chore(deps): update dependency better-auth to v1.4.7

[renovate]

Note: This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
better-auth (source)	1.4.0-beta.9 -> 1.4.7

---

Release Notes

better-auth/better-auth (better-auth)

v1.4.7

Compare Source

   🚀 Features

• admin:
  • Add support role with permissions for user updates and enforce role change validation  -  by @​Bekacru and Copilot in #​6699 (6c68e)
• one-time-token:
  • Support setting session cookie on ott verify  -  by @​Bekacru in #​3659 (7a4e8)
• phone-number:
  • Add password length validation for reset functionality  -  by @​Bekacru in #​6674 (700f4)
• saml:
  • Assertion timestamp validation with per-provider clock skew  -  by @​Paola3stefania in #​6706 (f9875)
• sso:
  • Add InResponseTo validation  -  by @​Paola3stefania in #​6557 (5a49f)
  • Add OIDC discovery  -  by @​Paola3stefania and @​Bekacru in #​6395 (b9d4b)
  • Add URL normalization and validation to all discovery URLs  -  by @​jonathansamines, Paola Estefanía de Campos, @​Paola3stefania and @​Bekacru in #​6503 (50248)

   🐞 Bug Fixes

• Prevent stateless refresh with database configured  -  by @​Bekacru in #​6700 (9fed2)
• api-key: Check metadata is enabled for api key update endpoint  -  by @​Bekacru in #​6632 (87441)
• line: Enforce nonce  -  by @​Bekacru in #​6631 (66699)
• saml: Remove signature validation bypass  -  by @​Paola3stefania in #​6682 (9c1a3)

   🏎 Performance

• Add index on organizations slug field  -  by @​matteobad and matteobadini in #​6303 (c3fe9)

    View changes on GitHub

v1.4.6

Compare Source

   🚀 Features

• Add ctx.isTrustedDomain helper  -  by @​jonathansamines in #​6462 (197e8)
• Drizzle pg supports JSON  -  by @​dvanmali in #​6518 (59b61)
• Add Refresh Token Support to Kick OAuth Provider  -  by @​CesarRodrigu in #​6263 (e9543)
• admin: Prevent impersonating admins by default [breaking]  -  by @​jslno and @​Bekacru in #​6454 (9d452)
• expo: Last-login-method client plugin  -  by @​jslno and @​himself65 in #​6413 (b7d32)
• multi-session: Allow to infer additional fields  -  by @​jslno in #​6585 (812a6)
• organization: Allow invited users to see organization name  -  by @​GautamBytes and Copilot in #​6602 (cda99)
• sso: Use domain verified flag to trust providers automatically  -  by @​Paola3stefania (312fc)

   🐞 Bug Fixes

• Avoid throwing on client side  -  by @​landoncolburn and @​Bekacru in #​6361 (bd987)
• Export organization plugin types  -  by @​pffigueiredo in #​6490 (630c5)
• Prematurely deleting active sessions in secondary storage  -  by @​DevDuki in #​3885 (7d0a6)
• Pathname should be normalized when basePath is set to root  -  by @​Bekacru (126e4)
• Make sure non-chunked session data cookie is cleared  -  by @​Bekacru (aa2fb)
• Array field handling across adapters and schema generation  -  by @​ping-maxwell and @​Bekacru in #​6601 (6494d)
• StoreStateStrategy default to database if provided  -  by @​himself65 in #​6619 (49c6b)
• Should always remove 2FA verification token after successful verification  -  by @​delfortrie in #​6604 (c47b5)
• adapter:
  • Add logger creation in adapter factory  -  by @​ping-maxwell in #​6597 (99b4f)
  • Allow run internal adapter outside context  -  by @​himself65 in #​6617 (adb75)
• admin:
  • Clear admin session cookie on stopImpersonating  -  by @​jslno in #​6568 (8e6c6)
• cli:
  • secret generates empty  -  by @​himself65 in #​6504 (0ca6d)
  • Deduplicate drizzle schema relationships  -  by @​ping-maxwell in #​6547 (a501b)
• core:
  • Allow returning null in getUserInfo in provider options  -  by @​Zollerboy1 in #​6528 (d4957)
• db:
  • Correctly unwrap validator result in schema parsing  -  by @​GautamBytes in #​6488 (89030)
• deps:
  • Update dependency next to v16.0.7 [security]  -  in #​6501 (aeb0b)
  • Update dependency @​react-email/components to v1  -  in #​6600 (c4d27)
• kysely:
  • Wrong affected row count in updateMany & deleteMany  -  by @​jslno in #​6572 (df8be)
• magic-link:
  • Handle query params in errorCallbackUrl  -  by @​martinriviere in #​6383 (69b88)
• oidc:
  • Compatibility with exact-optional-property  -  by @​ping-maxwell in #​6502 (51e46)
• openapi:
  • Mark /get-session response as nullable  -  by @​GautamBytes in #​6540 (be00f)
• prisma:
  • Use findFirst instead of findMany for findOne  -  by @​Bekacru in #​6429 (d814c)
• saml:
  • Enforce trusted provider check  -  by @​Paola3stefania in #​6551 (816f1)
• sso:
  • Safely parse provider configs on registration  -  by @​Paola3stefania and @​Bekacru in #​6550 (cfafc)
• username:
  • Await username validator  -  by @​jslno in #​6611 (b4320)

    View changes on GitHub

v1.4.5

Compare Source

v1.4.4

Compare Source

   🚀 Features

• cli: Better-auth-command  -  by @​Ridhim-RR in #​6362 (5e06f)
• scim: Add support to parse custom scim+json media type  -  by @​jonathansamines in #​6365 (6e9ec)

   🐞 Bug Fixes

• Customizing fields should be optional for rate limit options  -  by @​ceolinwill in #​6398 (115c9)
• Chunk account data cookie when exceeding limit  -  by @​jslno in #​6393 (c9eca)
• Remove applying user-agent by default  -  by @​Bekacru in #​6417 (34d7d)
• Additional fields default values should apply when creating session  -  by @​Bekacru in #​5763 (d5713)
• Return null early if userid isn't defined  -  by @​Bekacru in #​6418 (e4508)
• logger: Log level priority  -  by @​danielfinke in #​6411 (4c25b)
• mcp: Return origin url as authorization server  -  by @​jslno in #​6397 (594bb)
• multi-session: Endpoints breaks with invalid signatures  -  by @​ping-maxwell in #​6342 (9433e)
• oidc-provider: Resolve getSignedCookie return type  -  by @​bytaesu in #​6346 (425dd)

    View changes on GitHub

v1.4.3

Compare Source

   🚀 Features

• Add Vercel as OAuth provider  -  by @​anatrajkovska in #​6316 (6fd02)
• Add support for trusted proxy headers in base URL inference  -  by @​Bekacru and Copilot in #​6285 (c4c0b)

   🐞 Bug Fixes

• Support @​tanstack/solid-start in tanstackStartCookies plugin "  -  by @​Bekacru in #​6235 (781d7)
• open-api: Clean up incorrect null type in OpenAPI  -  by @​bytaesu in #​6293 (f9cba)
• two-factor: Remove incorrect blocking logic in OTP setup and verification  -  by @​isaacriehm in #​6322 (e75d2)

    View changes on GitHub

v1.4.2

Compare Source

   🚀 Features

• cli: Check /auth for auth.ts  -  by @​ping-maxwell in #​6273 (53a74)
• github: Add PKCE support for Github  -  by @​Shridhad in #​6276 (deb62)
• jwt: Allow custom jwks endpoint  -  by @​luist18 in #​6269 (1c45f)

   🐞 Bug Fixes

• Support @​tanstack/solid-start in tanstackStartCookies plugin  -  by @​jakst in #​6235 (c69b3)
• SignIn/signUp API returns user additional field  -  by @​himself65 in #​6287 (5ea36)
• cli:
  • Kysely migration fails due to chaining addIndex and addColumn on the same alterTable builder  -  by @​ping-maxwell in #​6214 (b8a73)
  • Prevent duplicate index creation in Prisma schema generation  -  by @​rovertrack in #​6234 (0bbd8)
• client:
  • Get-session gets triggered twice on foucs  -  by @​Bekacru in #​6186 (54852)
• email-otp:
  • Sign-in email-otp bugs with capitalized emails  -  by @​ping-maxwell in #​6237 (fd010)
• oidc-provider:
  • Session shouldn't be required  -  by @​Bekacru in #​6282 (201a7)
• organization:
  • Have deleteOrganization use adapter.deleteMany instead of delete  -  by @​kefimoto in #​6226 (32d3f)

    View changes on GitHub

v1.4.1

Compare Source

   🚀 Features

• api-key: Support secondary storage  -  by @​ping-maxwell and @​Bekacru in #​6014 (44308)

   🐞 Bug Fixes

• Custom fn field default values should be properly evaluted  -  by @​Bekacru and Copilot in #​6212 (590a2)
• jwt: Retrieve latest keys from storage properly  -  by @​Bekacru in #​6208 (6aca4)
• passkey: Change generate-authenticate-options from POST to GET  -  by @​mburumaxwell in #​6199 (f922c)

    View changes on GitHub

v1.4.0

Compare Source

   🚀 Features

• Bypass transaction with async local storage  -  by @​himself65 in #​4711 (52af6)
• Add returnHeaders to getSession  -  by @​frectonz in #​3983 (19d4b)
• Waku integration guide  -  by @​rmarscher in #​3990 (3e75a)
• Add support for custom callback for authorization url  -  by @​Bekacru in #​4919 (78506)
• Additional fields on account  -  by @​dvanmali in #​4935 (bf0ac)
• Add support for custom callback for token url  -  by @​acusti in #​5027 (6bb94)
• Enum support for drizzle schema  -  by @​himself65 in #​5287 (fd780)
• Nextjs 16 guide  -  by @​Kinfe123 and @​himself65 in #​5296 (8db97)
• Add storeStateStrategy  -  by @​himself65 and Copilot in #​5470 (b5f3b)
• Enhance PostgreSQL support for non-public schema by respecting search_path configuration  -  by @​okisdev in #​5449 (bef33)
• Add polar oauth provider  -  by @​ephraimduncan in #​5506 (4b075)
• Session store chunking  -  by @​himself65 and Copilot in #​5645 (0aa6d)
• Stateless session management  -  by @​Bekacru, Copilot, @​ping-maxwell and @​himself65 in #​5601 (afce9)
• Esm only  -  by @​himself65 in #​5703 (b6977)
• Implement automatic server-side IP detection  -  by @​GautamBytes in #​5695 (06e8c)
• Async import in getAdapter  -  by @​himself65 in #​5722 (10249)
• Improved API error page  -  by @​ping-maxwell and @​Bekacru in #​5272 (f9964)
• Add request state  -  by @​himself65 in #​5742 (cea5b)
• Add support for uuids  -  by @​Bekacru in #​5809 (4ac34)
• Auto-index CLI  -  by @​ping-maxwell and @​Bekacru in #​5357 (af6eb)
• Expose additional http methods  -  by @​jonathansamines and @​Bekacru in #​5754 (956e2)
• better-auth/minimal  -  by @​bytaesu and @​Bekacru in #​5704 (1ebc6)
• Add support for custom response status codes  -  by @​jonathansamines and @​Bekacru in #​5806 (fa595)
• Support pass raw function as middleware  -  by @​himself65 in #​5888 (48a20)
• Support pass raw function as middleware "  -  by @​himself65 in #​5888 (a391a)
• Adapter join support  -  by @​ping-maxwell in #​5730 (f5bbb)
• Refactor fetch plugins config disableDefaultFetchPlugins to include userAgentPlugin  -  by @​kaandok and @​himself65 in #​6020 (8e754)
• Utilize database joins across better-auth  -  by @​ping-maxwell in #​6004 (e9f5b)
• Support storing account data in a cookie  -  by @​Bekacru in #​6013 (06606)
• Adding support for SCIM provisioning  -  by @​jonathansamines in #​5685 (ffa29)
• Add support for organization slug on list members  -  by @​Bekacru in #​5862 (31a81)
• anonymous:
  • Support phone number verification for account linking  -  by @​Bekacru in #​5294 (07654)
  • Allow customizing random email generator  -  by @​bytaesu in #​5922 (5d168)
• captcha:
  • Add support for CaptchaFox  -  by @​tgrassl in #​4944 (e03e5)
• cli:
  • Add mcp client configs from cli  -  by @​Kinfe123 and @​himself65 in #​4872 (70cb4)
  • Support Cloudflare Workers virtual module imports  -  by @​chhoumann in #​5559 (cf050)
• client:
  • Refetch session when browser state changes  -  by @​himself65 and Copilot in #​5630 (522cf)
  • Add type helper AuthClient  -  by @​himself65 in #​5815 (7caa2)
  • Introduce disableSignal client option  -  by @​ping-maxwell in #​6108 (f4c43)
• core:
  • Replace ZodType with @standard-schema/spec  -  by @​himself65 in #​5629 (36315)
• db:
  • Delete hooks  -  by @​Kinfe123 and @​himself65 in #​4792 (eb76a)
• device-authorization:
  • Add verification uri  -  by @​bytaesu and @​himself65 in #​5451 (8b2b6)
• discord:
  • Allow specification of permissions  -  by @​TheUntraceable and @​Bekacru in #​4717 (69c9b)
• docs:
  • Adding missing auth & colour in builder  -  by @​okisdev in #​5982 (63518)
• email-otp:
  • Allow returning undefined in generateOTP  -  by @​ping-maxwell in #​4723 (8ac4f)
• expo:
  • Support multiple cookie prefixes for better-auth detection  -  by @​himself65 in #​6080 (f5285)
• generic-oauth:
  • Provide pre configured provider helpers  -  by @​Paola3stefania in #​6085 (07b7e)
  • Add custom token exchange support for non-standard providers  -  by @​bytaesu in #​6179 (0ac6a)
• jwt:
  • Support custom adapter option for jwt  -  by @​Bekacru in #​5812 (10cee)
  • Add JWT verification endpoint and refactor verification logic  -  by @​himself65 in #​6122 (18cf7)
  • Add key rotation  -  by @​Bekacru, Copilot and @​Paola3stefania in #​6147 (0bd9b)
• last-login-method:
  • Update OAuth login method tracking for multiple auth type  -  by @​Kinfe123 in #​4693 (5e7b5)
  • Add support for 'siwe' as a last login method and added tests  -  by @​rovertrack in #​6027 (08316)
• mongodb:
  • Support string IDs over ObjectIDs  -  by @​ping-maxwell and @​ahmedriad1 in #​5384 (0dfe6)
• oauth-proxy:
  • Stateless mode compatibility  -  by @​bytaesu and Copilot in #​6131 (05fa1)
• oidc-provider:
  • Add RP-Initiated Logout endpoint  -  by @​himself65 and Copilot in #​6094 (c9085)
• organization:
  • Support createdAt on invitations  -  by @​iRoachie and @​himself65 in #​2346 (fc321)
  • Refactor organization schema to use BetterAuth types  -  by @​himself65 in #​5515 (a58f1)
• passkey:
  • Allow multiple passkey origins  -  by @​kevcube in #​4800 (3783b)
• paybin:
  • Add Paybin OAuth provider  -  by @​redoh and Copilot in #​5626 (b5813)
• phone-number:
  • Allow custom verifyOTP implementation  -  by @​bytaesu and @​zain in #​5926 (b855a)
• plugin-openapi:
  • Allow passing nonce for CSP  -  by @​GautamBytes in #​5751 (fa147)
• prisma:
  • Enhance JSON default value handling for arrays and objects in schema generation  -  by @​rovertrack in #​5904 (09162)
• session:
  • Use JWE for cookie cache by default  -  by @​himself65 in #​5510 (f654b)
• sso:
  • DefaultSSO options and ACS endpoint  -  by @​Kinfe123 and @​Bekacru in #​3660 (b3ead)
  • Provide default service provider metadata  -  by @​dvanmali in #​4866 (e892a)
  • Add option to provide login hint  -  by @​tnkuehne and Copilot in #​5283 (6f231)
  • Add domain verification for SSO providers  -  by @​jonathansamines and @​ping-maxwell in #​5910 (da965)
• stripe:
  • Upgrade stripe support to v19.1.0  -  by @​okisdev in #​5346 (3a8f4)
  • Add StripePlugin type  -  by @​himself65 in #​5509 (34431)
  • Allow any scheme  -  by @​hyoban, @​Bekacru and Copilot in #​5725 (2451c)
  • Allow flexible types in plan limits  -  by @​bytaesu and @​Bekacru in #​5821 (4011c)

   🐞 Bug Fixes

• Device authorization plugin  -  by @​bytaesu in #​4695 (b9cbd)
• Device authorization plugin  -  by @​bytaesu in #​4695 (c3001)
• Reduce any type in generator.ts  -  by @​himself65 in #​4710 (0770c)
• Refresh secondary storage sessions on user update  -  by @​frectonz in #​4522 (ea89d)
• Allow disable database transaction  -  by @​himself65 in #​4733 (a8776)
• Wrap Math.floor around the division when calculating TTL  -  by @​DevDuki, Dusan Misic, ping-maxwell and @​himself65 in #​4768 (14b9e)
• Ttl sessions list expiration  -  by @​dvanmali in #​3836 (57e04)
• Tests failing due to clock drift  -  by @​dvanmali in #​4915 (63ca1)
• Refresh secondary storage sessions on user update  -  by @​frectonz in #​4522 (ccc7c)
• Refresh secondary storage sessions on user update  -  by @​frectonz in #​4522 (f1b0a)
• Support compressed ipv6 format  -  by @​Velka-DEV in #​4982 (d8f11)
• Add required constraint to slug filed in org plugin  -  by @​bytaesu in #​4989 (0581a)
• Use consistent messaging on requestPasswordReset  -  by @​Eazash in #​5014 (2f94b)
• Cookie size limit shouldn't throw error  -  by @​Bekacru and @​himself65 in #​5031 (72ecc)
• Handle symbols in proxy get trap to prevent TypeError  -  by @​zbeyens and @​himself65 in #​4924 (8d46c)
• Ttl for rate limited secondary storage  -  by @​dvanmali in #​4961 (f246d)
• Properly encode callback url for email verificaiton  -  by @​Bekacru in #​5052 (41d2e)
• Session update database hook should expect partial session type  -  by @​Bekacru in #​5056 (ade06)
• Deprecate options.advanced.generateId type  -  by @​himself65 (48249)
• Api keys should properly check if a request is from client or server  -  by @​Bekacru (2e236)
• Refactor account deletion functions to trigger database hooks  -  by @​xuchenhao001 in #​5114 (dade3)
• Improve username transformation logic  -  by @​ping-maxwell in #​5115 (b2a9e)
• Ensure falsy values are valid default values  -  by @​ocherry341 in #​5182 (03d62)
• Import node:async_hooks directly  -  by @​himself65 in #​5198 (0717e)
• Undeclared variable reference on docs  -  by @​Kinfe123 in #​5235 (6d6df)
• Argument where of type TwoFactorWhereUniqueInput needs at least one of id arguments  -  by @​AlexStrNik in #​5180 (2dab4)
• Mobile ai search responsiveness  -  by @​Kinfe123 in #​5269 (08d95)
• Type compatibility with exactOptionalPropertyTypes  -  by @​Kinfe123 and @​himself65 in #​5236 (f2723)
• Remove deprecated ssoClient export from client plugin  -  by @​Kinfe123 in #​5307 (ee229)
• GetAcccessToken refresh should properly refresh when o

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
create-t3-turbo-tanstack-start	Error		Dec 14, 2025 9:50am

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	better-auth@​1.4.7

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report