth	Ready	Preview	Jul 31, 2026 5:53pm

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@convex-dev/better-auth@376

commit: 5fab04d