Update dependency better-auth to v1.7.9

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
better-auth (source)	1.7.7 → 1.7.9

---

Release Notes

better-auth/better-auth (better-auth)

v1.7.9

Compare Source

Patch Changes

• #​11766 6edaa61 Thanks @​bytaesu! - An onAPIError.onError handler that throws or rejects no longer fails the request or causes an unhandled promise rejection. The error is logged and the original error response is returned. Async handlers now finish before the response is sent.

• Updated dependencies []:

  • @​better-auth/core@1.7.9
  • @​better-auth/drizzle-adapter@1.7.9
  • @​better-auth/kysely-adapter@1.7.9
  • @​better-auth/memory-adapter@1.7.9
  • @​better-auth/mongo-adapter@1.7.9
  • @​better-auth/prisma-adapter@1.7.9
  • @​better-auth/telemetry@1.7.9

v1.7.8

Compare Source

Patch Changes

• #​11512 4175b34 Thanks @​bytaesu! - Align the installed @better-auth/utils version with better-call while accepting ^0.4.2 || ^0.5.0 across official package peers.

• #​11565 b1cfc1e Thanks @​bytaesu! - Omit non-returned custom fields from inferred output schema types.

• #​11540 678c555 Thanks @​bytaesu! - Align cookie security attributes with RFC 6265bis.

• #​10591 193efff Thanks @​kdelay! - Expired or revoked sessions now clear stale cookies when using customSession.

• #​11625 369176e Thanks @​gustavovalverde! - Fixed single-use checks for apps that set advanced.database.generateId: "uuid". Default id generation is unaffected, and no migration is needed.

  • On SQLite and MySQL, SAML sign-in, DPoP-bound requests checked against the database replay store, private_key_jwt client authentication, and magic link or email OTP sign-ins that adopt an unverified account failed with a NOT NULL error on the id column. They now work. SIWE sign-in ignored the email field and used the wallet-derived address; it now uses the supplied email when no other account has it.
  • On Postgres and MongoDB, a reused SAML assertion, DPoP proof, or client assertion was accepted. Each one is now accepted only once.

  With generateId: "serial", behavior is unchanged: these checks need string ids, and Better Auth now logs a warning the first time one of these flows runs.

• #​11391 352d04c Thanks @​breken-ai! - Fix customSession treating session lookup failures as signed-out users. Server-side getSession now throws an API error, and HTTP clients receive an error response.

• #​11750 e9d9921 Thanks @​gustavovalverde! - Generic OAuth providers configured with discoveryUrl now recover without a restart when discovery fails at startup. Since 1.7.3, a provider whose discovery request failed at boot (for example, because the identity provider was still starting) was skipped, and every sign-in returned PROVIDER_NOT_FOUND until the app restarted. Better Auth now retries discovery on the next sign-in, callback, or account-linking request for that provider, and the provider works as soon as discovery succeeds. While discovery keeps failing, sign-in and account linking still return PROVIDER_NOT_FOUND and callbacks redirect with error=oauth_provider_not_found, and each request may wait up to 10 seconds for the retry.

• #​11549 1bd5c37 Thanks @​bytaesu! - Fix lastLoginMethod failing sign-in when cookieName or maxAge is explicitly undefined.

• #​11174 766cfb3 Thanks @​Bekacru! - Stop double-decoding callbackURL, newUserCallbackURL and errorCallbackURL on magic link verify so percent-encoded characters in callback query params are preserved.

• #​11505 c46992f Thanks @​bytaesu! - Preserve the referenced model and field keys when generating Kysely migrations, so custom table names that match another model key produce the intended foreign keys.

• #​11718 1d95ebf Thanks @​bytaesu! - Fix missing device sessions and failed automatic session switching after cache eviction when storeSessionInDatabase is enabled and preserveSessionInDatabase is disabled. Automatic switching now follows the order of held sessions, and large lists or sessions whose users no longer exist no longer cause valid sessions to disappear.

• #​10266 c68b2cd Thanks @​shiminshen! - Projects that enable exactOptionalPropertyTypes can use the oauthProvider() and mcp() plugins again. Since 1.7.0, adding either plugin to betterAuth() failed to type-check with a TS2322 error.

• #​11637 2627237 Thanks @​gustavovalverde! - Projects using the organization plugin with skipLibCheck: false no longer get TS2536: Type '"role"' cannot be used to index type ... from crud-members.d.mts. The role returned by getActiveMemberRole is now typed as the organization's role names directly. Projects with skipLibCheck: true (the default in most templates) were unaffected.

• #​10866 3d1f008 Thanks @​heliohm! - The organization plugin no longer pulls every zod locale into server bundles.

• #​11626 67743ed Thanks @​gustavovalverde! - Password resets and password changes no longer keep the new password when revoking the user's sessions fails. With revokeSessionsOnPasswordReset or revokeOtherSessions, database sessions are revoked and the password is saved in one transaction when transactions are enabled for the adapter, so a failure leaves the old password and sessions in place. Sessions in secondary storage are still removed after commit, on a best-effort basis. This covers /reset-password, the email OTP and phone number reset endpoints, and /change-password. onPasswordReset now runs after sessions are revoked, so a throwing callback no longer leaves them active, and a callback that lists the user's sessions no longer sees the revoked ones.

• #​10698 f0ce580 Thanks @​jashkarangiya! - If you set the phone number plugin's verifyOTP option, /phone-number/reset-password now checks the code with it, as /phone-number/verify already does. Before, password reset always compared the code with the one Better Auth generated, so apps that verify codes through a provider such as Twilio Verify could not reset passwords. If your sendPasswordResetOTP sends the code Better Auth generates, make sure verifyOTP accepts that code. Apps that don't set verifyOTP are unaffected.

• #​11646 07a0938 Thanks @​gustavovalverde! - A failed password reset no longer spends the reset link or OTP. /reset-password, /email-otp/reset-password and /phone-number/reset-password now check the token or code without consuming it, validate and hash the new password, then consume it in the same transaction as the session revocation and password write. A rejected password, such as one refused by haveIBeenPwned, always leaves the link or OTP usable. A later failure, such as a failed session revocation or password write, also leaves it usable when the adapter's transactions are enabled and verification values are stored in the database (the default without secondary storage, or verification.storeInDatabase: true). Wrong codes still count against the OTP attempt limit.

• #​11643 92dfcea Thanks @​gustavovalverde! - A sign-up that fails after its session is created no longer leaves that session in secondary storage. With storeSessionInDatabase enabled and preserveSessionInDatabase off, the secondary-storage copy is written only after the sign-up commits, and listing a user's sessions now reads the database, so a session whose cached copy failed to write is still listed and revoked. With other secondary-storage settings, sign-up, passkey registration and SSO sign-in with resolveUser keep the session write inside their transaction, so a storage failure rolls back the new user, passkey or account instead of keeping them without a session. A session revoked by a session.create.after database hook also stays revoked.

• #​11488 e15625f Thanks @​Bekacru! - SvelteKit 3 projects can now install Better Auth without --legacy-peer-deps. The @sveltejs/kit peer range now includes ^3.0.0; SvelteKit 2 projects are unaffected.

• Updated dependencies [4175b34, 435645e, 369176e, 0cfe07d, 9904b29, e78f15a, 60525e0, 8133265, ea85d13, 916ef5c, 1d95ebf, 6214610, 67743ed, c46d2a6, 92dfcea, a9f455d, 9725f1b]:

  • @​better-auth/core@1.7.8
  • @​better-auth/drizzle-adapter@1.7.8
  • @​better-auth/kysely-adapter@1.7.8
  • @​better-auth/memory-adapter@1.7.8
  • @​better-auth/mongo-adapter@1.7.8
  • @​better-auth/prisma-adapter@1.7.8
  • @​better-auth/telemetry@1.7.8

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • Only on Thursday (* * * * 4)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.