Skip to content

chore(deps): Bump the better-auth group with 4 updates - #180

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/better-auth-510375edf2
Closed

chore(deps): Bump the better-auth group with 4 updates#180
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/better-auth-510375edf2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 19, 2026

Copy link
Copy Markdown
Contributor

Bumps the better-auth group with 4 updates: better-auth, @better-auth/cimd, @better-auth/mcp and @better-auth/oauth-provider.

Updates better-auth from 1.7.7 to 1.7.10

Release notes

Sourced from better-auth's releases.

v1.7.10

better-auth

Bug Fixes

  • Fixed Captcha and OpenAPI plugin subpath imports and type resolution for better-auth/plugins/multi-session and better-auth/test. (#11822)
  • Fixed Google One Tap sign-ins not recording google as the last login method. (#11393)
  • Fixed imports from better-auth/plugins/one-tap failing with a not-exported error. (#11696)
  • Fixed Google One Tap ignoring plugin-level autoSelect and cancelOnTapOutside settings. (#11820)
  • Fixed Google One Tap sign-ins ignoring configured Google profile mapping and user info updates. (#11819)
  • Fixed Google One Tap calling a prompt method unsupported by FedCM and retrying skipped prompts. (#11821)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

  • Added optional self-service signing key rotation for private_key_jwt clients. (#11695)

Bug Fixes

  • Fixed valid DPoP proofs being rejected for parameterized routes and URLs with trailing slashes. (#11786)
  • Fixed native clients with HTTP loopback callbacks being rejected when application type inference is enabled. (#11798)
  • Fixed device-code clients being unable to refresh access for approved resources omitted from a token poll. (#11815)
  • Fixed OAuth consent without a reference overwriting or reusing consent for a different reference. (#11801)
  • Fixed dynamic client registration rejecting requests that include both supported and unsupported grants. (#11797)
  • Fixed attempts to change cached trusted clients returning HTTP 500 instead of HTTP 400. (#11781)
  • Improved errors for unknown OAuth client_id values to say client not found. (#11799)
  • Fixed PKCE verifier errors to return the specified HTTP 400 response and error code. (#11724)
  • Fixed unknown OAuth clients receiving invalid_grant instead of invalid_client at the token endpoint. (#11176)
  • Fixed unverifiable JWT access tokens causing server errors at /oauth2/userinfo, /oauth2/introspect, and /oauth2/revoke. (#11596)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Limited JWKS refetches for unknown key IDs to protect servers from repeated requests. (#11805)
  • Fixed unreachable JWKS endpoints being reported as invalid tokens instead of server errors. (#11612)

For detailed changes, see CHANGELOG

@better-auth/mongo-adapter

Bug Fixes

  • Fixed MongoDB findMany ignoring ID sorting and potentially repeating or skipping paginated results. (#11801)

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.10

Patch Changes

  • #11393 eebd47a Thanks @​breken-ai! - If you use the lastLoginMethod plugin with oneTap, signing in through Google One Tap now records "google", the same value as signing in with the Google button. Before, a One Tap sign-in recorded nothing: the better-auth.last_used_login_method cookie kept its previous value or stayed unset, and so did user.lastLoginMethod with storeInDatabase.

    If your customResolveMethod includes a /one-tap/callback → "google" workaround, remove that mapping; keep the resolver if it handles other routes.

  • #11821 09d07e6 Thanks @​gustavovalverde! - The Google One Tap prompt (authClient.oneTap() without button) no longer calls getSkippedReason(), which Google's FedCM migration guide says to remove. Before, it called it under any promptOptions.fedCM setting.

    A skipped prompt now ends the flow and calls onPromptNotification right away instead of retrying. Google doesn't report why a prompt was skipped, and a prompt the user closed stays hidden for Google's cooldown period, so the retries could not bring it back. Dismissed prompts still retry as before.

    Google Identity Services still logs its FedCM migration warning, because it does so whenever prompt() receives a listener. The plugin needs the listener to track dismissals and skips, so the warning is expected and safe to ignore.

  • #11819 eaecb72 Thanks @​gustavovalverde! - Google One Tap now applies your socialProviders.google.mapProfileToUser and custom getUserInfo, the same as the standard Google sign-in. Before, One Tap ignored both and always stored the token's name, email, email_verified, and picture claims.

    If you configured either one, users created through One Tap now get the fields it returns, including any extra fields such as a first name from given_name. Returning users are updated from it on each One Tap sign-in when socialProviders.google.overrideUserInfoOnSignIn is on, and so are existing users that One Tap links when account.accountLinking.updateUserInfoOnLink is on. Check that your mapper suits One Tap users too.

    If you set socialProviders.google.overrideUserInfoOnSignIn, One Tap sign-ins now update returning users' name, image, and email from Google, as the redirect sign-in already does.

    Setups that configure none of these, including oneTap({ clientId }) with no Google provider, are unaffected.

  • #11820 88c9a37 Thanks @​gustavovalverde! - If you set autoSelect or cancelOnTapOutside on oneTapClient(), the One Tap prompt and the Sign in with Google button now use them. Before, only values passed to authClient.oneTap() took effect, so with autoSelect: true on the plugin, returning users still had to pick an account. Values passed to oneTap() still override the plugin's. Apps that set these options only on oneTap(), or not at all, are unaffected.

  • #11696 0cf1f7c Thanks @​drewsephski! - You can now import the One Tap plugin from better-auth/plugins/one-tap, as you can for other plugins. Previously this import failed with a "not exported" error. Imports from better-auth/plugins and better-auth/client/plugins are unchanged.

  • #11822 414e845 Thanks @​gustavovalverde! - You can now import the Captcha and OpenAPI plugins from better-auth/plugins/captcha and better-auth/plugins/open-api, as you can for other plugins. Previously these imports failed with a "not exported" error. Imports from better-auth/plugins are unchanged.

    If your TypeScript config uses "moduleResolution": "node" (or node10), better-auth/plugins/multi-session and better-auth/test now resolve their types. Previously TypeScript reported that it could not find their declarations. Projects using bundler, node16, or nodenext resolution are unaffected.

  • Updated dependencies [fedd055, bbd0a19, 99cdfe7]:

    • @​better-auth/core@​1.7.10
    • @​better-auth/mongo-adapter@​1.7.10
    • @​better-auth/drizzle-adapter@​1.7.10
    • @​better-auth/kysely-adapter@​1.7.10
    • @​better-auth/memory-adapter@​1.7.10
    • @​better-auth/prisma-adapter@​1.7.10
    • @​better-auth/telemetry@​1.7.10

1.7.9

Patch Changes

  • #11766 6edaa61 Thanks @​bytaesu! - An onAPIError.onError handler that throws or rejects no longer fails the request or causes an unhandled promise rejection. The error is logged and the original error response is returned. Async handlers now finish before the response is sent.

  • Updated dependencies []:

    • @​better-auth/core@​1.7.9
    • @​better-auth/drizzle-adapter@​1.7.9
    • @​better-auth/kysely-adapter@​1.7.9
    • @​better-auth/memory-adapter@​1.7.9

... (truncated)

Commits
  • b734a41 chore: release v1.7.10 (#11795)
  • eebd47a fix(last-login-method): record Google One Tap sign-ins (#11393)
  • eaecb72 fix(one-tap): apply the Google provider's mapProfileToUser and getUserInfo (#...
  • 414e845 fix(better-auth): keep package subpaths in sync with build entries (#11822)
  • 88c9a37 fix(one-tap): apply plugin-level autoSelect and cancelOnTapOutside (#11820)
  • 09d07e6 fix(one-tap): stop calling prompt moment methods unsupported under FedCM (#11...
  • 0cf1f7c fix(one-tap): add the better-auth/plugins/one-tap subpath export (#11696)
  • d2a5f83 chore: release v1.7.9 (#11761)
  • dbca311 test: fix test names in bearer and organization (#11768)
  • c03ced5 chore: bump @biomejs/biome (#11760)
  • Additional commits viewable in compare view

Updates @better-auth/cimd from 1.7.7 to 1.7.10

Release notes

Sourced from @​better-auth/cimd's releases.

v1.7.10

better-auth

Bug Fixes

  • Fixed Captcha and OpenAPI plugin subpath imports and type resolution for better-auth/plugins/multi-session and better-auth/test. (#11822)
  • Fixed Google One Tap sign-ins not recording google as the last login method. (#11393)
  • Fixed imports from better-auth/plugins/one-tap failing with a not-exported error. (#11696)
  • Fixed Google One Tap ignoring plugin-level autoSelect and cancelOnTapOutside settings. (#11820)
  • Fixed Google One Tap sign-ins ignoring configured Google profile mapping and user info updates. (#11819)
  • Fixed Google One Tap calling a prompt method unsupported by FedCM and retrying skipped prompts. (#11821)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

  • Added optional self-service signing key rotation for private_key_jwt clients. (#11695)

Bug Fixes

  • Fixed valid DPoP proofs being rejected for parameterized routes and URLs with trailing slashes. (#11786)
  • Fixed native clients with HTTP loopback callbacks being rejected when application type inference is enabled. (#11798)
  • Fixed device-code clients being unable to refresh access for approved resources omitted from a token poll. (#11815)
  • Fixed OAuth consent without a reference overwriting or reusing consent for a different reference. (#11801)
  • Fixed dynamic client registration rejecting requests that include both supported and unsupported grants. (#11797)
  • Fixed attempts to change cached trusted clients returning HTTP 500 instead of HTTP 400. (#11781)
  • Improved errors for unknown OAuth client_id values to say client not found. (#11799)
  • Fixed PKCE verifier errors to return the specified HTTP 400 response and error code. (#11724)
  • Fixed unknown OAuth clients receiving invalid_grant instead of invalid_client at the token endpoint. (#11176)
  • Fixed unverifiable JWT access tokens causing server errors at /oauth2/userinfo, /oauth2/introspect, and /oauth2/revoke. (#11596)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Limited JWKS refetches for unknown key IDs to protect servers from repeated requests. (#11805)
  • Fixed unreachable JWKS endpoints being reported as invalid tokens instead of server errors. (#11612)

For detailed changes, see CHANGELOG

@better-auth/mongo-adapter

Bug Fixes

  • Fixed MongoDB findMany ignoring ID sorting and potentially repeating or skipping paginated results. (#11801)

... (truncated)

Changelog

Sourced from @​better-auth/cimd's changelog.

1.7.10

1.7.9

1.7.8

Patch Changes

  • #10956 6214610 Thanks @​disbell! - Native OAuth clients and Client ID Metadata Documents can now use custom-scheme redirect URIs with a host and a path, such as Cursor's cursor://anysphere.cursor-mcp/oauth/callback. Previously, only the authority-free reverse-domain form, such as com.example.app:/callback, was accepted, and these registrations failed with invalid_redirect_uri.

    Cursor also omits application_type when it registers, so the web default still rejects it. To accept Cursor, set the new clientRegistrationDefaultApplicationType option to "infer". A dynamic registration that omits application_type then becomes native when any of its redirect URIs uses a custom scheme, and every redirect URI must pass the native rules. Setting "native" treats every registration that omits the field as native. The default remains "web", and an application_type the client sends is never overridden.

    Pairwise clients (subject_type: "pairwise") cannot use these host-bearing custom-scheme redirect URIs. Web clients are unaffected: they still accept only https redirect URIs on non-loopback hosts.

Commits

Updates @better-auth/mcp from 1.7.7 to 1.7.10

Release notes

Sourced from @​better-auth/mcp's releases.

v1.7.10

better-auth

Bug Fixes

  • Fixed Captcha and OpenAPI plugin subpath imports and type resolution for better-auth/plugins/multi-session and better-auth/test. (#11822)
  • Fixed Google One Tap sign-ins not recording google as the last login method. (#11393)
  • Fixed imports from better-auth/plugins/one-tap failing with a not-exported error. (#11696)
  • Fixed Google One Tap ignoring plugin-level autoSelect and cancelOnTapOutside settings. (#11820)
  • Fixed Google One Tap sign-ins ignoring configured Google profile mapping and user info updates. (#11819)
  • Fixed Google One Tap calling a prompt method unsupported by FedCM and retrying skipped prompts. (#11821)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

  • Added optional self-service signing key rotation for private_key_jwt clients. (#11695)

Bug Fixes

  • Fixed valid DPoP proofs being rejected for parameterized routes and URLs with trailing slashes. (#11786)
  • Fixed native clients with HTTP loopback callbacks being rejected when application type inference is enabled. (#11798)
  • Fixed device-code clients being unable to refresh access for approved resources omitted from a token poll. (#11815)
  • Fixed OAuth consent without a reference overwriting or reusing consent for a different reference. (#11801)
  • Fixed dynamic client registration rejecting requests that include both supported and unsupported grants. (#11797)
  • Fixed attempts to change cached trusted clients returning HTTP 500 instead of HTTP 400. (#11781)
  • Improved errors for unknown OAuth client_id values to say client not found. (#11799)
  • Fixed PKCE verifier errors to return the specified HTTP 400 response and error code. (#11724)
  • Fixed unknown OAuth clients receiving invalid_grant instead of invalid_client at the token endpoint. (#11176)
  • Fixed unverifiable JWT access tokens causing server errors at /oauth2/userinfo, /oauth2/introspect, and /oauth2/revoke. (#11596)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Limited JWKS refetches for unknown key IDs to protect servers from repeated requests. (#11805)
  • Fixed unreachable JWKS endpoints being reported as invalid tokens instead of server errors. (#11612)

For detailed changes, see CHANGELOG

@better-auth/mongo-adapter

Bug Fixes

  • Fixed MongoDB findMany ignoring ID sorting and potentially repeating or skipping paginated results. (#11801)

... (truncated)

Changelog

Sourced from @​better-auth/mcp's changelog.

1.7.10

Patch Changes

1.7.9

Patch Changes

1.7.8

Patch Changes

Commits

Updates @better-auth/oauth-provider from 1.7.7 to 1.7.10

Release notes

Sourced from @​better-auth/oauth-provider's releases.

v1.7.10

better-auth

Bug Fixes

  • Fixed Captcha and OpenAPI plugin subpath imports and type resolution for better-auth/plugins/multi-session and better-auth/test. (#11822)
  • Fixed Google One Tap sign-ins not recording google as the last login method. (#11393)
  • Fixed imports from better-auth/plugins/one-tap failing with a not-exported error. (#11696)
  • Fixed Google One Tap ignoring plugin-level autoSelect and cancelOnTapOutside settings. (#11820)
  • Fixed Google One Tap sign-ins ignoring configured Google profile mapping and user info updates. (#11819)
  • Fixed Google One Tap calling a prompt method unsupported by FedCM and retrying skipped prompts. (#11821)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

  • Added optional self-service signing key rotation for private_key_jwt clients. (#11695)

Bug Fixes

  • Fixed valid DPoP proofs being rejected for parameterized routes and URLs with trailing slashes. (#11786)
  • Fixed native clients with HTTP loopback callbacks being rejected when application type inference is enabled. (#11798)
  • Fixed device-code clients being unable to refresh access for approved resources omitted from a token poll. (#11815)
  • Fixed OAuth consent without a reference overwriting or reusing consent for a different reference. (#11801)
  • Fixed dynamic client registration rejecting requests that include both supported and unsupported grants. (#11797)
  • Fixed attempts to change cached trusted clients returning HTTP 500 instead of HTTP 400. (#11781)
  • Improved errors for unknown OAuth client_id values to say client not found. (#11799)
  • Fixed PKCE verifier errors to return the specified HTTP 400 response and error code. (#11724)
  • Fixed unknown OAuth clients receiving invalid_grant instead of invalid_client at the token endpoint. (#11176)
  • Fixed unverifiable JWT access tokens causing server errors at /oauth2/userinfo, /oauth2/introspect, and /oauth2/revoke. (#11596)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Limited JWKS refetches for unknown key IDs to protect servers from repeated requests. (#11805)
  • Fixed unreachable JWKS endpoints being reported as invalid tokens instead of server errors. (#11612)

For detailed changes, see CHANGELOG

@better-auth/mongo-adapter

Bug Fixes

  • Fixed MongoDB findMany ignoring ID sorting and potentially repeating or skipping paginated results. (#11801)

... (truncated)

Changelog

Sourced from @​better-auth/oauth-provider's changelog.

1.7.10

Patch Changes

  • #11786 cdd491b Thanks @​gustavovalverde! - DPoP proofs are accepted again for two setups that broke in v1.7.9:

    • Plugin endpoints with route params, such as /extension/:tenant/token, that issue tokens with a DPoP proof. A valid proof for /extension/acme/token was rejected with invalid_dpop_proof, because the expected htu contained the literal :tenant.
    • Token and UserInfo requests to a URL with a trailing slash, such as /api/auth/oauth2/token/, when advanced.skipTrailingSlashes is on. The proof was rejected because the expected htu dropped the slash.

    The expected htu still takes its origin and base path from baseURL, so keep baseURL set to the public URL clients call. Other setups are unaffected.

  • #11815 44f14bb Thanks @​gustavovalverde! - Device-code clients that request offline_access and poll the token endpoint for only some of the RFC 8707 resources the user approved can now refresh for any approved resource. Previously, a refresh for an approved resource left out of the poll failed with invalid_target. Device codes polled without resource, or for every approved resource, are unaffected.

  • #11695 fe550a9 Thanks @​gustavovalverde! - Confidential private_key_jwt clients that register inline jwks can now replace their own signing keys without a user session. Until now those keys were fixed at registration. The feature is off by default; set allowClientKeyRotation: true to enable it. No database migration is needed, but the provider refuses to start with it enabled on the memory adapter or with advanced.database.generateId: "serial", because neither enforces single-use client assertions.

    The client calls POST /oauth2/client/rotate-keys with its complete new jwks and a client assertion signed by one of its current keys, whose aud includes the rotation endpoint's URL. An assertion addressed only to the token endpoint or the issuer is rejected. Keys left out of the new set stop working at once, so roll a key in two steps: send the old and new keys together, then drop the old key once every instance signs with the new one.

  • #11801 99cdfe7 Thanks @​gustavovalverde! - If postLogin.consentReferenceId returns no reference for some authorizations (for example, it returns an organization ID only for organization scopes), consent is now kept separate per reference. Approving consent without a reference no longer overwrites the consent stored for an organization, and an authorization without a reference no longer skips the consent prompt because the user consented under an organization. Previously, approving read write without a reference could replace an organization's stored read consent, so later authorizations for that organization were granted write without asking. For new authorizations, an empty string is treated the same as no reference, including the referenceId passed to token claim callbacks.

    Users may see the consent prompt once for authorizations that were previously approved through another reference's consent. Until they do, silent (prompt=none) authorizations in these setups return consent_required. Consent overwritten before this release is not repaired; users can review or revoke it through the consent management endpoints. Setups that never configured consentReferenceId, or that always return a reference, are unaffected.

  • #11797 906c32f Thanks @​gustavovalverde! - If you enable dynamic client registration, Claude's MCP connector can now register. It requests urn:ietf:params:oauth:grant-type:jwt-bearer along with authorization_code and refresh_token, and Better Auth rejected the whole registration with invalid_client_metadata because one grant was unsupported. Dynamic registration now keeps the requested grants the server supports and lists them in the registration response. A request that shares no grant with the server is still rejected. Clients created with createOAuthClient or adminCreateOAuthClient still reject unsupported grants.

  • #11798 2fa7e2f Thanks @​gustavovalverde! - With clientRegistrationDefaultApplicationType: "infer", clients that register an http callback on localhost, 127.0.0.1, or [::1] without application_type now register as native. This includes older Claude Code releases, which register http://127.0.0.1:<port>/callback. Current Claude Code releases send application_type: "native" and were not affected. Before, "infer" chose native only for callbacks whose scheme is not http or https, so these registrations were treated as web and rejected with invalid_redirect_uri. The "web" default and the "native" setting are unchanged, and an application_type the client sends is never overridden.

  • #11176 8f3da46 Thanks @​Bekacru! - The token endpoint now returns invalid_client instead of invalid_grant when a request names a client_id that is not registered, for the authorization_code, refresh_token, and device code grants. MCP clients whose registration was deleted, for example by a database reset or an upgrade that dropped OAuth tables, now register again and prompt the user to sign in. Before, they kept the deleted client_id and stayed signed out until the user cleared their saved credentials by hand. A registered client that sends wrong credentials also gets invalid_client now, even when its code or refresh token is also invalid.

  • #11596 963b7f9 Thanks @​mahoor! - /oauth2/userinfo, /oauth2/introspect and /oauth2/revoke now answer a JWT that fails verification the way they answer any unknown token. Before, they returned an empty 500. This covers an alg: none token, a tampered signature, an unknown kid and a wrong issuer: userinfo returns 401 invalid_token with a WWW-Authenticate challenge, introspection returns { "active": false }, and revocation returns its unknown-token error. Valid JWT and opaque access tokens are unaffected, including JWT-shaped tokens issued by generateOpaqueAccessToken.

    If you set disableJwtPlugin: true, a JWT-shaped token that is not a stored access token, such as an ID token, now gets the same unknown-token response instead of a 500.

    A key set the server cannot use, such as one where two keys share a kid, still returns 500.

  • #11781 e34b828 Thanks @​gustavovalverde! - If you configure cachedTrustedClients, attempts to update, delete, or rotate the secret of one of those clients through the client management endpoints now fail with HTTP 400 instead of 500. The response body is unchanged (error: "invalid_client"), so only code that branches on the status code is affected. A 500 previously made a deliberate refusal look like a server failure.

  • #11799 f42c0c2 Thanks @​gustavovalverde! - Requests that name a client_id the server does not know now fail with error_description set to client not found. Before, /oauth2/authorize said client_id is required, which read as a missing parameter, /oauth2/token, /oauth2/revoke, and /oauth2/introspect said missing client, and requests that authenticate with a private_key_jwt client assertion said unknown client. You would see this, for example, when an MCP client kept a registration the server had deleted. The invalid_client error code is unchanged.

  • #11724 4d7da0b Thanks @​drewsephski! - Clients exchanging an authorization code with PKCE now get the token errors RFC 7636 and RFC 6749 specify. A code_verifier that does not match the authorization request's code_challenge returns HTTP 400 invalid_grant; it previously returned HTTP 401 invalid_request. For clients where PKCE is optional, a missing or unexpected code_verifier still returns invalid_request, now with HTTP 400 instead of 401. No request that failed before now succeeds.

1.7.9

Patch Changes

  • #10799 54a0994 Thanks @​bytaesu! - DPoP token and UserInfo requests now succeed when the server sees a different request URL than the one the client called. This affects deployments behind a proxy that rewrites the host or path, and the Next.js dev server, which reports every request as localhost. Before, a client that built the proof's htu from the public endpoint URL got invalid_dpop_proof for every grant that accepts DPoP.

    The expected htu is now the public endpoint URL built from baseURL, such as https://auth.example.com/api/auth/oauth2/token, or the URL of a plugin endpoint that issues tokens. Behind a proxy, set baseURL to the public URL clients call, not the internal one. A client that sends proofs to a host other than baseURL must build htu from the public URL instead. Deployments where the request URL already matches baseURL are unaffected.

  • #11185 0a1a87e Thanks @​johanneskares! - If you use postLogin with the documented organization selector, users who belong to more than one organization can now finish authorization. Since v1.6.16, selecting an organization and calling oauth2.continue({ postLogin: true }) sent these users back to the selection page every time.

    postLogin.shouldRedirect now receives isContinuation, which is true when the user returns from your post login page. To stop the loop, update your callback to match the Post Login Screen example: on a new authorization, ask users with several organizations to choose; on continuation, return false once the session's active organization is one the user belongs to. Callbacks that do not read isContinuation behave as before.

... (truncated)

Commits
  • b734a41 chore: release v1.7.10 (#11795)
  • 61c913d fix(oauth-provider): report an unknown client in a client assertion as not fo...
  • 4d7da0b fix(oauth-provider): return 400 invalid_grant on PKCE verifier mismatch (#11724)
  • 8f3da46 fix(oauth-provider): return invalid_client for an unknown client at the token...
  • 44f14bb fix(oauth-provider): keep approved resources refreshable after a narrowed dev...
  • fedd055 fix(oauth2): report an unreachable JWKS as an error, not an invalid token (#1...
  • 963b7f9 fix(oauth-provider): treat unverifiable JWT access tokens as invalid (#11596)
  • 906c32f fix(oauth-provider): keep the supported grants from a dynamic registration (#...
  • 99cdfe7 fix(oauth-provider): keep consent separate per reference (#11801)
  • 2832dbd fix(oauth-provider): accept key-rotation assertions when baseURL ends in a sl...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): Bump the better-auth group with 4 updates
00ec951 
Bumps the better-auth group with 4 updates: [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth), [@better-auth/cimd](https://github.com/better-auth/better-auth/tree/HEAD/packages/cimd), [@better-auth/mcp](https://github.com/better-auth/better-auth/tree/HEAD/packages/mcp) and [@better-auth/oauth-provider](https://github.com/better-auth/better-auth/tree/HEAD/packages/oauth-provider).


Updates `better-auth` from 1.7.7 to 1.7.10
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.10/packages/better-auth)

Updates `@better-auth/cimd` from 1.7.7 to 1.7.10
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/cimd/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.10/packages/cimd)

Updates `@better-auth/mcp` from 1.7.7 to 1.7.10
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/mcp/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.10/packages/mcp)

Updates `@better-auth/oauth-provider` from 1.7.7 to 1.7.10
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/oauth-provider/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.10/packages/oauth-provider)

---
updated-dependencies:
- dependency-name: better-auth
  dependency-version: 1.7.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: better-auth
- dependency-name: "@better-auth/cimd"
  dependency-version: 1.7.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: better-auth
- dependency-name: "@better-auth/mcp"
  dependency-version: 1.7.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: better-auth
- dependency-name: "@better-auth/oauth-provider"
  dependency-version: 1.7.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: better-auth
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added area:infra Infra: CI, Docker, imagem multi-arch, releases, templates de deploy dependencies Pull requests that update a dependency file labels Oct 19, 2026
@patrickbrandao patrickbrandao mentioned this pull request Oct 26, 2026
Merged
patrickbrandao added a commit that referenced this pull request Oct 26, 2026
@patrickbrandao @claude
chore(deps): better-auth 1.7.13 with aligned @better-auth packages (#205
476ebd9 
)

Pins better-auth, @better-auth/mcp, @better-auth/oauth-provider and
@better-auth/cimd to the same version so @better-auth/mcp no longer pulls a
nested oauth-provider copy (TS2742 in auth.instance.ts on #180).

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
@patrickbrandao

patrickbrandao commented Oct 26, 2026

Copy link
Copy Markdown
Owner

Substituído pelo better-auth 1.7.13 com todas as @better-auth alinhadas (corrige o TS2742).

@dependabot @github

dependabot Bot commented on behalf of github Oct 26, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/better-auth-510375edf2 branch October 26, 2026 18:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area:infra Infra: CI, Docker, imagem multi-arch, releases, templates de deploy dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@patrickbrandao