Skip to content

chore(deps): bump the better-auth group across 1 directory with 5 updates - #3011

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/better-auth-1e180aec4a
Open

chore(deps): bump the better-auth group across 1 directory with 5 updates#3011
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/better-auth-1e180aec4a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the better-auth group with 5 updates in the / directory:

Package From To
@better-auth/stripe 1.7.4 1.7.14
better-auth 1.7.4 1.7.14
@better-auth/cimd 1.7.4 1.7.14
@better-auth/mcp 1.7.4 1.7.14
@better-auth/oauth-provider 1.7.4 1.7.14

Updates @better-auth/stripe from 1.7.4 to 1.7.14

Release notes

Sourced from @​better-auth/stripe's releases.

v1.7.14

better-auth

Bug Fixes

  • Fixed two-factor TOTP to accept imported Base32 secrets stored as base32:<secret> (#12031)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Fixed Kakao sign-in to forward loginHint so the Kakao Account login page opens with the ID field prefilled (#12045)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​bytaesu, @​honuuk

Full changelog: v1.7.13...v1.7.14

v1.7.13

better-auth

Bug Fixes

  • Fixed type declarations so type-only exports are no longer listed as values, making a value import fail type checking instead of failing at runtime (#11985)

For detailed changes, see CHANGELOG

@better-auth/core

Features

  • Added token endpoint authentication options to the Vercel social provider, including dynamic OIDC tokens and private key JWT client assertions, without replacing the built-in sign-in flow (#11948)

Bug Fixes

  • Added tokenEndpointAuth: { method } to the Cloudflare provider and deprecated tokenEndpointAuthMethod, which remains supported (#11997)

For detailed changes, see CHANGELOG

@better-auth/stripe

Features

... (truncated)

Changelog

Sourced from @​better-auth/stripe's changelog.

1.7.14

1.7.13

Patch Changes

1.7.12

1.7.11

1.7.10

1.7.9

1.7.8

Patch Changes

  • #9684 72a6394 Thanks @​nikhilgupta58! - Stop logging a "Stripe webhook failed" error when a one-time payment mode checkout session completes.

1.7.7

1.7.6

Patch Changes

  • #11347 f95d5f1 Thanks @​rwieruch! - Fix automatic seat synchronization after an organization cancels and resubscribes, so member changes update the active or trialing subscription even when canceled subscriptions remain in its history.

1.7.5

Commits

Updates better-auth from 1.7.4 to 1.7.14

Release notes

Sourced from better-auth's releases.

v1.7.14

better-auth

Bug Fixes

  • Fixed two-factor TOTP to accept imported Base32 secrets stored as base32:<secret> (#12031)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Fixed Kakao sign-in to forward loginHint so the Kakao Account login page opens with the ID field prefilled (#12045)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​bytaesu, @​honuuk

Full changelog: v1.7.13...v1.7.14

v1.7.13

better-auth

Bug Fixes

  • Fixed type declarations so type-only exports are no longer listed as values, making a value import fail type checking instead of failing at runtime (#11985)

For detailed changes, see CHANGELOG

@better-auth/core

Features

  • Added token endpoint authentication options to the Vercel social provider, including dynamic OIDC tokens and private key JWT client assertions, without replacing the built-in sign-in flow (#11948)

Bug Fixes

  • Added tokenEndpointAuth: { method } to the Cloudflare provider and deprecated tokenEndpointAuthMethod, which remains supported (#11997)

For detailed changes, see CHANGELOG

@better-auth/stripe

Features

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.14

Patch Changes

  • #12031 d2cb7f5 Thanks @​bytaesu! - Two-factor TOTP now accepts imported Base32 secrets stored as base32:<secret>.

  • Updated dependencies [2947ab7]:

    • @​better-auth/core@​1.7.14
    • @​better-auth/drizzle-adapter@​1.7.14
    • @​better-auth/kysely-adapter@​1.7.14
    • @​better-auth/memory-adapter@​1.7.14
    • @​better-auth/mongo-adapter@​1.7.14
    • @​better-auth/prisma-adapter@​1.7.14
    • @​better-auth/telemetry@​1.7.14

1.7.13

Patch Changes

  • #11985 9cb95fe Thanks @​bytaesu! - Type declarations no longer list type-only exports as values, so importing one as a value now fails type checking instead of failing at runtime.

  • Updated dependencies [2712441, 1cf4b2c]:

    • @​better-auth/core@​1.7.13
    • @​better-auth/drizzle-adapter@​1.7.13
    • @​better-auth/kysely-adapter@​1.7.13
    • @​better-auth/memory-adapter@​1.7.13
    • @​better-auth/mongo-adapter@​1.7.13
    • @​better-auth/prisma-adapter@​1.7.13
    • @​better-auth/telemetry@​1.7.13

1.7.12

Patch Changes

  • #11925 fb48619 Thanks @​bytaesu! - The JWT plugin now verifies JWTs and session cookie-cache JWTs with the algorithm of the stored key instead of the one named in the token header, and logs a warning when it signs or verifies a JWT without an issuer or audience.

  • #11924 681aa5c Thanks @​bytaesu! - auth.api.getSession() now keeps the original database error as error.cause when the session lookup fails, so server code can tell a transient failure from a bug.

  • #11930 b18e3b8 Thanks @​bytaesu! - OAuth callbacks completed through the OAuth proxy now run the same checks as the standard OAuth callback, including issuer and ID token nonce validation.

  • Updated dependencies [681aa5c, 4bc78ba, 876608d, 083a743, 492134a]:

    • @​better-auth/core@​1.7.12
    • @​better-auth/drizzle-adapter@​1.7.12
    • @​better-auth/kysely-adapter@​1.7.12
    • @​better-auth/memory-adapter@​1.7.12
    • @​better-auth/mongo-adapter@​1.7.12
    • @​better-auth/prisma-adapter@​1.7.12
    • @​better-auth/telemetry@​1.7.12

1.7.11

... (truncated)

Commits

Updates @better-auth/cimd from 1.7.4 to 1.7.14

Release notes

Sourced from @​better-auth/cimd's releases.

v1.7.14

better-auth

Bug Fixes

  • Fixed two-factor TOTP to accept imported Base32 secrets stored as base32:<secret> (#12031)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Fixed Kakao sign-in to forward loginHint so the Kakao Account login page opens with the ID field prefilled (#12045)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​bytaesu, @​honuuk

Full changelog: v1.7.13...v1.7.14

v1.7.13

better-auth

Bug Fixes

  • Fixed type declarations so type-only exports are no longer listed as values, making a value import fail type checking instead of failing at runtime (#11985)

For detailed changes, see CHANGELOG

@better-auth/core

Features

  • Added token endpoint authentication options to the Vercel social provider, including dynamic OIDC tokens and private key JWT client assertions, without replacing the built-in sign-in flow (#11948)

Bug Fixes

  • Added tokenEndpointAuth: { method } to the Cloudflare provider and deprecated tokenEndpointAuthMethod, which remains supported (#11997)

For detailed changes, see CHANGELOG

@better-auth/stripe

Features

... (truncated)

Changelog

Sourced from @​better-auth/cimd's changelog.

1.7.14

1.7.13

1.7.12

1.7.11

1.7.10

1.7.9

1.7.8

Patch Changes

  • #10956 6214610 Thanks @​disbell! - Native OAuth clients and Client ID Metadata Documents can now use custom-scheme redirect URIs with a host and a path, such as Cursor's cursor://anysphere.cursor-mcp/oauth/callback. Previously, only the authority-free reverse-domain form, such as com.example.app:/callback, was accepted, and these registrations failed with invalid_redirect_uri.

    Cursor also omits application_type when it registers, so the web default still rejects it. To accept Cursor, set the new clientRegistrationDefaultApplicationType option to "infer". A dynamic registration that omits application_type then becomes native when any of its redirect URIs uses a custom scheme, and every redirect URI must pass the native rules. Setting "native" treats every registration that omits the field as native. The default remains "web", and an application_type the client sends is never overridden.

    Pairwise clients (subject_type: "pairwise") cannot use these host-bearing custom-scheme redirect URIs. Web clients are unaffected: they still accept only https redirect URIs on non-loopback hosts.

1.7.7

1.7.6

1.7.5

Patch Changes

  • #11161 753c2d1 Thanks @​bytaesu! - Allow CIMD clients with valid metadata that cannot be cached to make consecutive OAuth requests while retaining failed-fetch backoff and origin/global fetch limits.
Commits

Updates @better-auth/mcp from 1.7.4 to 1.7.14

Release notes

Sourced from @​better-auth/mcp's releases.

v1.7.14

better-auth

Bug Fixes

  • Fixed two-factor TOTP to accept imported Base32 secrets stored as base32:<secret> (#12031)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Fixed Kakao sign-in to forward loginHint so the Kakao Account login page opens with the ID field prefilled (#12045)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​bytaesu, @​honuuk

Full changelog: v1.7.13...v1.7.14

v1.7.13

better-auth

Bug Fixes

  • Fixed type declarations so type-only exports are no longer listed as values, making a value import fail type checking instead of failing at runtime (#11985)

For detailed changes, see CHANGELOG

@better-auth/core

Features

  • Added token endpoint authentication options to the Vercel social provider, including dynamic OIDC tokens and private key JWT client assertions, without replacing the built-in sign-in flow (#11948)

Bug Fixes

  • Added tokenEndpointAuth: { method } to the Cloudflare provider and deprecated tokenEndpointAuthMethod, which remains supported (#11997)

For detailed changes, see CHANGELOG

@better-auth/stripe

Features

... (truncated)

Changelog

Sourced from @​better-auth/mcp's changelog.

1.7.14

Patch Changes

  • Updated dependencies []:
    • @​better-auth/oauth-provider@​1.7.14

1.7.13

Patch Changes

  • Updated dependencies []:
    • @​better-auth/oauth-provider@​1.7.13

1.7.12

Patch Changes

  • #11934 2a576f3 Thanks @​bytaesu! - requireMcpAuth now accepts only OAuth access tokens and rejects session JWTs from the JWT plugin, even when they share the issuer and audience.

  • Updated dependencies []:

    • @​better-auth/oauth-provider@​1.7.12

1.7.11

Patch Changes

1.7.10

Patch Changes

1.7.9

Patch Changes

1.7.8

Patch Changes

  • #11635 a5d582a Thanks @​gustavovalverde! - Projects that enable exactOptionalPropertyTypes with skipLibCheck: false no longer get a TS2430 error from the @better-auth/mcp type declarations.

... (truncated)

Commits

Updates @better-auth/oauth-provider from 1.7.4 to 1.7.14

Release notes

Sourced from @​better-auth/oauth-provider's releases.

v1.7.14

better-auth

Bug Fixes

  • Fixed two-factor TOTP to accept imported Base32 secrets stored as base32:<secret> (#12031)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Fixed Kakao sign-in to forward loginHint so the Kakao Account login page opens with the ID field prefilled (#12045)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​bytaesu, @​honuuk

Full changelog: v1.7.13...v1.7.14

v1.7.13

better-auth

Bug Fixes

  • Fixed type declarations so type-only exports are no longer listed as values, making a value import fail type checking instead of failing at runtime (#11985)

For detailed changes, see CHANGELOG

@better-auth/core

Features

  • Added token endpoint authentication options to the Vercel social provider, including dynamic OIDC tokens and private key JWT client assertions, without replacing the built-in sign-in flow (#11948)

Bug Fixes

  • Added tokenEndpointAuth: { method } to the Cloudflare provider and deprecated tokenEndpointAuthMethod, which remains supported (#11997)

For detailed changes, see CHANGELOG

@better-auth/stripe

Features

... (truncated)

Changelog

Sourced from @​better-auth/oauth-provider's changelog.

1.7.14

1.7.13

1.7.12

1.7.11

Patch Changes

  • #11830 a1f6f0b Thanks @​gustavovalverde! - Apps using the CIMD plugin no longer lose an administrator's change to a discovered client when a metadata refresh is running at the same time. Before, disabling the client, setting skipConsent or enableEndSession, or assigning client_credentials scopes while its document was being fetched could be undone by the refresh. No action is needed.

  • #10881 37debaa Thanks @​sahiljagtap08! - Corrected the OpenAPI response schemas for /oauth2/consent and /oauth2/continue to describe { redirect: true, url: string }, so generated clients no longer expect a nonexistent redirect_uri field. Runtime responses are unchanged.

1.7.10

Patch Changes

  • #11786 cdd491b Thanks @​gustavovalverde! - DPoP proofs are accepted again for two setups that broke in v1.7.9:

    • Plugin endpoints with route params, such as /extension/:tenant/token, that issue tokens with a DPoP proof. A valid proof for /extension/acme/token was rejected with invalid_dpop_proof, because the expected htu contained the literal :tenant.
    • Token and UserInfo requests to a URL with a trailing slash, such as /api/auth/oauth2/token/, when advanced.skipTrailingSlashes is on. The proof was rejected because the expected htu dropped the slash.

    The expected htu still takes its origin and base path from baseURL, so keep baseURL set to the public URL clients call. Other setups are unaffected.

  • #11815 44f14bb Thanks @​gustavovalverde! - Device-code clients that request offline_access and poll the token endpoint for only some of the RFC 8707 resources the user approved can now refresh for any approved resource. Previously, a refresh for an approved resource left out of the poll failed with invalid_target. Device codes polled without resource, or for every approved resource, are unaffected.

  • #11695 fe550a9 Thanks @​gustavovalverde! - Confidential private_key_jwt clients that register inline jwks can now replace their own signing keys without a user session. Until now those keys were fixed at registration. The feature is off by default; set allowClientKeyRotation: true to enable it. No database migration is needed, but the provider refuses to start with it enabled on the memory adapter or with advanced.database.generateId: "serial", because neither enforces single-use client assertions.

    The client calls POST /oauth2/client/rotate-keys with its complete new jwks and a client assertion signed by one of its current keys, whose aud includes the rotation endpoint's URL. An assertion addressed only to the token endpoint or the issuer is rejected. Keys left out of the new set stop working at once, so roll a key in two steps: send the old and new keys together, then drop the old key once every instance signs with the new one.

  • #11801 99cdfe7 Thanks @​gustavovalverde! - If postLogin.consentReferenceId returns no reference for some authorizations (for example, it returns an organization ID only for organization scopes), consent is now kept separate per reference. Approving consent without a reference no longer overwrites the consent stored for an organization, and an authorization without a reference no longer skips the consent prompt because the user consented under an organization. Previously, approving read write without a reference could replace an organization's stored read consent, so later authorizations for that organization were granted write without asking. For new authorizations, an empty string is treated the same as no reference, including the referenceId passed to token claim callbacks.

    Users may see the consent prompt once for authorizations that were previously approved through another reference's consent. Until they do, silent (prompt=none) authorizations in these setups return consent_required. Consent overwritten before this release is not repaired; users can review or revoke it through the consent management endpoints. Setups that never configured consentReferenceId, or that always return a reference, are unaffected.

  • #11797 906c32f Thanks @​gustavovalverde! - If you enable dynamic client registration, Claude's MCP connector can now register. It requests urn:ietf:params:oauth:grant-type:jwt-bearer along with authorization_code and refresh_token, and Better Auth rejected the whole registration with invalid_client_metadata because one grant was unsupported. Dynamic registration now keeps the requested grants the server supports and lists them in the registration response. A request that shares no grant with the server is still rejected. Clients created with createOAuthClient or adminCreateOAuthClient still reject unsupported grants.

  • #11798 2fa7e2f Thanks @​gustavovalverde! - With clientRegistrationDefaultApplicationType: "infer", clients that register an http callback on localhost, 127.0.0.1, or [::1] without application_type now register as native. This includes older Claude Code releases, which register http://127.0.0.1:<port>/callback. Current Claude Code releases send application_type: "native" and were not affected. Before, "infer" chose native only for callbacks whose scheme is not http or https, so these registrations were treated as web and rejected with invalid_redirect_uri. The "web" default and the "native" setting are unchanged, and an application_type the client sends is never overridden.

  • #11176 8f3da46 Thanks @​Bekacru! - The token endpoint now returns invalid_client instead of invalid_grant when a request names a client_id that is not registered, for the authorization_code, refresh_token, and device code grants. MCP clients whose registration was deleted, for example by a database reset or an upgrade that dropped OAuth tables, now register again and prompt the user to sign in. Before, they kept the deleted client_id and stayed signed out until the user cleared their saved credentials by hand. A registered client that sends wrong credentials also gets invalid_client now, even when its code or refresh token is also invalid.

  • #11596 963b7f9 Thanks @​mahoor! - /oauth2/userinfo, /oauth2/introspect and /oauth2/revoke now answer a JWT that fails verification the way they answer any unknown token. Before, they returned an empty 500. This covers an alg: none token, a tampered signature, an unknown kid and a wrong issuer: userinfo returns 401 invalid_token with a WWW-Authenticate challenge, introspection returns { "active": false }, and revocation returns its unknown-token error. Valid JWT and opaque access tokens are unaffected, including JWT-shaped tokens issued by generateOpaqueAccessToken.

    If you set disableJwtPlugin: true, a JWT-shaped token that is not a stored access token, such as an ID token, now gets the same unknown-token response instead of a 500.

    A key set the server cannot use, such as one where two keys share a kid, still returns 500.

  • #11781 e34b828 Thanks @​gustavovalverde! - If you configure cachedTrustedClients, attempts to update, delete, or rotate the secret of one of those clients through the client management endpoints now fail with HTTP 400 instead of 500. The response body is unchanged (error: "invalid_client"), so only code that branches on the status code is affected. A 500 previously made a deliberate refusal look like a server failure.

  • #11799 f42c0c2 Thanks @​gustavovalverde! - Requests that name a client_id the server does not know now fail with error_description set to client not found. Before, /oauth2/authorize said client_id is required, which read as a missing parameter, /oauth2/token, /oauth2/revoke, and /oauth2/introspect said missing client, and requests that authenticate with a private_key_jwt client assertion said unknown client. You would see this, for example, when an MCP client kept a registration the server had deleted. The invalid_client error code is unchanged.

... (truncated)

Commits
  • a936663 chore: release v1.7.14 (#12055)
  • 7f61081 chore: release v1.7.13 (#11994)
  • f4260a9 chore: release v1.7.12 (#11922)
  • 52ab801 chore: release v1.7.11 (#11827)
  • a1f6f0b fix(oauth-provider): keep admin changes made during a CIMD refresh (#11830)
  • 37debaa fix(oauth-provider): correct consent and continue OpenAPI response schemas (#...
  • b734a41 chore: release v1.7.10 (#11795)
  • 61c913d fix(oauth-provider): report an unknown client in a client assertion as not fo...
  • 4d7da0b fix(oauth-provider): return 400 invalid_grant on PKCE verifier mismatch (#11724)
  • 8f3da46 fix(oauth-provider): return invalid_client for an unknown client at the token...
  • Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 28, 2026
@codecov

codecov Bot commented Sep 28, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.50%. Comparing base (394d9a9) to head (51e04a5).

Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff             @@
##             main    #3011      +/-   ##
==========================================
+ Coverage   96.20%   97.50%   +1.30%     
==========================================
  Files         673      247     -426     
  Lines       39749    17278   -22471     
  Branches    11095     4713    -6382     
==========================================
- Hits        38240    16847   -21393     
+ Misses        521      347     -174     
+ Partials      988       84     -904
Flag Coverage Δ
backend ?
frontend 97.44% <ø> (ø)
shared 98.78% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@codecov

codecov Bot commented Sep 28, 2026 •
edited
Loading

Copy link
Copy Markdown

Bundle Report

Changes will increase total bundle size by 2.36kB (0.14%) ⬆️. This is within the configured threshold ✅

Detailed changes
Bundle name Size Change
manifest-frontend-esm 1.64MB 2.36kB (0.14%) ⬆️

Affected Assets, Files, and Routes:

view changes for bundle: manifest-frontend-esm

Assets Changed:

Asset Name Size Change Total Size Change (%)
assets/index-*.js 105 bytes 164.9kB 0.06%
assets/auth-*.js 2.26kB 28.7kB 8.53% ⚠️

@dependabot dependabot Bot changed the title chore(deps): bump the better-auth group with 5 updates chore(deps): bump the better-auth group across 1 directory with 5 updates Oct 5, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/better-auth-1e180aec4a branch from 13154f5 to 64d59ef Compare October 5, 2026 21:18
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/better-auth-1e180aec4a branch 2 times, most recently from 47f4214 to 44a48d3 Compare October 19, 2026 21:07
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/better-auth-1e180aec4a branch from 44a48d3 to 2b64650 Compare October 26, 2026 21:08
@dependabot
chore(deps): bump the better-auth group across 1 directory with 5 upd…
51e04a5 
…ates

Bumps the better-auth group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@better-auth/stripe](https://github.com/better-auth/better-auth/tree/HEAD/packages/stripe) | `1.7.4` | `1.7.14` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.4` | `1.7.14` |
| [@better-auth/cimd](https://github.com/better-auth/better-auth/tree/HEAD/packages/cimd) | `1.7.4` | `1.7.14` |
| [@better-auth/mcp](https://github.com/better-auth/better-auth/tree/HEAD/packages/mcp) | `1.7.4` | `1.7.14` |
| [@better-auth/oauth-provider](https://github.com/better-auth/better-auth/tree/HEAD/packages/oauth-provider) | `1.7.4` | `1.7.14` |



Updates `@better-auth/stripe` from 1.7.4 to 1.7.14
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/stripe/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.14/packages/stripe)

Updates `better-auth` from 1.7.4 to 1.7.14
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.14/packages/better-auth)

Updates `@better-auth/cimd` from 1.7.4 to 1.7.14
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/cimd/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.14/packages/cimd)

Updates `@better-auth/mcp` from 1.7.4 to 1.7.14
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/mcp/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.14/packages/mcp)

Updates `@better-auth/oauth-provider` from 1.7.4 to 1.7.14
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/oauth-provider/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.14/packages/oauth-provider)

---
updated-dependencies:
- dependency-name: "@better-auth/cimd"
  dependency-version: 1.7.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: better-auth
- dependency-name: "@better-auth/mcp"
  dependency-version: 1.7.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: better-auth
- dependency-name: "@better-auth/oauth-provider"
  dependency-version: 1.7.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: better-auth
- dependency-name: "@better-auth/stripe"
  dependency-version: 1.7.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: better-auth
- dependency-name: better-auth
  dependency-version: 1.7.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: better-auth
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/better-auth-1e180aec4a branch from 2b64650 to 51e04a5 Compare November 2, 2026 21:08

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants