From 7f4e456dec1aec1828efe7752f26a1468c4ab612 Mon Sep 17 00:00:00 2001 From: os-warren Date: Wed, 19 Aug 2026 05:33:38 +0000 Subject: [PATCH 1/5] deps(auth): move the better-auth family off 1.7.0-rc.2 onto the stable ^1.7.1 line MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Stable 1.7.x has shipped: `npm view dist-tags` reports latest 1.7.1 for better-auth, @better-auth/core, oauth-provider, sso, the five adapters and telemetry. The prerelease pin was the remediation for GHSA-p2fr-6hmx-4528 and GHSA-j8v8-g9cx-5qf4 (patched only in >=1.7.0-beta.4), so it could not be dropped until a stable line above that floor existed. It now does. - pnpm-workspace.yaml overrides move to `^1.7.1`, with the selector bounds reshaped to the MAJOR boundary (`pkg@<2.0.0`) so a future advisory lift moves only the target — the shape the file's own header mandates. This retires the better-auth carve-out in the drift note. - plugin-auth's direct declarations move to `^1.7.1` in lockstep (overrides do not ship with published packages; check:override-consistency holds them). - @better-auth/scim stays at 1.7.0-rc.1. Measured against the published 1.7.1 tarball, stable ships the rc.2 REWRITE — no scimProvider model, no generate-token endpoint, and all six new models present — so moving it is the ADR-0071 migration tracked by #3653, not this bump. rc.1 is above the advisory fix floor and its peer ranges accept the stable 1.7.1 core. Refs #3002 --- packages/plugins/plugin-auth/package.json | 8 +- pnpm-lock.yaml | 218 +++++++++++----------- pnpm-workspace.yaml | 107 ++++++----- 3 files changed, 182 insertions(+), 151 deletions(-) diff --git a/packages/plugins/plugin-auth/package.json b/packages/plugins/plugin-auth/package.json index 5f85c2494d..997d2e6b56 100644 --- a/packages/plugins/plugin-auth/package.json +++ b/packages/plugins/plugin-auth/package.json @@ -24,17 +24,17 @@ "typecheck": "tsc --noEmit" }, "dependencies": { - "@better-auth/core": "1.7.0-rc.2", - "@better-auth/oauth-provider": "1.7.0-rc.2", + "@better-auth/core": "^1.7.1", + "@better-auth/oauth-provider": "^1.7.1", "@better-auth/scim": "1.7.0-rc.1", - "@better-auth/sso": "1.7.0-rc.2", + "@better-auth/sso": "^1.7.1", "@noble/hashes": "^2.3.0", "@objectstack/core": "workspace:*", "@objectstack/platform-objects": "workspace:*", "@objectstack/rest": "workspace:*", "@objectstack/spec": "workspace:*", "@objectstack/types": "workspace:*", - "better-auth": "1.7.0-rc.2", + "better-auth": "^1.7.1", "jose": "^6.2.8" }, "devDependencies": { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 0682a03e79..fc016c0ab9 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -10,17 +10,17 @@ overrides: tar@>=2.0.0 <8.0.0: ^7.5.11 form-data@<5.0.0: '>=4.0.6' undici@>=7.23.0 <8.0.0: ^7.29.0 - better-auth@<1.7.0-rc.2: 1.7.0-rc.2 - '@better-auth/core@<1.7.0-rc.2': 1.7.0-rc.2 + better-auth@<2.0.0: ^1.7.1 + '@better-auth/core@<2.0.0': ^1.7.1 '@better-auth/scim@<1.7.0-rc.1': 1.7.0-rc.1 - '@better-auth/oauth-provider@<1.7.0-rc.2': 1.7.0-rc.2 - '@better-auth/sso@<1.7.0-rc.2': 1.7.0-rc.2 - '@better-auth/drizzle-adapter@<1.7.0-rc.2': 1.7.0-rc.2 - '@better-auth/kysely-adapter@<1.7.0-rc.2': 1.7.0-rc.2 - '@better-auth/memory-adapter@<1.7.0-rc.2': 1.7.0-rc.2 - '@better-auth/mongo-adapter@<1.7.0-rc.2': 1.7.0-rc.2 - '@better-auth/prisma-adapter@<1.7.0-rc.2': 1.7.0-rc.2 - '@better-auth/telemetry@<1.7.0-rc.2': 1.7.0-rc.2 + '@better-auth/oauth-provider@<2.0.0': ^1.7.1 + '@better-auth/sso@<2.0.0': ^1.7.1 + '@better-auth/drizzle-adapter@<2.0.0': ^1.7.1 + '@better-auth/kysely-adapter@<2.0.0': ^1.7.1 + '@better-auth/memory-adapter@<2.0.0': ^1.7.1 + '@better-auth/mongo-adapter@<2.0.0': ^1.7.1 + '@better-auth/prisma-adapter@<2.0.0': ^1.7.1 + '@better-auth/telemetry@<2.0.0': ^1.7.1 uuid@<12.0.0: ^11.1.1 postcss@<9.0.0: ^8.5.10 cookie@<0.8.0: ^0.7.0 @@ -1479,17 +1479,17 @@ importers: packages/plugins/plugin-auth: dependencies: '@better-auth/core': - specifier: 1.7.0-rc.2 - version: 1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) + specifier: ^1.7.1 + version: 1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) '@better-auth/oauth-provider': - specifier: 1.7.0-rc.2 - version: 1.7.0-rc.2(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-auth@1.7.0-rc.2(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.1(@types/node@26.1.2))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.1.2)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.8(@typescript-eslint/types@8.65.0))(vitest@4.1.10))(better-call@1.3.7(zod@4.4.3)) + specifier: ^1.7.1 + version: 1.7.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-auth@1.7.1(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.1(@types/node@26.1.2))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.1.2)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.8(@typescript-eslint/types@8.65.0))(vitest@4.1.10))(better-call@1.4.0(zod@4.4.3)) '@better-auth/scim': specifier: 1.7.0-rc.1 - version: 1.7.0-rc.1(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(better-auth@1.7.0-rc.2(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.1(@types/node@26.1.2))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.1.2)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.8(@typescript-eslint/types@8.65.0))(vitest@4.1.10))(better-call@1.3.7(zod@4.4.3)) + version: 1.7.0-rc.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(better-auth@1.7.1(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.1(@types/node@26.1.2))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.1.2)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.8(@typescript-eslint/types@8.65.0))(vitest@4.1.10))(better-call@1.4.0(zod@4.4.3)) '@better-auth/sso': - specifier: 1.7.0-rc.2 - version: 1.7.0-rc.2(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-auth@1.7.0-rc.2(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.1(@types/node@26.1.2))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.1.2)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.8(@typescript-eslint/types@8.65.0))(vitest@4.1.10))(better-call@1.3.7(zod@4.4.3)) + specifier: ^1.7.1 + version: 1.7.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-auth@1.7.1(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.1(@types/node@26.1.2))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.1.2)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.8(@typescript-eslint/types@8.65.0))(vitest@4.1.10))(better-call@1.4.0(zod@4.4.3)) '@noble/hashes': specifier: ^2.3.0 version: 2.3.0 @@ -1509,8 +1509,8 @@ importers: specifier: workspace:* version: link:../../types better-auth: - specifier: 1.7.0-rc.2 - version: 1.7.0-rc.2(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.1(@types/node@26.1.2))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.1.2)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.8(@typescript-eslint/types@8.65.0))(vitest@4.1.10) + specifier: ^1.7.1 + version: 1.7.1(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.1(@types/node@26.1.2))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.1.2)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.8(@typescript-eslint/types@8.65.0))(vitest@4.1.10) jose: specifier: ^6.2.8 version: 6.2.8 @@ -2958,14 +2958,14 @@ packages: resolution: {integrity: sha512-6zABk/ECA/QYSCQ1NGiVwwbQerUCZ+TQbp64Q3AgmfNvurHH0j8TtXa1qbShXA6qqkpAj4V5W8pP6mLe1mcMqA==} engines: {node: '>=18'} - '@better-auth/core@1.7.0-rc.2': - resolution: {integrity: sha512-NreNGg68j4qUVVYTcC1DtvRTwSJdCavH5igrMyTO5ghZxnzL4G539uRIzOZmJ64MLzOyOwzWH+JHqpVaj0ZRxw==} + '@better-auth/core@1.7.1': + resolution: {integrity: sha512-eZ9lqcnVLMZ3QtUByRo4VZqkB1ESyRddd9NfWjBdDPgh+jcwLScoIUAqhtHLR8zaSUJZah8OLGlkzObyPdUH7A==} peerDependencies: '@better-auth/utils': 0.4.2 '@better-fetch/fetch': 1.3.1 '@cloudflare/workers-types': '>=4' '@opentelemetry/api': ^1.9.0 - better-call: 1.3.7 + better-call: 1.4.0 jose: ^6.1.0 kysely: ^0.28.5 || ^0.29.0 nanostores: ^1.0.1 @@ -2975,55 +2975,55 @@ packages: '@opentelemetry/api': optional: true - '@better-auth/drizzle-adapter@1.7.0-rc.2': - resolution: {integrity: sha512-o6HCC8PCyvg1/BQaNWvJM7kO8svXWvuM++APj7ah+iEfFWcp0yklNQWLijDLu+PAaoKHwNMgDpmclDruirHdPA==} + '@better-auth/drizzle-adapter@1.7.1': + resolution: {integrity: sha512-qlqNyg5V9bXHSP68/vtlsiZayhR4hgvEGiS/E3SIj8bCpWWFGmyQkxJbQCqpBmC7vT30wE/kNtJMHIgnV3rkiw==} peerDependencies: - '@better-auth/core': ^1.7.0-rc.2 + '@better-auth/core': ^1.7.1 '@better-auth/utils': 0.4.2 drizzle-orm: ^0.45.2 || >=1.0.0-rc.1 <2.0.0 peerDependenciesMeta: drizzle-orm: optional: true - '@better-auth/kysely-adapter@1.7.0-rc.2': - resolution: {integrity: sha512-g65JeOOseffsqHJXOM0/+SdPvojXzFPejVEFKuUatkdfXcw/l0zEiEkH38Ag5SWFaqfvog/wRPY/MK8PC/ODvg==} + '@better-auth/kysely-adapter@1.7.1': + resolution: {integrity: sha512-yWCpE1cZpMUj37nD6JFDK+GDR8zS37L5WI73il3qbU9TXtWsxUQKc/5c3IHsHizWQsmcQI8uv2pAFKxsRDa+AQ==} peerDependencies: - '@better-auth/core': ^1.7.0-rc.2 + '@better-auth/core': ^1.7.1 '@better-auth/utils': 0.4.2 kysely: ^0.28.17 || ^0.29.0 peerDependenciesMeta: kysely: optional: true - '@better-auth/memory-adapter@1.7.0-rc.2': - resolution: {integrity: sha512-ACP69pbSDnIYYcx/KEtRXpFmte6q0Adh3028pRP5aDydkmbcCc7cFiwnRMQuI/MY7aBfW0wefEbcEwOse61Hcg==} + '@better-auth/memory-adapter@1.7.1': + resolution: {integrity: sha512-6NX1yv88DeqdoG7owYFqKwlrDGaIPhsC52JUGrUgeGVKyOq8a/6hHlHsqG1C2FwT23SHQiKVYCEAG9N6aH5OvQ==} peerDependencies: - '@better-auth/core': ^1.7.0-rc.2 + '@better-auth/core': ^1.7.1 '@better-auth/utils': 0.4.2 - '@better-auth/mongo-adapter@1.7.0-rc.2': - resolution: {integrity: sha512-/QeC23KheruIamhu4XIqtPLcvupoDXmSpPB9QvmVqQcb5oVjAILJo6kIbZtq/JYbaHjrIO7mpdH6404hyv7weg==} + '@better-auth/mongo-adapter@1.7.1': + resolution: {integrity: sha512-9ILTcNqhG37QK//qR4UhYLyKzNqq6w6zVTf5KX6xkiTjNcV7Oh1yS31lkIJEVTqRNcy9AoV6FZMW6Bbsm8IMDA==} peerDependencies: - '@better-auth/core': ^1.7.0-rc.2 + '@better-auth/core': ^1.7.1 '@better-auth/utils': 0.4.2 mongodb: ^6.0.0 || ^7.0.0 peerDependenciesMeta: mongodb: optional: true - '@better-auth/oauth-provider@1.7.0-rc.2': - resolution: {integrity: sha512-fc3jCYwS/PaQyErOPqIUplqK456zhrmNWGnJPhDEF68merXBQN1OodUTzicZ3skFDpAv6MY3m5vk4D1Gz3R/oA==} + '@better-auth/oauth-provider@1.7.1': + resolution: {integrity: sha512-VWIw7ti6rodlbbdSbn0mts/TZcBWUj6YaoIpREmv70eoGmWTa6MPWEbGuUdADQe3Vy4YqysIbmQA6qgRqfLTaw==} peerDependencies: - '@better-auth/core': ^1.7.0-rc.2 + '@better-auth/core': ^1.7.1 '@better-auth/utils': 0.4.2 '@better-fetch/fetch': 1.3.1 - better-auth: ^1.7.0-rc.2 - better-call: 1.3.7 + better-auth: ^1.7.1 + better-call: 1.4.0 - '@better-auth/prisma-adapter@1.7.0-rc.2': - resolution: {integrity: sha512-OFRJbg44ha2zD5lpXIKfoGBEwPe58YBhwIgKlfRuHpsZSpknaXOTvFIH2da8q8SK5L5mjYQ9vSsnX0oOf8gNDA==} + '@better-auth/prisma-adapter@1.7.1': + resolution: {integrity: sha512-ZiUcafQ85InAofcUjyGgCPjKLfQjXr9SvDmMjuFUW8oEbreA6C6GaFAEA77VuV2doZUQlzvQQ4gCoTmS28W92A==} peerDependencies: - '@better-auth/core': ^1.7.0-rc.2 + '@better-auth/core': ^1.7.1 '@better-auth/utils': 0.4.2 '@prisma/client': ^5.0.0 || ^6.0.0 || ^7.0.0 prisma: ^5.0.0 || ^6.0.0 || ^7.0.0 @@ -3036,30 +3036,33 @@ packages: '@better-auth/scim@1.7.0-rc.1': resolution: {integrity: sha512-pcnliU2eewYq2SF4cRDn1XvQ2I7+WhufoDv5lx9yH7fmrfsU6mYQpZX3mu2Fj/AFCHauCI7Ld617pnz5+yTtOw==} peerDependencies: - '@better-auth/core': 1.7.0-rc.2 + '@better-auth/core': ^1.7.1 '@better-auth/utils': 0.4.2 - better-auth: 1.7.0-rc.2 + better-auth: ^1.7.1 better-call: 1.3.7 - '@better-auth/sso@1.7.0-rc.2': - resolution: {integrity: sha512-vn+WjTNMYWKX/jrrSCekv8Aia7uuhBlFcgUcwJpbSxCvD67uyNhN0W48ob+NKKY2vlT4nrDVESP2csxUXyUmtw==} + '@better-auth/sso@1.7.1': + resolution: {integrity: sha512-fkGNMO8W5uNJSHAlvSe4Gxm1NVTQT4JFS7JpCNIxUAl5UyskE1yFXc2NH0KjcvSbR1RfgrqUgUevOjOjcSUKcg==} peerDependencies: - '@better-auth/core': ^1.7.0-rc.2 + '@better-auth/core': ^1.7.1 '@better-auth/utils': 0.4.2 '@better-fetch/fetch': 1.3.1 - better-auth: ^1.7.0-rc.2 - better-call: 1.3.7 + better-auth: ^1.7.1 + better-call: 1.4.0 - '@better-auth/telemetry@1.7.0-rc.2': - resolution: {integrity: sha512-sSZ+/FkG/axBjXVeF01LT+NQjT23TLwRwpdkcI8FJBWINNUCYhuxgdi05dv70MeX8iocfMhKxQ4EPgvt/eW/kQ==} + '@better-auth/telemetry@1.7.1': + resolution: {integrity: sha512-kLKjMfFlTbyt49DGeI9okHAsn0MtBZcMoQYKaEdgR0H3BHzqqyzePcQz/hxAmRgjB4p/6inise3zJwhX0sgXrQ==} peerDependencies: - '@better-auth/core': ^1.7.0-rc.2 + '@better-auth/core': ^1.7.1 '@better-auth/utils': 0.4.2 '@better-fetch/fetch': 1.3.1 '@better-auth/utils@0.4.2': resolution: {integrity: sha512-AUxrvu+HaaODsUyzDxFgwd/8RZ1yZaYo42LXKSrU2oGgR38pS1ij8nqQKNgtTWoYGpNevNXtCfgTy6loHveW9A==} + '@better-auth/utils@0.5.0': + resolution: {integrity: sha512-BL8W4EfIZFwlu0r54m3v1ztjDhu6dDe/amLTm0xybmbZaNgYUqhD3SjpAsnq0q8YD6/ki4iwIgxJNLP/N3TxiA==} + '@better-fetch/fetch@1.3.1': resolution: {integrity: sha512-ABkD1WhyfPZprKRQI3bhATjeiFuNWC9PXhfGWqL+sg/gKrM977oFrYkdb4msM3hgUGonr7KlOsOFT5TU2rht9g==} @@ -4026,10 +4029,6 @@ packages: cpu: [x64] os: [win32] - '@noble/ciphers@2.2.0': - resolution: {integrity: sha512-Z6pjIZ/8IJcCGzb2S/0Px5J81yij85xASuk1teLNeg75bfT07MV3a/O2Mtn1I2se43k3lkVEcFaR10N4cgQcZA==} - engines: {node: '>= 20.19.0'} - '@noble/ciphers@2.3.0': resolution: {integrity: sha512-Clu/xdfgVTf9o7ngLOURaxePwR0j8sjclKEtVij10/jGulwFsPWCvvRgG/XjUVf8Nei+jLG6uwyXzUTGY1DQrw==} engines: {node: '>= 20.19.0'} @@ -5217,6 +5216,10 @@ packages: engines: {node: '>=10.0.0'} deprecated: this version has critical issues, please update to the latest version + '@xmldom/xmldom@0.9.11': + resolution: {integrity: sha512-tW8bcK3hsG0/uqSnNz6TK4BkcuZSezoU7DlnYssILmZDktPnSHHuDJJFM0AJv+13gz2r0iGdrj6qqKeUnxXEDg==} + engines: {node: '>=14.6'} + '@yuku-analyzer/binding-android-arm64@0.8.7': resolution: {integrity: sha512-pzJ++UMCZEV4s6SP3Ryvj+snWP8s7aTXFkSXRyeBF4RSALftPzfqYssHdGOmOH2QnRAtyOhhg64tdjeSGJvYRg==} cpu: [arm64] @@ -5468,8 +5471,8 @@ packages: engines: {node: '>=6.0.0'} hasBin: true - better-auth@1.7.0-rc.2: - resolution: {integrity: sha512-5KZrqbAsoQA8q1edmufaoF/CBbMjGb/BoPqyMTzXFyDeXNhk8pXO2xJkiDDeZcSGtyhUKXiDnD7hxh4sJVgYZw==} + better-auth@1.7.1: + resolution: {integrity: sha512-g8WlTQijxXWJjPVZfFu1+EJg9cwwHrKDmIkcYMzx8CzYA+tDxl6NI7qQbKkbgw5UtHILsT5VH+RMzFzwnVJqAg==} peerDependencies: '@lynx-js/react': '*' '@prisma/client': ^5.0.0 || ^6.0.0 || ^7.0.0 @@ -5478,7 +5481,7 @@ packages: '@tanstack/solid-start': ^1.0.0 better-sqlite3: ^12.0.0 drizzle-kit: '>=0.31.4 || >=1.0.0-beta.1' - drizzle-orm: ^0.45.2 + drizzle-orm: ^0.45.2 || >=1.0.0-rc.1 <2.0.0 mongodb: ^6.0.0 || ^7.0.0 mysql2: ^3.0.0 next: ^14.0.0 || ^15.0.0 || ^16.0.0 @@ -5530,8 +5533,8 @@ packages: vue: optional: true - better-call@1.3.7: - resolution: {integrity: sha512-Al51/hjp2SSp6CRTa3F2ptcx4yQVS1xWKoY6jcVXqNYOap6mHFP2jUBn5EwIL4iIed1/Sq4hlQ+Umm6EflZG+w==} + better-call@1.4.0: + resolution: {integrity: sha512-bBKOT4vv1kZLDgxVePdilk/Jwkn+dtRRsmi3DzHcDP+WnswyVl6dR59l2HEeP/0cB+bDoopASAesWDPIdd/zZA==} peerDependencies: zod: ^4.0.0 peerDependenciesMeta: @@ -8282,8 +8285,8 @@ packages: engines: {node: '>=18.0.0', npm: '>=8.0.0'} hasBin: true - rou3@0.7.12: - resolution: {integrity: sha512-iFE4hLDuloSWcD7mjdCDhx2bKcIsYbtOTpfH5MHHLSKMOUyjqQXTeZVa289uuwEGEKFoE/BAPbhaU4B774nceg==} + rou3@0.9.2: + resolution: {integrity: sha512-3SOzvaAg8rkHrXtRjpCvCvbyO5to9oOO27Z/XqHEYXfMRVSw/qMIVdmaOk9W2lcRLtR6dlqTjo9hDeJk70QBYQ==} roughjs@4.6.6: resolution: {integrity: sha512-ZUz/69+SYpFN/g/lUlo2FXcIjRkSu3nDarreVdGGndHEBJ6cXPdKguS8JGxwj5HA5xIbVKSmLgr5b3AWxtRfvQ==} @@ -9482,13 +9485,13 @@ snapshots: '@bcoe/v8-coverage@1.0.2': {} - '@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0)': + '@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0)': dependencies: '@better-auth/utils': 0.4.2 '@better-fetch/fetch': 1.3.1 '@opentelemetry/semantic-conventions': 1.43.0 '@standard-schema/spec': 1.1.0 - better-call: 1.3.7(zod@4.4.3) + better-call: 1.4.0(zod@4.4.3) jose: 6.2.8 kysely: 0.29.4 nanostores: 1.4.0 @@ -9497,69 +9500,70 @@ snapshots: '@cloudflare/workers-types': 4.20260520.1 '@opentelemetry/api': 1.9.1 - '@better-auth/drizzle-adapter@1.7.0-rc.2(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)': + '@better-auth/drizzle-adapter@1.7.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)': dependencies: - '@better-auth/core': 1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) + '@better-auth/core': 1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) '@better-auth/utils': 0.4.2 - '@better-auth/kysely-adapter@1.7.0-rc.2(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(kysely@0.29.4)': + '@better-auth/kysely-adapter@1.7.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(kysely@0.29.4)': dependencies: - '@better-auth/core': 1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) + '@better-auth/core': 1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) '@better-auth/utils': 0.4.2 optionalDependencies: kysely: 0.29.4 - '@better-auth/memory-adapter@1.7.0-rc.2(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)': + '@better-auth/memory-adapter@1.7.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)': dependencies: - '@better-auth/core': 1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) + '@better-auth/core': 1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) '@better-auth/utils': 0.4.2 - '@better-auth/mongo-adapter@1.7.0-rc.2(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(mongodb@7.5.0(socks@2.8.9))': + '@better-auth/mongo-adapter@1.7.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(mongodb@7.5.0(socks@2.8.9))': dependencies: - '@better-auth/core': 1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) + '@better-auth/core': 1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) '@better-auth/utils': 0.4.2 optionalDependencies: mongodb: 7.5.0(socks@2.8.9) - '@better-auth/oauth-provider@1.7.0-rc.2(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-auth@1.7.0-rc.2(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.1(@types/node@26.1.2))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.1.2)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.8(@typescript-eslint/types@8.65.0))(vitest@4.1.10))(better-call@1.3.7(zod@4.4.3))': + '@better-auth/oauth-provider@1.7.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-auth@1.7.1(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.1(@types/node@26.1.2))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.1.2)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.8(@typescript-eslint/types@8.65.0))(vitest@4.1.10))(better-call@1.4.0(zod@4.4.3))': dependencies: - '@better-auth/core': 1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) + '@better-auth/core': 1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) '@better-auth/utils': 0.4.2 '@better-fetch/fetch': 1.3.1 - better-auth: 1.7.0-rc.2(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.1(@types/node@26.1.2))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.1.2)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.8(@typescript-eslint/types@8.65.0))(vitest@4.1.10) - better-call: 1.3.7(zod@4.4.3) + better-auth: 1.7.1(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.1(@types/node@26.1.2))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.1.2)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.8(@typescript-eslint/types@8.65.0))(vitest@4.1.10) + better-call: 1.4.0(zod@4.4.3) jose: 6.2.8 zod: 4.4.3 - '@better-auth/prisma-adapter@1.7.0-rc.2(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)': + '@better-auth/prisma-adapter@1.7.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)': dependencies: - '@better-auth/core': 1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) + '@better-auth/core': 1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) '@better-auth/utils': 0.4.2 - '@better-auth/scim@1.7.0-rc.1(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(better-auth@1.7.0-rc.2(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.1(@types/node@26.1.2))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.1.2)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.8(@typescript-eslint/types@8.65.0))(vitest@4.1.10))(better-call@1.3.7(zod@4.4.3))': + '@better-auth/scim@1.7.0-rc.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(better-auth@1.7.1(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.1(@types/node@26.1.2))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.1.2)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.8(@typescript-eslint/types@8.65.0))(vitest@4.1.10))(better-call@1.4.0(zod@4.4.3))': dependencies: - '@better-auth/core': 1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) + '@better-auth/core': 1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) '@better-auth/utils': 0.4.2 - better-auth: 1.7.0-rc.2(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.1(@types/node@26.1.2))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.1.2)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.8(@typescript-eslint/types@8.65.0))(vitest@4.1.10) - better-call: 1.3.7(zod@4.4.3) + better-auth: 1.7.1(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.1(@types/node@26.1.2))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.1.2)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.8(@typescript-eslint/types@8.65.0))(vitest@4.1.10) + better-call: 1.4.0(zod@4.4.3) zod: 4.4.3 - '@better-auth/sso@1.7.0-rc.2(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-auth@1.7.0-rc.2(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.1(@types/node@26.1.2))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.1.2)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.8(@typescript-eslint/types@8.65.0))(vitest@4.1.10))(better-call@1.3.7(zod@4.4.3))': + '@better-auth/sso@1.7.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-auth@1.7.1(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.1(@types/node@26.1.2))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.1.2)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.8(@typescript-eslint/types@8.65.0))(vitest@4.1.10))(better-call@1.4.0(zod@4.4.3))': dependencies: - '@better-auth/core': 1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) + '@better-auth/core': 1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) '@better-auth/utils': 0.4.2 '@better-fetch/fetch': 1.3.1 - better-auth: 1.7.0-rc.2(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.1(@types/node@26.1.2))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.1.2)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.8(@typescript-eslint/types@8.65.0))(vitest@4.1.10) - better-call: 1.3.7(zod@4.4.3) + '@xmldom/xmldom': 0.9.11 + better-auth: 1.7.1(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.1(@types/node@26.1.2))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.1.2)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.8(@typescript-eslint/types@8.65.0))(vitest@4.1.10) + better-call: 1.4.0(zod@4.4.3) fast-xml-parser: 5.10.1 jose: 6.2.8 samlify: 2.13.1 tldts: 7.4.9 zod: 4.4.3 - '@better-auth/telemetry@1.7.0-rc.2(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)': + '@better-auth/telemetry@1.7.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)': dependencies: - '@better-auth/core': 1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) + '@better-auth/core': 1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) '@better-auth/utils': 0.4.2 '@better-fetch/fetch': 1.3.1 @@ -9567,6 +9571,10 @@ snapshots: dependencies: '@noble/hashes': 2.3.0 + '@better-auth/utils@0.5.0': + dependencies: + '@noble/hashes': 2.3.0 + '@better-fetch/fetch@1.3.1': {} '@braintree/sanitize-url@7.1.2': {} @@ -10402,8 +10410,6 @@ snapshots: '@next/swc-win32-x64-msvc@16.3.1': optional: true - '@noble/ciphers@2.2.0': {} - '@noble/ciphers@2.3.0': {} '@noble/hashes@2.3.0': {} @@ -11566,6 +11572,8 @@ snapshots: '@xmldom/xmldom@0.8.13': {} + '@xmldom/xmldom@0.9.11': {} + '@yuku-analyzer/binding-android-arm64@0.8.7': optional: true @@ -11775,20 +11783,20 @@ snapshots: baseline-browser-mapping@2.11.14: {} - better-auth@1.7.0-rc.2(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.1(@types/node@26.1.2))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.1.2)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.8(@typescript-eslint/types@8.65.0))(vitest@4.1.10): + better-auth@1.7.1(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.1(@types/node@26.1.2))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.1.2)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.8(@typescript-eslint/types@8.65.0))(vitest@4.1.10): dependencies: - '@better-auth/core': 1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) - '@better-auth/drizzle-adapter': 1.7.0-rc.2(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2) - '@better-auth/kysely-adapter': 1.7.0-rc.2(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(kysely@0.29.4) - '@better-auth/memory-adapter': 1.7.0-rc.2(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2) - '@better-auth/mongo-adapter': 1.7.0-rc.2(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(mongodb@7.5.0(socks@2.8.9)) - '@better-auth/prisma-adapter': 1.7.0-rc.2(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2) - '@better-auth/telemetry': 1.7.0-rc.2(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1) + '@better-auth/core': 1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) + '@better-auth/drizzle-adapter': 1.7.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2) + '@better-auth/kysely-adapter': 1.7.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(kysely@0.29.4) + '@better-auth/memory-adapter': 1.7.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2) + '@better-auth/mongo-adapter': 1.7.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(mongodb@7.5.0(socks@2.8.9)) + '@better-auth/prisma-adapter': 1.7.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2) + '@better-auth/telemetry': 1.7.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1) '@better-auth/utils': 0.4.2 '@better-fetch/fetch': 1.3.1 - '@noble/ciphers': 2.2.0 + '@noble/ciphers': 2.3.0 '@noble/hashes': 2.3.0 - better-call: 1.3.7(zod@4.4.3) + better-call: 1.4.0(zod@4.4.3) defu: 6.1.7 jose: 6.2.8 kysely: 0.29.4 @@ -11808,11 +11816,11 @@ snapshots: - '@cloudflare/workers-types' - '@opentelemetry/api' - better-call@1.3.7(zod@4.4.3): + better-call@1.4.0(zod@4.4.3): dependencies: - '@better-auth/utils': 0.4.2 + '@better-auth/utils': 0.5.0 '@better-fetch/fetch': 1.3.1 - rou3: 0.7.12 + rou3: 0.9.2 set-cookie-parser: 3.1.2 optionalDependencies: zod: 4.4.3 @@ -14975,7 +14983,7 @@ snapshots: '@rollup/rollup-win32-x64-msvc': 4.62.2 fsevents: 2.3.3 - rou3@0.7.12: {} + rou3@0.9.2: {} roughjs@4.6.6: dependencies: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index d56d7c9832..fe34a04edd 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -40,9 +40,12 @@ onlyBuiltDependencies: # because that is where semver's compatibility break actually falls. # `scripts/check-override-consistency.mjs` reports (never fails on) any entry # that drifts back into the old shape. Two carve-outs deliberately keep it: -# the better-auth pre-release family (a compat pin, not an OSV floor — it is -# retired wholesale when 1.7.0 stable ships) and the three zero-consumer pins -# awaiting a #5835-style ruling (@tootallnate/once, react-router, @sveltejs/kit). +# `@better-auth/scim` alone — the rest of the better-auth family was retired to +# the stable `^1.7.1` line with major-boundary bounds when 1.7.0 shipped (#3002), +# and scim's bound MUST stay at the pinned rc, because a `<2.0.0` bound would +# rewrite the stable release DOWN onto the rc it is deliberately held at (#3653) +# — and the three zero-consumer pins awaiting a #5835-style ruling +# (@tootallnate/once, react-router, @sveltejs/kit). # - esbuild: GHSA-gv7w-rqvm-qjhr (high). tsup/tsx/vite pulled 0.27.7 / 0.28.0 # (< 0.28.1); force the patched line everywhere. # - form-data: GHSA-hmw2-7cc7-3qxx (high) — CRLF injection via unescaped @@ -77,36 +80,52 @@ onlyBuiltDependencies: # 8.9.0 is a different major and stays outside, unaffected. Kept as # defense-in-depth on the same reasoning as form-data above. # - @better-auth/scim: GHSA-j8v8-g9cx-5qf4 (high) — account/provider -# takeover. The advisory is patched only in >=1.7.0-beta.4 — there is NO -# stable patched release yet (npm `latest` is still on the 1.6.x line), so -# a pre-release pin is what clears the CI audit gate; revert to a stable -# `^1.7.x` line the moment one ships. -# Held at 1.7.0-rc.1 while the rest of the family moves to rc.2: rc.2 is a -# ground-up rewrite of this plugin — the `scimProvider` model and its -# generate-token endpoint are gone, replaced by code-defined connections -# plus six new models (scimUser, scimGroup, scimGroupMember, scimSubject, -# scimConnectionBinding, scimIdentityTombstone). Adopting it means new -# platform objects, retiring `sys_scim_provider`, and a new way for a -# tenant to register a connection — a feature migration (ADR-0071), not a -# version bump. rc.1's peer range accepts rc.2 core, and it still carries -# the advisory fix. +# takeover, patched only in >=1.7.0-beta.4. THE ONLY MEMBER OF THE FAMILY +# STILL ON A PRE-RELEASE, and deliberately so. +# Stable 1.7.0/1.7.1 have now shipped, and measured against the published +# 1.7.1 tarball they ship the rc.2 REWRITE, not the rc.1 shape: no +# `scimProvider` model and no generate-token endpoint (0 occurrences in +# `dist/index.mjs`), replaced by code-defined connections plus six new +# models (scimUser, scimGroup, scimGroupMember, scimSubject, +# scimConnectionBinding, scimIdentityTombstone — all six present). So +# moving this pin is still the ADR-0071 feature migration tracked by #3653 +# (new platform objects, retiring `sys_scim_provider`, a new way for a +# tenant to register a connection) — NOT the version bump #3002 did for the +# rest of the family. Holding here stays security-clean: rc.1 is above the +# >=1.7.0-beta.4 fix floor, and rc.1's peer ranges (`better-auth` and +# `@better-auth/core` at `^1.7.0-rc.1`) are satisfied by the stable 1.7.1 +# the family now resolves to. +# KNOWN SKEW while this hold lasts: scim rc.1 peers `better-call@1.3.7` +# while better-auth 1.7.1 depends on `better-call@1.4.0`, so the tree +# carries two copies. Measured green on the plugin-auth suite; it retires +# with #3653. +# `scripts/check-prerelease-pin-watch.mjs` keeps watching this pin (it is +# now the only entry on its watch list) so #3653 has a producer. # - @better-auth/oauth-provider: GHSA-p2fr-6hmx-4528 — same better-auth # monorepo and same situation as @better-auth/scim above. The fix first -# ships in the 1.7.0 pre-release line. Pin to 1.7.0-rc.2. The 1.7 -# oauth-provider is exercised on the sign-in path and imports symbols -# (e.g. CLIENT_ASSERTION_TYPE) that only exist in @better-auth/core 1.7.x, -# so the ENTIRE better-auth family must move to 1.7.0-rc.2 together — -# mixing a 1.7 plugin with 1.6.x core throws "Cannot set properties of -# undefined (setting 'modelName')" during better-auth init and 500s every -# auth endpoint at runtime, and mixing rc.2 with rc.1 is the same class of -# hazard. The full family is pinned below; revert all of them to a stable -# `^1.7.x` line the moment one ships. +# shipped in the 1.7.0 pre-release line; it is now in stable 1.7.x, and +# #3002 moved this pin (and the whole family bar scim) off `1.7.0-rc.2` +# onto `^1.7.1` — npm `latest` for every family member is 1.7.1, verified +# by `npm view dist-tags`. The 1.7 oauth-provider is exercised on the +# sign-in path and imports symbols (e.g. CLIENT_ASSERTION_TYPE) that only +# exist in @better-auth/core 1.7.x, so the ENTIRE family must stay on ONE +# line — mixing a 1.7 plugin with 1.6.x core throws "Cannot set properties +# of undefined (setting 'modelName')" during better-auth init and 500s +# every auth endpoint at runtime. That is now cheap to hold: `better-auth` +# itself declares EXACT dependencies on the rest of the family +# (`@better-auth/core`, the five adapters, telemetry all at 1.7.1), so one +# stable range on the root drags the family with it. +# The pins are kept rather than dropped because two of them +# (oauth-provider, scim) are OSV floors: a transitive reintroduction must +# land on the patched line, and dropping a security pin is its own +# decision, not a rider on a version bump (same reasoning as form-data / +# undici above). # IMPORTANT: these overrides do NOT ship with published packages — a # downstream `npx create-objectstack` install resolves plugin-auth's own -# declared ranges. plugin-auth therefore pins the same exact 1.7.0-rc.2 in -# its dependencies (a `^1.6.23` range there resolved to the broken 1.6.23 -# mix and 500'd every fresh 15.1.0 project). Keep both in sync — CI -# enforces this via scripts/check-override-consistency.mjs. +# declared ranges. plugin-auth therefore declares the same `^1.7.1` in its +# dependencies (a `^1.6.23` range there resolved to the broken 1.6.23 mix +# and 500'd every fresh 15.1.0 project). Keep both in sync — CI enforces +# this via scripts/check-override-consistency.mjs. # - uuid: GHSA-w5hq-g745-h8pq (high) — pulled 8.3.2 transitively; the fix # first lands in 11.1.1. Pin to the ^11.1.1 LTS line (uuid `legacy-11` # dist-tag) rather than the latest major to keep the jump conservative. @@ -132,20 +151,24 @@ overrides: 'form-data@<5.0.0': '>=4.0.6' 'undici@>=7.23.0 <8.0.0': '^7.29.0' # better-auth family — kept on one line (see @better-auth/oauth-provider note). - 'better-auth@<1.7.0-rc.2': '1.7.0-rc.2' - '@better-auth/core@<1.7.0-rc.2': '1.7.0-rc.2' - # scim is deliberately held one pre-release BEHIND the rest of the family — - # see the @better-auth/scim note above. Do not "align" it without doing the - # connection/credential migration first. + # Off the 1.7.0-rc.2 prerelease and onto the stable line (#3002). Bounds sit + # at the MAJOR boundary, so a future advisory lift moves only the target. + 'better-auth@<2.0.0': '^1.7.1' + '@better-auth/core@<2.0.0': '^1.7.1' + # scim is deliberately held on the 1.7.0-rc.1 PRE-RELEASE, one line behind the + # rest of the family — see the @better-auth/scim note above. Stable 1.7.x + # ships the rc.2 rewrite, so adopting it is the ADR-0071 migration (#3653), + # not this bump. Its bound stays AT the rc on purpose: a major-boundary bound + # here would rewrite the stable release down onto the rc. '@better-auth/scim@<1.7.0-rc.1': '1.7.0-rc.1' - '@better-auth/oauth-provider@<1.7.0-rc.2': '1.7.0-rc.2' - '@better-auth/sso@<1.7.0-rc.2': '1.7.0-rc.2' - '@better-auth/drizzle-adapter@<1.7.0-rc.2': '1.7.0-rc.2' - '@better-auth/kysely-adapter@<1.7.0-rc.2': '1.7.0-rc.2' - '@better-auth/memory-adapter@<1.7.0-rc.2': '1.7.0-rc.2' - '@better-auth/mongo-adapter@<1.7.0-rc.2': '1.7.0-rc.2' - '@better-auth/prisma-adapter@<1.7.0-rc.2': '1.7.0-rc.2' - '@better-auth/telemetry@<1.7.0-rc.2': '1.7.0-rc.2' + '@better-auth/oauth-provider@<2.0.0': '^1.7.1' + '@better-auth/sso@<2.0.0': '^1.7.1' + '@better-auth/drizzle-adapter@<2.0.0': '^1.7.1' + '@better-auth/kysely-adapter@<2.0.0': '^1.7.1' + '@better-auth/memory-adapter@<2.0.0': '^1.7.1' + '@better-auth/mongo-adapter@<2.0.0': '^1.7.1' + '@better-auth/prisma-adapter@<2.0.0': '^1.7.1' + '@better-auth/telemetry@<2.0.0': '^1.7.1' 'uuid@<12.0.0': '^11.1.1' 'postcss@<9.0.0': '^8.5.10' 'cookie@<0.8.0': '^0.7.0' From c9a19be470c64bc298b430bf340755955069c79e Mon Sep 17 00:00:00 2001 From: os-warren Date: Wed, 19 Aug 2026 05:53:10 +0000 Subject: [PATCH 2/5] =?UTF-8?q?fix(auth):=20absorb=20the=20rc.2=20?= =?UTF-8?q?=E2=86=92=20stable=201.7=20vendor=20drift=20on=20the=20auth=20s?= =?UTF-8?q?urface?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Moving to stable 1.7.1 surfaced three pieces of upstream drift that the pinned rc.2 did not have. All three were caught by the repo's own drift gates, and all three are mechanical parity — no behaviour is authored here. 1. THE ACCOUNT ID FIELD FLIP-FLOPPED. `1.7.0-rc.2` renamed `account.accountId` → `providerAccountId`; stable 1.7.0/1.7.1 renamed it BACK to `accountId`, keeping the new required `issuer`. Measured on the installed 1.7.1: `getAuthTables({}).account.fields` = `issuer, accountId, providerId, userId, …` with no `providerAccountId` at all. Carrying the rc.2 spelling left `accountId` unmapped, so the adapter asked for a column of that name and EVERY sign-up answered 500 `Unknown field 'accountId' on object 'sys_account'`. The `account_id` column is unchanged and no data moves. Fixed in the schema mapping, in the `createAccount` call in admin-user-endpoints, in the two mapping pin tests, and in the client's `/list-accounts` response type. 2. `@better-auth/oauth-provider` 1.7.1's `oauthClient` model writes three fields the platform object did not answer for: `applicationType` (the OIDC spelling of what rc.2 called `type` — mapped onto the EXISTING `type` column, so no data moves), plus genuinely new `clientDiscoveryId` and `clientCredentialsScopes`, now declared on `sys_oauth_application`. Without these, `POST /oauth2/register` 500s at the driver. 3. Two new endpoints are mounted publicly by the catch-all: `POST /oauth2/end-session` and `POST /oauth2/end-session/confirm` — the POST form of OIDC RP-initiated logout, whose GET counterpart was already ledgered. Added to BETTER_AUTH_MOUNTED_SURFACE with that rationale. Also re-points the #5024 prerelease-pin probe at the state this leaves behind: `@better-auth/scim` is the only prerelease pin left, so its follow-up ledger names #3653 (the ADR-0071 migration) alone rather than a card this PR closes. plugin-auth: 55 files, 1263 tests, all passing. tsc --noEmit clean. Refs #3002 --- packages/client/src/index.ts | 10 +++- .../src/identity/sys-account.object.ts | 4 +- .../identity/sys-oauth-application.object.ts | 26 +++++++++ .../src/account-issuer-parity.test.ts | 2 +- .../plugin-auth/src/admin-user-endpoints.ts | 12 ++-- .../plugin-auth/src/auth-manager.test.ts | 7 ++- .../plugins/plugin-auth/src/auth-plugin.ts | 2 +- .../plugin-auth/src/auth-route-ledger.ts | 7 +++ .../plugin-auth/src/auth-schema-config.ts | 57 +++++++++++++++---- .../src/backfill-account-issuer.ts | 5 +- .../plugin-auth/src/objectql-adapter.test.ts | 10 ++-- ...se-demo-personas-loginable.dogfood.test.ts | 2 +- scripts/check-prerelease-pin-watch.mjs | 49 +++++++++------- 13 files changed, 138 insertions(+), 55 deletions(-) diff --git a/packages/client/src/index.ts b/packages/client/src/index.ts index b101435868..6c28d59434 100644 --- a/packages/client/src/index.ts +++ b/packages/client/src/index.ts @@ -2788,10 +2788,14 @@ export class ObjectStackClient { return { accounts: accounts as Array<{ id: string; providerId: string; - /** Authority that vouched for `providerAccountId` — an OIDC issuer, or `local:…`. */ + /** Authority that vouched for `accountId` — an OIDC issuer, or `local:…`. */ issuer: string; - /** The user's id at the provider — better-auth 1.7 renamed this from `accountId`. */ - providerAccountId: string; + /** + * The user's id at the provider. `1.7.0-rc.2` briefly published this + * as `providerAccountId`; stable 1.7 answers with `accountId` again + * (#3002), which is what this route returns today. + */ + accountId: string; createdAt?: string; updatedAt?: string; }> }; diff --git a/packages/platform-objects/src/identity/sys-account.object.ts b/packages/platform-objects/src/identity/sys-account.object.ts index 9dd7e12994..852c6598f8 100644 --- a/packages/platform-objects/src/identity/sys-account.object.ts +++ b/packages/platform-objects/src/identity/sys-account.object.ts @@ -35,7 +35,7 @@ export const SysAccount = ObjectSchema.create({ // this, where `accountId` is the account ROW id (better-auth 1.7 narrowed // the body from the old `{ providerId, accountId }` pair, and `accountId` // no longer means the provider's id for the user — that field is now - // `providerAccountId`). The form is locked to the row's values so it acts + // `accountId`). The form is locked to the row's values so it acts // as a one-click confirmation rather than a free-form edit. // // `link_social` is the self-service counterpart — a toolbar action @@ -306,7 +306,7 @@ export const SysAccount = ObjectSchema.create({ indexes: [ { fields: ['user_id'], unique: false }, { fields: ['provider_id', 'account_id'], unique: true }, - // better-auth 1.7 resolves accounts by (issuer, providerAccountId) and + // better-auth 1.7 resolves accounts by (issuer, accountId) and // declares that pair unique on its own `account` table — mirror it here so // the physical table enforces the same identity key the auth code assumes. { fields: ['issuer', 'account_id'], unique: true }, diff --git a/packages/platform-objects/src/identity/sys-oauth-application.object.ts b/packages/platform-objects/src/identity/sys-oauth-application.object.ts index 853af47f62..05e8b289c1 100644 --- a/packages/platform-objects/src/identity/sys-oauth-application.object.ts +++ b/packages/platform-objects/src/identity/sys-oauth-application.object.ts @@ -315,6 +315,15 @@ export const SysOauthApplication = ObjectSchema.create({ group: 'Credentials', }), + // Added with the stable `@better-auth/oauth-provider` 1.7 line (#3002). + client_discovery_id: Field.text({ + label: 'Client Discovery ID', + required: false, + maxLength: 255, + description: 'Opaque identifier the provider uses to look this client up on the discovery path, kept apart from the public `client_id`', + group: 'Credentials', + }), + client_secret: Field.text({ label: 'Client Secret', required: false, @@ -342,6 +351,11 @@ export const SysOauthApplication = ObjectSchema.create({ group: 'Credentials', }), + // Upstream's `applicationType` (OIDC `application_type`) maps onto this + // column — `1.7.0-rc.2` called the field `type`, stable 1.7 renamed it + // (#3002). The column keeps its name and its data; the rename is absorbed + // by the `applicationType: 'type'` mapping in plugin-auth's + // `auth-schema-config.ts`. type: Field.select(['web', 'native', 'user-agent-based', 'public'], { label: 'Client Type', required: false, @@ -391,6 +405,18 @@ export const SysOauthApplication = ObjectSchema.create({ group: 'Credentials', }), + // Added with the stable `@better-auth/oauth-provider` 1.7 line (#3002). + // The plugin writes these two through the adapter, so without the + // declarations a client registration answers 500 at the driver — the + // failure mode `oauth-provider-schema-parity.test.ts` exists to catch. + client_credentials_scopes: Field.textarea({ + label: 'Client-Credentials Scopes', + required: false, + description: + 'JSON-serialized list of scopes the client may request on the client_credentials grant, where there is no user to consent — kept apart from `scopes`, which governs user-delegated grants', + group: 'Credentials', + }), + subject_type: Field.text({ label: 'Subject Type', required: false, diff --git a/packages/plugins/plugin-auth/src/account-issuer-parity.test.ts b/packages/plugins/plugin-auth/src/account-issuer-parity.test.ts index bf14392cb8..fa3dba8366 100644 --- a/packages/plugins/plugin-auth/src/account-issuer-parity.test.ts +++ b/packages/plugins/plugin-auth/src/account-issuer-parity.test.ts @@ -10,7 +10,7 @@ import { backfillAccountIssuer, oauthIssuerFor } from './backfill-account-issuer /** * Account-issuer parity gate. * - * better-auth 1.7 keys every account on `(issuer, providerAccountId)`, and the + * better-auth 1.7 keys every account on `(issuer, accountId)`, and the * issuer is the PROVIDER's to declare: `resolveOAuthAccountKey` takes * `provider.accountIssuer` when there is one and synthesizes * `local:oauth:` only when there is not. A boot-time backfill that stamps a diff --git a/packages/plugins/plugin-auth/src/admin-user-endpoints.ts b/packages/plugins/plugin-auth/src/admin-user-endpoints.ts index ea2606241c..9deca3bc3e 100644 --- a/packages/plugins/plugin-auth/src/admin-user-endpoints.ts +++ b/packages/plugins/plugin-auth/src/admin-user-endpoints.ts @@ -62,13 +62,17 @@ export interface AuthContextLike { userId: string; providerId: string; /** - * better-auth 1.7 keys accounts on (issuer, providerAccountId) and - * requires both. A local password account carries the synthetic issuer + * better-auth 1.7 keys accounts on (issuer, accountId) and requires + * both. A local password account carries the synthetic issuer * better-auth mints for itself, `local:credential` — write anything else * and the row exists but no sign-in ever finds it. + * + * `accountId` is the STABLE 1.7 spelling. `1.7.0-rc.2` briefly called it + * `providerAccountId` and stable 1.7.0 renamed it back (#3002); the + * rc.2 spelling here would have created accounts with no account id. */ issuer: string; - providerAccountId: string; + accountId: string; password: string; }): Promise; }; @@ -579,7 +583,7 @@ export async function runAdminSetUserPassword( userId, providerId: 'credential', issuer: CREDENTIAL_ISSUER, - providerAccountId: userId, + accountId: userId, password: hashed, }); } diff --git a/packages/plugins/plugin-auth/src/auth-manager.test.ts b/packages/plugins/plugin-auth/src/auth-manager.test.ts index abc904fb1c..29873b7a3d 100644 --- a/packages/plugins/plugin-auth/src/auth-manager.test.ts +++ b/packages/plugins/plugin-auth/src/auth-manager.test.ts @@ -311,10 +311,11 @@ describe('AuthManager', () => { expect(capturedConfig.account.fields).toEqual(expect.objectContaining({ userId: 'user_id', providerId: 'provider_id', - // 1.7 identity key: (issuer, providerAccountId), the latter renamed - // from `accountId` but still living in the `account_id` column. + // 1.7 identity key: (issuer, accountId). The id field kept the + // `account_id` column across the rc.2 `providerAccountId` detour and + // the stable 1.7 rename back (#3002). issuer: 'issuer', - providerAccountId: 'account_id', + accountId: 'account_id', accessToken: 'access_token', refreshToken: 'refresh_token', idToken: 'id_token', diff --git a/packages/plugins/plugin-auth/src/auth-plugin.ts b/packages/plugins/plugin-auth/src/auth-plugin.ts index 2bc04d506d..ad03e27e64 100644 --- a/packages/plugins/plugin-auth/src/auth-plugin.ts +++ b/packages/plugins/plugin-auth/src/auth-plugin.ts @@ -843,7 +843,7 @@ export class AuthPlugin implements Plugin { await this.maybeSeedDevAdmin(ctx); }); - // better-auth 1.7 resolves every account by (issuer, providerAccountId). + // better-auth 1.7 resolves every account by (issuer, accountId). // Rows written before the upgrade have no issuer and are therefore // invisible to sign-in, so stamp them once at boot. Idempotent: a database // whose rows already carry the right issuer costs one empty query. diff --git a/packages/plugins/plugin-auth/src/auth-route-ledger.ts b/packages/plugins/plugin-auth/src/auth-route-ledger.ts index e68203570a..a7d5117d9c 100644 --- a/packages/plugins/plugin-auth/src/auth-route-ledger.ts +++ b/packages/plugins/plugin-auth/src/auth-route-ledger.ts @@ -314,6 +314,13 @@ export const BETTER_AUTH_MOUNTED_SURFACE: readonly string[] = [ 'POST /api/v1/auth/oauth2/create-client', 'POST /api/v1/auth/oauth2/delete-client', 'POST /api/v1/auth/oauth2/delete-consent', + // RP-initiated logout, POST form (OIDC RP-Initiated Logout §3). Added by the + // stable 1.7 line (#3002) as the POST counterpart of the already-mounted + // `GET /api/v1/auth/oauth2/end-session`, plus its confirmation step. Same + // handler and same gating as the GET — the confirm step is what stops a + // cross-site GET from silently ending a session. + 'POST /api/v1/auth/oauth2/end-session', + 'POST /api/v1/auth/oauth2/end-session/confirm', 'POST /api/v1/auth/oauth2/introspect', 'POST /api/v1/auth/oauth2/public-client-prelogin', 'POST /api/v1/auth/oauth2/register', diff --git a/packages/plugins/plugin-auth/src/auth-schema-config.ts b/packages/plugins/plugin-auth/src/auth-schema-config.ts index ac7f92fe28..651ff04b52 100644 --- a/packages/plugins/plugin-auth/src/auth-schema-config.ts +++ b/packages/plugins/plugin-auth/src/auth-schema-config.ts @@ -88,7 +88,7 @@ export const AUTH_SESSION_CONFIG = { * | userId | user_id | * | providerId | provider_id | * | issuer | issuer | - * | providerAccountId | account_id | + * | accountId | account_id | * | accessToken | access_token | * | refreshToken | refresh_token | * | idToken | id_token | @@ -97,19 +97,30 @@ export const AUTH_SESSION_CONFIG = { * | createdAt | created_at | * | updatedAt | updated_at | * - * better-auth 1.7.0-rc.2 restructured account identity: the field formerly - * called `accountId` is now `providerAccountId`, and a new REQUIRED `issuer` - * names the authority that vouched for that id. Every account lookup keys on - * (issuer, providerAccountId) — `findAccountByKey` / `findAccountOwnerByKey` + * better-auth 1.7 restructured account identity by adding a REQUIRED `issuer` + * naming the authority that vouched for the account id. Every account lookup + * keys on (issuer, accountId) — `findAccountByKey` / `findAccountOwnerByKey` * filter on `issuer` — so an unmapped or unstamped `issuer` means sign-in * finds no account at all. * - * `providerAccountId` keeps the existing `account_id` column: same value, - * renamed upstream, so no data moves. `issuer` is a new column, stamped on - * legacy rows by backfillAccountIssuer() at boot (see backfill-account-issuer.ts) - * with the synthetic issuers better-auth mints itself: `local:credential` for - * password accounts and `local:oauth:` for OAuth providers that - * carry no issuer of their own. + * ⚠️ THE FIELD NAME FLIP-FLOPPED ACROSS THE 1.7 PRE-RELEASES, so read it off + * the installed version, never off memory. `1.7.0-rc.2` renamed `accountId` → + * `providerAccountId`; **stable `1.7.0`/`1.7.1` renamed it BACK to + * `accountId`** while keeping `issuer`. Measured on the installed 1.7.1: + * `getAuthTables({}).account.fields` is + * `issuer, accountId, providerId, userId, …` — no `providerAccountId` at all. + * Carrying the rc.2 spelling into the stable line left `accountId` unmapped, + * so the adapter asked for a column named `accountId` and every sign-up + * answered 500 `Unknown field 'accountId' on object 'sys_account'` (#3002). + * `better-auth-schema-parity.test.ts` is the gate that catches exactly this. + * + * `accountId` keeps the existing `account_id` column: same value throughout + * the rename round-trip, so no data ever moved. `issuer` is a new column, + * stamped on legacy rows by backfillAccountIssuer() at boot (see + * backfill-account-issuer.ts) with the synthetic issuers better-auth mints + * itself: `local:credential` for password accounts and + * `local:oauth:` for OAuth providers that carry no issuer of + * their own. */ export const AUTH_ACCOUNT_CONFIG = { modelName: SystemObjectName.ACCOUNT, // 'sys_account' @@ -117,7 +128,7 @@ export const AUTH_ACCOUNT_CONFIG = { userId: 'user_id', providerId: 'provider_id', issuer: 'issuer', - providerAccountId: 'account_id', + accountId: 'account_id', accessToken: 'access_token', refreshToken: 'refresh_token', idToken: 'id_token', @@ -430,6 +441,9 @@ export const AUTH_PHONE_NUMBER_USER_FIELDS = { * |:---------------------------|:--------------------------------| * | clientId | client_id | * | clientSecret | client_secret | + * | clientDiscoveryId | client_discovery_id | + * | clientCredentialsScopes | client_credentials_scopes | + * | applicationType | type | * | skipConsent | skip_consent | * | enableEndSession | enable_end_session | * | subjectType | subject_type | @@ -450,12 +464,31 @@ export const AUTH_PHONE_NUMBER_USER_FIELDS = { * | backchannelLogoutUri | backchannel_logout_uri | * | backchannelLogoutSessionRequired | backchannel_logout_session_required | * | dpopBoundAccessTokens | dpop_bound_access_tokens | + * + * The last three rows arrived with the stable 1.7 line (#3002), and two of + * them are new columns rather than renames: + * + * - `applicationType` is the OIDC `application_type` and is the stable + * spelling of the field `1.7.0-rc.2` called `type` — it maps onto the + * EXISTING `type` column, so no data moves and the column keeps its + * meaning. Left unmapped it resolves to a column named `applicationType`, + * which `sys_oauth_application` does not have. + * - `clientDiscoveryId` and `clientCredentialsScopes` are genuinely new + * upstream fields; both are declared on `sys_oauth_application`. + * + * `oauth-provider-schema-parity.test.ts` is the gate: it resolves every model + * field the way the adapter does (`field.fieldName ?? key`) and fails when the + * resolved column is not declared. A camelCase name in its failure output + * means the mapping is missing, not just the column. */ export const AUTH_OAUTH_CLIENT_SCHEMA = { modelName: SystemObjectName.OAUTH_APPLICATION, // 'sys_oauth_application' fields: { clientId: 'client_id', clientSecret: 'client_secret', + clientDiscoveryId: 'client_discovery_id', + clientCredentialsScopes: 'client_credentials_scopes', + applicationType: 'type', skipConsent: 'skip_consent', enableEndSession: 'enable_end_session', subjectType: 'subject_type', diff --git a/packages/plugins/plugin-auth/src/backfill-account-issuer.ts b/packages/plugins/plugin-auth/src/backfill-account-issuer.ts index a2bdb15c2a..2e853657fe 100644 --- a/packages/plugins/plugin-auth/src/backfill-account-issuer.ts +++ b/packages/plugins/plugin-auth/src/backfill-account-issuer.ts @@ -6,10 +6,9 @@ import { createLocalAccountIssuer, createOAuthAccountIssuer } from '@better-auth * backfillAccountIssuer — stamp `sys_account.issuer` on rows written before * better-auth 1.7. * - * 1.7 restructured account identity: what used to be `account.accountId` is now - * `account.providerAccountId`, and every account carries a REQUIRED `issuer` + * 1.7 restructured account identity: every account carries a REQUIRED `issuer` * naming the authority that vouched for that id. Sign-in resolves accounts with - * `findAccountByKey({ issuer, providerAccountId })`, so a row whose `issuer` is + * `findAccountByKey({ issuer, accountId })`, so a row whose `issuer` is * NULL is invisible to better-auth — the user's password or social link simply * stops resolving. This helper closes that gap at boot, once, in place. * diff --git a/packages/plugins/plugin-auth/src/objectql-adapter.test.ts b/packages/plugins/plugin-auth/src/objectql-adapter.test.ts index 9e47f42510..b9187b0e85 100644 --- a/packages/plugins/plugin-auth/src/objectql-adapter.test.ts +++ b/packages/plugins/plugin-auth/src/objectql-adapter.test.ts @@ -86,15 +86,17 @@ describe('AUTH_*_CONFIG schema mappings', () => { }); }); - // better-auth 1.7 renamed `accountId` → `providerAccountId` and added the - // required `issuer`. Lookups key on (issuer, providerAccountId), so a - // missing mapping here reads as "no such account" on every sign-in. + // better-auth 1.7 added the required `issuer`. Lookups key on + // (issuer, accountId), so a missing mapping here reads as "no such account" + // on every sign-in. The id field's NAME flip-flopped mid pre-release — + // `1.7.0-rc.2` called it `providerAccountId`, stable 1.7 calls it + // `accountId` again (#3002) — which is why it is pinned here. it('should map account camelCase fields to snake_case', () => { expect(AUTH_ACCOUNT_CONFIG.fields).toEqual({ userId: 'user_id', providerId: 'provider_id', issuer: 'issuer', - providerAccountId: 'account_id', + accountId: 'account_id', accessToken: 'access_token', refreshToken: 'refresh_token', idToken: 'id_token', diff --git a/packages/qa/dogfood/test/showcase-demo-personas-loginable.dogfood.test.ts b/packages/qa/dogfood/test/showcase-demo-personas-loginable.dogfood.test.ts index 697a96e68e..909dc0d7f9 100644 --- a/packages/qa/dogfood/test/showcase-demo-personas-loginable.dogfood.test.ts +++ b/packages/qa/dogfood/test/showcase-demo-personas-loginable.dogfood.test.ts @@ -23,7 +23,7 @@ // ## The non-obvious half this file pins // // A password hash is not enough. better-auth 1.7 keys account identity on -// `(issuer, providerAccountId)`, so a credential row whose `issuer` is not the +// `(issuer, accountId)`, so a credential row whose `issuer` is not the // local credential issuer is invisible to `findAccountByKey` — sign-in then // fails `INVALID_EMAIL_OR_PASSWORD` behind a "User not found" warn that points // at the `sys_user` row, which is fine, instead of at the account, which is not. diff --git a/scripts/check-prerelease-pin-watch.mjs b/scripts/check-prerelease-pin-watch.mjs index 7eed77c9ec..c314890857 100644 --- a/scripts/check-prerelease-pin-watch.mjs +++ b/scripts/check-prerelease-pin-watch.mjs @@ -18,9 +18,12 @@ // // revert to a stable `^1.7.x` line the moment one ships. // -// Two issues are gated on exactly that event — #3002 (revert the family to a -// stable `^1.7.x`) and #3653 (the SCIM migration, which #3653 explicitly defers -// until `@better-auth/scim` ships a non-rc release). Neither had a PRODUCER: +// Two issues were gated on exactly that event — #3002 (revert the family to a +// stable `^1.7.x`, done: the family is on `^1.7.1` and only `@better-auth/scim` +// is still pinned to a prerelease) and #3653 (the SCIM migration, which #3653 +// explicitly defers until `@better-auth/scim` ships a non-rc release — it has, +// and it ships the rc.2 rewrite, so #3653 is now the live card). Neither had a +// PRODUCER: // nothing anywhere watched npm, so redeeming the promise depended on somebody // remembering to look. That is the repo's standard `declared != enforced` shape, // applied to a promise in a comment — and every extra day on a prerelease is @@ -28,7 +31,7 @@ // commitment. // // This is the producer. It is a WATCHER, not a fixer: it never edits a pin. Its -// entire job is to make the trigger condition of #3002 / #3653 arrive as an +// entire job is to make the trigger condition of those cards arrive as an // automatic signal within a day of the release, instead of as a memory. // // THE WATCH LIST IS DERIVED, NOT DECLARED @@ -60,7 +63,7 @@ // Two shapes of hit are reported apart, because the remedy differs: // // in-line a stable release inside the pinned line (`1.7.x`) — the exact -// trigger #3002 / #3653 wrote down. Mechanical: move the pin. +// trigger those cards wrote down. Mechanical: move the pin. // later a stable release only in a HIGHER line (`1.8.0`+) while the // pinned line never stabilized. Also gets us off the prerelease, // but crossing a minor is a decision, not a bump. Reported as its @@ -75,7 +78,7 @@ // thing it was built to replace: // // 0 WAITING every watched pin was read; no stable release yet. Quiet. -// 1 AVAILABLE a stable release exists. Loud; names #3002 / #3653. +// 1 AVAILABLE a stable release exists. Loud; names the follow-up card. // 2 UNKNOWN at least one registry read failed; no hit among the rest. // // Exit 2 is deliberately NOT exit 1. Unlike `check:objectui-pin-fresh` — a @@ -137,19 +140,24 @@ const FOLLOW_UPS = [ // stable release triggers a migration rather than a bump — rc.2 replaced the // whole SCIM model set, so #3653 defers the work to the stable release. match: /^@better-auth\/scim$/, - issues: ['#3002', '#3653'], + issues: ['#3653'], note: 'SCIM is a MIGRATION, not a bump (#3653): rc.2 replaced the model set and moved ' + - 'connections from runtime rows to boot config. Do the migration against the STABLE ' + - 'models — do not "align" this pin with the family first.', + 'connections from runtime rows to boot config, and the STABLE 1.7 releases ship that ' + + 'same rewrite (measured on the 1.7.1 tarball: no scimProvider model, no generate-token ' + + 'endpoint, all six new models present). Do the migration against the stable models — ' + + 'do not "align" this pin with the family first. #3002 moved the REST of the family to ' + + 'stable ^1.7.1 and left this pin behind deliberately, so #3653 is the only card left.', }, { match: /^(better-auth|@better-auth\/.+)$/, - issues: ['#3002'], + issues: ['#3653'], note: 'The family moves together (mixing a 1.7 plugin with 1.6 core throws during init and ' + - "500s every auth endpoint). #3002 carries the action list; plugin-auth's own exact " + - 'declarations must move in the same PR — `check:override-consistency` holds them to it.', + "500s every auth endpoint). plugin-auth's own declarations must move in the SAME PR — " + + '`check:override-consistency` holds them to it. The family is on stable `^1.7.1` since ' + + '#3002, so a family member showing up here again means a NEW prerelease pin was added; ' + + 'read the pin\'s own comment in pnpm-workspace.yaml for why, and file a card for it.', }, ]; @@ -606,14 +614,13 @@ function selfTest() { watch.find((w) => w.name === 'better-auth')?.base === '1.7.0', ); check( - 'scim carries BOTH follow-up issues (#3002 and #3653)', - ['#3002', '#3653'].every((i) => - watch.find((w) => w.name === '@better-auth/scim').followUp.issues.includes(i), - ), + 'scim carries the migration card (#3653) and names it a MIGRATION', + watch.find((w) => w.name === '@better-auth/scim').followUp.issues.join() === '#3653' && + watch.find((w) => w.name === '@better-auth/scim').followUp.note.includes('MIGRATION'), ); check( - 'the rest of the family carries #3002', - watch.find((w) => w.name === 'better-auth').followUp.issues.join() === '#3002', + 'the rest of the family carries a follow-up card too', + watch.find((w) => w.name === 'better-auth').followUp.issues.join() === '#3653', ); check( 'a prerelease pin with no declared follow-up is watched anyway (unmapped is legal)', @@ -686,7 +693,7 @@ function selfTest() { // --- 5. the reports say what they must ---------------------------------- const hitText = render(evaluate([judge(entry, { versions: ['1.7.0'], distTags: {} })])); - check('the AVAILABLE report names #3002', hitText.includes('#3002'), hitText); + check('the AVAILABLE report names its follow-up card', hitText.includes('#3653'), hitText); check( 'the AVAILABLE report names the remedy (revert to ^1.7.x)', hitText.includes('^1.7.x'), @@ -792,7 +799,7 @@ function selfTest() { check('CLI exits 1 when a stable release exists', hitRun.code === 1, `code ${hitRun.code}`); check( 'the hit run emits ::error:: naming the follow-up issue', - hitRun.out.includes('::error::') && hitRun.out.includes('#3002'), + hitRun.out.includes('::error::') && hitRun.out.includes('#3653'), hitRun.out, ); @@ -843,7 +850,7 @@ function selfTest() { 'JSON carries the verdict, the per-package rows and the issue list', parsed.verdict === 'available' && parsed.packages.length === 3 && - parsed.issues.join(',') === '#3002,#3653', + parsed.issues.join(',') === '#3653', jsonRun.stdout, ); check( From 9e156c12c36fcd79e14d1629bd12fd87f3b9f0d9 Mon Sep 17 00:00:00 2001 From: os-warren Date: Wed, 19 Aug 2026 06:03:26 +0000 Subject: [PATCH 3/5] chore(i18n): regenerate platform-objects bundles for the two new sys_oauth_application columns Generated output, not hand-edited: node scripts/check-i18n-bundles.mjs --write. `pnpm check:i18n` is green again (9 packages, all bundles in sync). Refs #3002 --- .../src/apps/translations/en.objects.generated.ts | 8 ++++++++ .../src/apps/translations/es-ES.objects.generated.ts | 8 ++++++++ .../src/apps/translations/ja-JP.objects.generated.ts | 8 ++++++++ .../src/apps/translations/zh-CN.objects.generated.ts | 8 ++++++++ 4 files changed, 32 insertions(+) diff --git a/packages/platform-objects/src/apps/translations/en.objects.generated.ts b/packages/platform-objects/src/apps/translations/en.objects.generated.ts index 686b9ee47e..e7799f450f 100644 --- a/packages/platform-objects/src/apps/translations/en.objects.generated.ts +++ b/packages/platform-objects/src/apps/translations/en.objects.generated.ts @@ -1228,6 +1228,10 @@ export const enObjects: NonNullable = { label: "Client ID", help: "Public OAuth client identifier" }, + client_discovery_id: { + label: "Client Discovery ID", + help: "Opaque identifier the provider uses to look this client up on the discovery path, kept apart from the public `client_id`" + }, client_secret: { label: "Client Secret", help: "OAuth client secret — stored as a SHA-256 digest, never plaintext (`@better-auth/oauth-provider`'s `storeClientSecret`, which defaults to hashed whenever the jwt plugin is enabled; wired in plugin-auth's `AuthManager.buildPluginList()`, oidcProvider branch). Shown once at registration." @@ -1272,6 +1276,10 @@ export const enObjects: NonNullable = { label: "Allowed Scopes", help: "JSON-serialized list of scopes the client may request" }, + client_credentials_scopes: { + label: "Client-Credentials Scopes", + help: "JSON-serialized list of scopes the client may request on the client_credentials grant, where there is no user to consent — kept apart from `scopes`, which governs user-delegated grants" + }, subject_type: { label: "Subject Type", help: "OIDC subject type (e.g. public, pairwise)" diff --git a/packages/platform-objects/src/apps/translations/es-ES.objects.generated.ts b/packages/platform-objects/src/apps/translations/es-ES.objects.generated.ts index 0dcaad4ef2..a97709f92e 100644 --- a/packages/platform-objects/src/apps/translations/es-ES.objects.generated.ts +++ b/packages/platform-objects/src/apps/translations/es-ES.objects.generated.ts @@ -1228,6 +1228,10 @@ export const esESObjects: NonNullable = { label: "ID de cliente", help: "Identificador público del cliente OAuth." }, + client_discovery_id: { + label: "Client Discovery ID", + help: "Opaque identifier the provider uses to look this client up on the discovery path, kept apart from the public `client_id`" + }, client_secret: { label: "Secreto de cliente", help: "Secreto del cliente OAuth (con hash/cifrado en reposo)." @@ -1272,6 +1276,10 @@ export const esESObjects: NonNullable = { label: "Ámbitos permitidos", help: "Lista serializada en JSON de ámbitos que el cliente puede solicitar." }, + client_credentials_scopes: { + label: "Client-Credentials Scopes", + help: "JSON-serialized list of scopes the client may request on the client_credentials grant, where there is no user to consent — kept apart from `scopes`, which governs user-delegated grants" + }, subject_type: { label: "Tipo de sujeto", help: "Tipo de sujeto OIDC (p. ej. public, pairwise)." diff --git a/packages/platform-objects/src/apps/translations/ja-JP.objects.generated.ts b/packages/platform-objects/src/apps/translations/ja-JP.objects.generated.ts index d14ddd1184..e43ce14b11 100644 --- a/packages/platform-objects/src/apps/translations/ja-JP.objects.generated.ts +++ b/packages/platform-objects/src/apps/translations/ja-JP.objects.generated.ts @@ -1228,6 +1228,10 @@ export const jaJPObjects: NonNullable = { label: "クライアント ID", help: "公開 OAuth クライアント識別子" }, + client_discovery_id: { + label: "Client Discovery ID", + help: "Opaque identifier the provider uses to look this client up on the discovery path, kept apart from the public `client_id`" + }, client_secret: { label: "クライアントシークレット", help: "OAuth クライアントシークレット（保存時にハッシュ/暗号化済み）" @@ -1272,6 +1276,10 @@ export const jaJPObjects: NonNullable = { label: "許可スコープ", help: "クライアントがリクエスト可能なスコープの JSON シリアライズリスト" }, + client_credentials_scopes: { + label: "Client-Credentials Scopes", + help: "JSON-serialized list of scopes the client may request on the client_credentials grant, where there is no user to consent — kept apart from `scopes`, which governs user-delegated grants" + }, subject_type: { label: "サブジェクトタイプ", help: "OIDC サブジェクトタイプ（例: public、pairwise）" diff --git a/packages/platform-objects/src/apps/translations/zh-CN.objects.generated.ts b/packages/platform-objects/src/apps/translations/zh-CN.objects.generated.ts index f834c0bcb7..7378653bc2 100644 --- a/packages/platform-objects/src/apps/translations/zh-CN.objects.generated.ts +++ b/packages/platform-objects/src/apps/translations/zh-CN.objects.generated.ts @@ -1228,6 +1228,10 @@ export const zhCNObjects: NonNullable = { label: "客户端 ID", help: "公开的 OAuth 客户端标识" }, + client_discovery_id: { + label: "Client Discovery ID", + help: "Opaque identifier the provider uses to look this client up on the discovery path, kept apart from the public `client_id`" + }, client_secret: { label: "客户端密钥", help: "OAuth 客户端密钥（静态存储时会哈希/加密）" @@ -1272,6 +1276,10 @@ export const zhCNObjects: NonNullable = { label: "允许的范围", help: "客户端可申请的 scopes 的 JSON 序列化列表" }, + client_credentials_scopes: { + label: "Client-Credentials Scopes", + help: "JSON-serialized list of scopes the client may request on the client_credentials grant, where there is no user to consent — kept apart from `scopes`, which governs user-delegated grants" + }, subject_type: { label: "主体类型", help: "OIDC 主体类型（例如 public、pairwise）" From 936b45da5c73df08d22f126ee1ce95c672c145a5 Mon Sep 17 00:00:00 2001 From: os-warren Date: Wed, 19 Aug 2026 06:36:38 +0000 Subject: [PATCH 4/5] fix(showcase): the demo-persona seeder writes the stable 1.7 account id key MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Second `internalAdapter.createAccount` call site carrying the rc.2 `providerAccountId` spelling — found by the dogfood suite, not by grep: `showcase-demo-personas-loginable.dogfood.test.ts` failed with phone.demo@example.com holds a credential account: expected undefined to be truthy verify signIn failed: 401 {"code":"INVALID_EMAIL_OR_PASSWORD"} The account row was written with no account id, so better-auth's `findAccountByKey({ issuer, accountId })` could not see it and both demo personas were silently un-loginable — exactly the failure mode #9308 fixture 1 exists to prevent, and exactly the shape its own comment warns about (a misleading "User not found" pointing at the sys_user row rather than the account). The admin persona was unaffected, which is why only the persona test caught it. Also adds the changeset for the family bump, the drift it absorbs, and the one consumer-visible rename (`@objectstack/client`'s `/list-accounts` response type), and lowers plugin-auth's TEST_DEBT ceiling 111 → 110 to the number this branch now measures, as `check:type-check-debt` prescribes. Verified: showcase-demo-personas-loginable dogfood 4/4 pass; the auth-path dogfood set 57/57; app-showcase 337 tests + tsc clean. Refs #3002 --- .changeset/better-auth-family-stable-1-7.md | 55 +++++++++++++++++++ .../src/security/demo-personas.ts | 2 +- .../src/security/seed-approval-demo.ts | 12 +++- scripts/check-type-check-coverage.mjs | 2 +- 4 files changed, 66 insertions(+), 5 deletions(-) create mode 100644 .changeset/better-auth-family-stable-1-7.md diff --git a/.changeset/better-auth-family-stable-1-7.md b/.changeset/better-auth-family-stable-1-7.md new file mode 100644 index 0000000000..8df149cebf --- /dev/null +++ b/.changeset/better-auth-family-stable-1-7.md @@ -0,0 +1,55 @@ +--- +"@objectstack/plugin-auth": patch +"@objectstack/platform-objects": patch +"@objectstack/client": patch +--- + +deps(auth): the better-auth family moves off the `1.7.0-rc.2` prerelease onto stable `^1.7.1` (#3002) + +`@objectstack/plugin-auth` shipped with **exact pins on a release candidate** — +`better-auth`, `@better-auth/core`, `@better-auth/oauth-provider` and +`@better-auth/sso` all at `1.7.0-rc.2`. That pin was never housekeeping debt: it was +the remediation for **GHSA-p2fr-6hmx-4528** (`@better-auth/oauth-provider`) and +**GHSA-j8v8-g9cx-5qf4** (`@better-auth/scim`, high — account/provider takeover), both +patched only in `>=1.7.0-beta.4`, so there was no stable line to move to. Upstream has +now shipped one: `npm view dist-tags` reports `latest: 1.7.1` for every family +member. The declarations become `^1.7.1`, which is what a downstream +`npx create-objectstack` install now resolves. + +**`@better-auth/scim` deliberately stays at `1.7.0-rc.1`.** Measured against the +published stable tarball rather than assumed: `@better-auth/scim@1.7.1` ships the rc.2 +**rewrite** — no `scimProvider` model, no generate-token endpoint, and six replacement +models (`scimUser`, `scimGroup`, `scimGroupMember`, `scimSubject`, +`scimConnectionBinding`, `scimIdentityTombstone`). Adopting it is a feature migration +(ADR-0071, tracked separately), not a version bump. The hold stays security-clean: rc.1 +is above the advisory's fix floor, `pnpm audit --audit-level=high` is green, and rc.1's +peer ranges accept the stable 1.7.1 core the rest of the family resolves to. + +**Three pieces of upstream drift are absorbed here, and one of them was a live +sign-in outage waiting to happen.** + +`1.7.0-rc.2` renamed the account model's `accountId` field to `providerAccountId`; +**stable 1.7.0/1.7.1 renamed it back to `accountId`**, keeping the new required +`issuer`. Carrying the rc.2 spelling into the stable line left the field unmapped, so +better-auth's adapter asked for a column named `accountId` and **every sign-up answered +500** — `Unknown field 'accountId' on object 'sys_account'`. The `account_id` column +itself never changed and no data moves; only the camelCase key does. The same rename +reaches `@objectstack/client`: `auth.accounts.list()` (better-auth's `/list-accounts`) +returns `accountId`, and its declared response type said `providerAccountId`. If you +read that field off the client's typed response, rename it. + +`@better-auth/oauth-provider` 1.7.1's client model writes three fields the platform +object did not answer for. `applicationType` is the OIDC spelling of what rc.2 called +`type`, so it maps onto the **existing** `type` column and no data moves; +`clientDiscoveryId` and `clientCredentialsScopes` are genuinely new and are now +declared on `sys_oauth_application` as `client_discovery_id` and +`client_credentials_scopes`. Without them, dynamic client registration +(`POST /oauth2/register`) fails at the driver. + +Two endpoints are newly mounted by the auth catch-all and are now ledgered: +`POST /oauth2/end-session` and `POST /oauth2/end-session/confirm` — the POST form of +OIDC RP-initiated logout, whose `GET` counterpart was already published. + +**Nothing here needs an action on upgrade.** The new columns are additive and optional, +and the field rename is internal to how the plugin talks to better-auth — with the one +exception of the `@objectstack/client` response type named above. diff --git a/examples/app-showcase/src/security/demo-personas.ts b/examples/app-showcase/src/security/demo-personas.ts index 6957054c14..11bf927224 100644 --- a/examples/app-showcase/src/security/demo-personas.ts +++ b/examples/app-showcase/src/security/demo-personas.ts @@ -40,7 +40,7 @@ * distinct people, a submitter who is not an approver, an out-of-office * delegation decided under the delegate's own identity — was stuck on it, and * each rediscovered the same non-obvious cause: a password hash is not enough. - * better-auth 1.7 keys accounts on `(issuer, providerAccountId)`, so a + * better-auth 1.7 keys accounts on `(issuer, accountId)`, so a * credential row whose `issuer` is not the local credential issuer is INVISIBLE * to sign-in, which then fails `INVALID_EMAIL_OR_PASSWORD` behind a misleading * "User not found" — pointing at the row, which is fine, instead of at the diff --git a/examples/app-showcase/src/security/seed-approval-demo.ts b/examples/app-showcase/src/security/seed-approval-demo.ts index ff6cb7e162..446ef517f8 100644 --- a/examples/app-showcase/src/security/seed-approval-demo.ts +++ b/examples/app-showcase/src/security/seed-approval-demo.ts @@ -92,7 +92,13 @@ interface AuthContextLike { userId: string; providerId: string; issuer: string; - providerAccountId: string; + /** + * The STABLE better-auth 1.7 spelling. `1.7.0-rc.2` briefly called this + * `providerAccountId` and stable 1.7.0 renamed it back (#3002) — under + * the rc.2 spelling the account row is written with no account id and + * the persona silently stays un-loginable. + */ + accountId: string; password: string; }) => Promise; }; @@ -176,7 +182,7 @@ async function assignPositions( * * ## Why this is read and not written * - * better-auth 1.7 keys account identity on `(issuer, providerAccountId)`: + * better-auth 1.7 keys account identity on `(issuer, accountId)`: * `findAccountByKey` looks a credential up under the issuer better-auth mints * for itself, so a row carrying any other value — or none — is INVISIBLE and * sign-in fails `INVALID_EMAIL_OR_PASSWORD` behind a "User not found" warn that @@ -245,7 +251,7 @@ async function ensureCredentialAccount( userId, providerId: 'credential', issuer, - providerAccountId: userId, + accountId: userId, password: hashed, }); ctx.logger?.info?.('[showcase] approval-demo persona is now loginable', { userId }); diff --git a/scripts/check-type-check-coverage.mjs b/scripts/check-type-check-coverage.mjs index 268a79f2c9..2e75ee9278 100644 --- a/scripts/check-type-check-coverage.mjs +++ b/scripts/check-type-check-coverage.mjs @@ -729,7 +729,7 @@ const TEST_DEBT = { + '(#5278 option A).', }, '@objectstack/plugin-auth': { - errors: 111, + errors: 110, note: 'TS2493 x42 (tuple index out of range), TS18048 x24, TS2740 x19, TS2322 x11, TS2532 x9, ' + 'TS2339 x8, TS2741 x8. Lowered 131 -> 111 at b16dcb45 (#7888); the intermediate 108 in this PR\'s ' + 'first commit was measured at b5e09b21 and was already stale when the merge queue built it -- the ' From b679943535e169b21c7a8e736a79687c65eefce3 Mon Sep 17 00:00:00 2001 From: os-warren Date: Wed, 19 Aug 2026 06:45:09 +0000 Subject: [PATCH 5/5] docs(auth): the account-mapping section names the stable 1.7 field, with the flip-flop stated MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit content/docs/permissions/authentication.mdx documented the mapping as `providerAccountId: 'account_id'` and told the reader that is "the field formerly called accountId". On stable 1.7 that is backwards, and a reader following it writes exactly the mapping that answers 500 on every sign-up. The field name moved twice inside the 1.7 line — rc.2 renamed `accountId` → `providerAccountId`, stable 1.7.0 renamed it back — so the correction carries a callout saying so rather than silently swapping the word: the next reader arriving from an rc-era note needs to know which way it went. content/docs/releases/ is left alone by rule; its v15/v17 entries are accurate records of what those releases did. Refs #3002 --- content/docs/permissions/authentication.mdx | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/content/docs/permissions/authentication.mdx b/content/docs/permissions/authentication.mdx index 5ae59a1b57..dfe6b32550 100644 --- a/content/docs/permissions/authentication.mdx +++ b/content/docs/permissions/authentication.mdx @@ -1048,17 +1048,26 @@ The plugin bridges this gap using better-auth's official **`modelName` / `fields // Declared in the betterAuth() config via AUTH_*_CONFIG constants: user: { modelName: 'sys_user', fields: { emailVerified: 'email_verified', … } }, session: { modelName: 'sys_session', fields: { userId: 'user_id', expiresAt: 'expires_at', … } }, -account: { modelName: 'sys_account', fields: { providerId: 'provider_id', issuer: 'issuer', providerAccountId: 'account_id', … } }, +account: { modelName: 'sys_account', fields: { providerId: 'provider_id', issuer: 'issuer', accountId: 'account_id', … } }, verification: { modelName: 'sys_verification', fields: { expiresAt: 'expires_at', … } }, ``` -better-auth 1.7 identifies an account by `(issuer, providerAccountId)` — `providerAccountId` is -the field formerly called `accountId` (same `account_id` column) and `issuer` names the authority -that vouched for it: an OIDC `iss` for federated logins, or a synthetic `local:credential` / +better-auth 1.7 identifies an account by `(issuer, accountId)`. `issuer` names the authority +that vouched for the id: an OIDC `iss` for federated logins, or a synthetic `local:credential` / `local:oauth:` for providers that carry none. Rows written before 1.7 have no issuer, so the auth plugin stamps them once at boot; accounts from a federated IdP that is no longer registered cannot be derived and are reported in the boot log instead of guessed. + +The account id field's NAME changed twice inside the 1.7 line, so read it off the version you +run rather than off an older note. The `1.7.0-rc.2` pre-release renamed `accountId` → +`providerAccountId`; the stable `1.7.0` / `1.7.1` releases renamed it **back to `accountId`**, +keeping the new `issuer`. The `account_id` column is the same throughout — only the camelCase +key moved. On stable 1.7 the mapping above, and any `internalAdapter.createAccount({ …, +accountId })` call, must use `accountId`; the rc.2 spelling leaves the field unmapped and every +sign-up answers 500 `Unknown field 'accountId' on object 'sys_account'`. + + The ObjectQL adapter factory (`createObjectQLAdapterFactory`) then uses better-auth's `createAdapterFactory` which automatically transforms all data and where-clauses using these mappings — no manual camelCase ↔ snake_case conversion is needed in the adapter.