[dependabot]

Bumps better-auth from 1.7.7 to 1.7.10.

Release notes

Sourced from better-auth's releases.

v1.7.10

better-auth

Bug Fixes

• Fixed Captcha and OpenAPI plugin subpath imports and type resolution for better-auth/plugins/multi-session and better-auth/test. (#11822)
• Fixed Google One Tap sign-ins not recording google as the last login method. (#11393)
• Fixed imports from better-auth/plugins/one-tap failing with a not-exported error. (#11696)
• Fixed Google One Tap ignoring plugin-level autoSelect and cancelOnTapOutside settings. (#11820)
• Fixed Google One Tap sign-ins ignoring configured Google profile mapping and user info updates. (#11819)
• Fixed Google One Tap calling a prompt method unsupported by FedCM and retrying skipped prompts. (#11821)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

• Added optional self-service signing key rotation for private_key_jwt clients. (#11695)

Bug Fixes

• Fixed valid DPoP proofs being rejected for parameterized routes and URLs with trailing slashes. (#11786)
• Fixed native clients with HTTP loopback callbacks being rejected when application type inference is enabled. (#11798)
• Fixed device-code clients being unable to refresh access for approved resources omitted from a token poll. (#11815)
• Fixed OAuth consent without a reference overwriting or reusing consent for a different reference. (#11801)
• Fixed dynamic client registration rejecting requests that include both supported and unsupported grants. (#11797)
• Fixed attempts to change cached trusted clients returning HTTP 500 instead of HTTP 400. (#11781)
• Improved errors for unknown OAuth client_id values to say client not found. (#11799)
• Fixed PKCE verifier errors to return the specified HTTP 400 response and error code. (#11724)
• Fixed unknown OAuth clients receiving invalid_grant instead of invalid_client at the token endpoint. (#11176)
• Fixed unverifiable JWT access tokens causing server errors at /oauth2/userinfo, /oauth2/introspect, and /oauth2/revoke. (#11596)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Limited JWKS refetches for unknown key IDs to protect servers from repeated requests. (#11805)
• Fixed unreachable JWKS endpoints being reported as invalid tokens instead of server errors. (#11612)

For detailed changes, see CHANGELOG

@better-auth/mongo-adapter

Bug Fixes

• Fixed MongoDB findMany ignoring ID sorting and potentially repeating or skipping paginated results. (#11801)

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.10

Patch Changes

• #11393 eebd47a Thanks @​breken-ai! - If you use the lastLoginMethod plugin with oneTap, signing in through Google One Tap now records "google", the same value as signing in with the Google button. Before, a One Tap sign-in recorded nothing: the better-auth.last_used_login_method cookie kept its previous value or stayed unset, and so did user.lastLoginMethod with storeInDatabase.

  If your customResolveMethod includes a /one-tap/callback → "google" workaround, remove that mapping; keep the resolver if it handles other routes.

• #11821 09d07e6 Thanks @​gustavovalverde! - The Google One Tap prompt (authClient.oneTap() without button) no longer calls getSkippedReason(), which Google's FedCM migration guide says to remove. Before, it called it under any promptOptions.fedCM setting.

  A skipped prompt now ends the flow and calls onPromptNotification right away instead of retrying. Google doesn't report why a prompt was skipped, and a prompt the user closed stays hidden for Google's cooldown period, so the retries could not bring it back. Dismissed prompts still retry as before.

  Google Identity Services still logs its FedCM migration warning, because it does so whenever prompt() receives a listener. The plugin needs the listener to track dismissals and skips, so the warning is expected and safe to ignore.

• #11819 eaecb72 Thanks @​gustavovalverde! - Google One Tap now applies your socialProviders.google.mapProfileToUser and custom getUserInfo, the same as the standard Google sign-in. Before, One Tap ignored both and always stored the token's name, email, email_verified, and picture claims.

  If you configured either one, users created through One Tap now get the fields it returns, including any extra fields such as a first name from given_name. Returning users are updated from it on each One Tap sign-in when socialProviders.google.overrideUserInfoOnSignIn is on, and so are existing users that One Tap links when account.accountLinking.updateUserInfoOnLink is on. Check that your mapper suits One Tap users too.

  If you set socialProviders.google.overrideUserInfoOnSignIn, One Tap sign-ins now update returning users' name, image, and email from Google, as the redirect sign-in already does.

  Setups that configure none of these, including oneTap({ clientId }) with no Google provider, are unaffected.

• #11820 88c9a37 Thanks @​gustavovalverde! - If you set autoSelect or cancelOnTapOutside on oneTapClient(), the One Tap prompt and the Sign in with Google button now use them. Before, only values passed to authClient.oneTap() took effect, so with autoSelect: true on the plugin, returning users still had to pick an account. Values passed to oneTap() still override the plugin's. Apps that set these options only on oneTap(), or not at all, are unaffected.

• #11696 0cf1f7c Thanks @​drewsephski! - You can now import the One Tap plugin from better-auth/plugins/one-tap, as you can for other plugins. Previously this import failed with a "not exported" error. Imports from better-auth/plugins and better-auth/client/plugins are unchanged.

• #11822 414e845 Thanks @​gustavovalverde! - You can now import the Captcha and OpenAPI plugins from better-auth/plugins/captcha and better-auth/plugins/open-api, as you can for other plugins. Previously these imports failed with a "not exported" error. Imports from better-auth/plugins are unchanged.

  If your TypeScript config uses "moduleResolution": "node" (or node10), better-auth/plugins/multi-session and better-auth/test now resolve their types. Previously TypeScript reported that it could not find their declarations. Projects using bundler, node16, or nodenext resolution are unaffected.

• Updated dependencies [fedd055, bbd0a19, 99cdfe7]:

  • @​better-auth/core@​1.7.10
  • @​better-auth/mongo-adapter@​1.7.10
  • @​better-auth/drizzle-adapter@​1.7.10
  • @​better-auth/kysely-adapter@​1.7.10
  • @​better-auth/memory-adapter@​1.7.10
  • @​better-auth/prisma-adapter@​1.7.10
  • @​better-auth/telemetry@​1.7.10

1.7.9

Patch Changes

• #11766 6edaa61 Thanks @​bytaesu! - An onAPIError.onError handler that throws or rejects no longer fails the request or causes an unhandled promise rejection. The error is logged and the original error response is returned. Async handlers now finish before the response is sent.

• Updated dependencies []:

  • @​better-auth/core@​1.7.9
  • @​better-auth/drizzle-adapter@​1.7.9
  • @​better-auth/kysely-adapter@​1.7.9
  • @​better-auth/memory-adapter@​1.7.9

... (truncated)

Commits

• b734a41 chore: release v1.7.10 (#11795)
• eebd47a fix(last-login-method): record Google One Tap sign-ins (#11393)
• eaecb72 fix(one-tap): apply the Google provider's mapProfileToUser and getUserInfo (#...
• 414e845 fix(better-auth): keep package subpaths in sync with build entries (#11822)
• 88c9a37 fix(one-tap): apply plugin-level autoSelect and cancelOnTapOutside (#11820)
• 09d07e6 fix(one-tap): stop calling prompt moment methods unsupported under FedCM (#11...
• 0cf1f7c fix(one-tap): add the better-auth/plugins/one-tap subpath export (#11696)
• d2a5f83 chore: release v1.7.9 (#11761)
• dbca311 test: fix test names in bearer and organization (#11768)
• c03ced5 chore: bump @biomejs/biome (#11760)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	better-auth@​1.7.7 ⏵ 1.7.10	+1		+1	+1

View full report