Bump better-auth from 1.7.2 to 1.7.3

[dependabot]

Bumps better-auth from 1.7.2 to 1.7.3.

Release notes

Sourced from better-auth's releases.

v1.7.3

Upgrading from 1.7.0–1.7.2:

We restored the 1.6 account core schema to avoid requiring a disruptive backfill for existing users. We recognize the cost to users who already migrated and are committed to keeping the core schema stable throughout v1.

If you applied the 1.7 issuer schema, follow the upgrade guide for the required cleanup. No backfill is needed.

better-auth

Features

• Added Cloudflare as a built-in social provider with client-secret and PKCE support. (#9908)
• Enabled schema validation during initialization by default, including in production, and rejected authentication requests on detected mismatches. (#11178)
• Added isPasswordCompromised for checking passwords against Have I Been Pwned in custom server-side flows. (#11147)

Bug Fixes

• Aligned generated OpenAPI required fields with runtime validation. (#11066)
• Handled malformed custom-scheme callback URLs without excessive processing. (#11060)
• Improved Auth0 domain normalization to avoid slow trailing-slash processing. (#11188)
• Prevented generic OAuth discovery failures from taking down the authentication API. (#10978)
• Tracked email OTP sign-ins in the last login method plugin. (#10963)
• Fixed callback hooks being skipped after proxied OAuth sign-ins and preserved server state when callback cookies are unavailable. The legacy /oauth-proxy-callback endpoint is deprecated and will be removed in the next minor release. (#10988)
• Fixed getSession failures when cookie caching is disabled and cached session cookies remain. (#11120)
• Fixed TOTP re-enrollment replacing an active authenticator and its backup codes. (#11037)
• Prevented duplicate session requests and hydration mismatches in Nuxt useFetch. (#11084)
• Improved dynamic organization role permission check performance. (#11069)
• Added type-safe Nuxt useFetch integration for the Vue client's useSession hook. (#11085)
• Restored compatibility with 1.6 account schemas by identifying accounts with (providerId, accountId) instead of issuer. (#11153)

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added Cloudflare as a built-in social provider with client-secret and PKCE support. (#9908)
• Added initialization-time schema validation and actionable mismatch guidance for Drizzle and Prisma adapters. (#11179)
• Enabled schema validation during initialization by default, including in production, and rejected authentication requests on detected mismatches. (#11178)
• Added custom token endpoint authentication strategies for providers with non-standard request parameters. (#11101)

Bug Fixes

• Restored optional consumeOne and incrementOne methods for custom database adapters. (#11189)
• Fixed TikTok sign-in and token refresh with the documented clientKey and clientSecret options. (#11102)
• Improved request IP validation performance. (#11068)
• Improved PayPal authorization code and refresh token requests, including PKCE handling. (#11129)
• Improved Reddit token requests with OAuth-compliant Basic authentication and redirect protection. (#11134)
• Restored compatibility with 1.6 account schemas by identifying accounts with (providerId, accountId) instead of issuer. (#11153)

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.3

Patch Changes

• #11060 3660f06 Thanks @​bytaesu! - Handle malformed custom-scheme callback URLs without excessive processing.

• #11037 5bd7096 Thanks @​bytaesu! - Prevent repeated TOTP enrollment from replacing an active authenticator and its backup codes.

• #11120 7ec7146 Thanks @​onmax! - Prevent getSession from failing when cookie caching is disabled while clients still have cached session cookies.

• #9908 76d311f Thanks @​harshil1712! - Add Cloudflare as a built-in social provider, with support for client-secret authentication and PKCE clients without a secret.

• #11188 c47b765 Thanks @​bytaesu! - Normalize Auth0 domains without a potentially slow trailing-slash regular expression.

• #11084 2d5c63d Thanks @​bytaesu! - Prevent duplicate session requests and hydration mismatches when using the Vue client with Nuxt useFetch.

• #11147 a9d8c12 Thanks @​bytaesu! - Add isPasswordCompromised for checking passwords against Have I Been Pwned in custom server-side flows, while ignoring padded response entries with zero occurrences.

• #10988 9fc7498 Thanks @​bytaesu! - Run callback hooks after proxied OAuth sign-ins and preserve server state when callback cookies are unavailable. The legacy /oauth-proxy-callback endpoint is deprecated and will be removed in the next minor release.

• #11178 be0e007 Thanks @​bytaesu! - Report missing tables, missing columns, and required columns Better Auth never writes during initialization, with guidance for fixing them. Kysely checks the live database schema. Authentication requests await the same check and are rejected if the schema does not match.

  Validation is enabled by default, including in production. Set advanced.database.validateSchema: false to disable runtime validation. auth migrate refuses to apply changes when required unwritten columns need manual repair.

• #11069 0bb0dbf Thanks @​bytaesu! - Improve dynamic organization role permission check performance.

• #11153 2220ee7 Thanks @​bytaesu! - Restore sign-in compatibility with 1.6 databases by identifying accounts with (providerId, accountId) and removing the issuer requirement introduced in 1.7.0. Upgrading from 1.6 no longer requires an account schema migration. Ambiguous account keys are rejected instead of selecting an arbitrary account.

  If you applied the 1.7.0 through 1.7.2 account schema, remove its issuer unique index before upgrading. For SQL databases, also make issuer nullable or remove the column so sign-ups and account linking can succeed. auth migrate does not perform this cleanup. Follow the upgrade guide for database-specific steps.

• #10978 5fe5bc2 Thanks @​BetterAndBetterII! - Skip a generic OAuth provider when discovery fails instead of taking down the rest of the auth API.

• #10963 74a7369 Thanks @​thisismert! - Track email OTP sign-ins in the last login method plugin.

• #11085 e16b40a Thanks @​bytaesu! - Provide type-safe Nuxt useFetch integration for the Vue client's useSession hook.

• #11066 c0444dc Thanks @​bytaesu! - Upgrade the packaged Zod dependency to 4.5. Generated OpenAPI schemas now mark required request fields consistently with runtime validation, including passkey registration responses.

• Updated dependencies [352d012, 76d311f, 3e9e197, 157ec8d, baa08f4, 9e36635, be0e007, a2bae0c, 1a1b7d5, 2220ee7]:

  • @​better-auth/core@​1.7.3
  • @​better-auth/drizzle-adapter@​1.7.3
  • @​better-auth/prisma-adapter@​1.7.3
  • @​better-auth/kysely-adapter@​1.7.3
  • @​better-auth/memory-adapter@​1.7.3
  • @​better-auth/mongo-adapter@​1.7.3
  • @​better-auth/telemetry@​1.7.3

Commits

• 597d39c chore: release v1.7.3 (#11032)
• 1a1b7d5 fix(core): restore optional atomic adapter methods (#11189)
• 76d311f feat: add Cloudflare social provider (#9908)
• 7ec7146 fix(session): skip cache cookie when disabled (#11120)
• c47b765 fix(generic-oauth): harden Auth0 domain normalization (#11188)
• be0e007 feat(db): check the database schema on initialization (#11178)
• 2220ee7 revert: drop the issuer column and resolve accounts by provider id (#11153)
• 5fe5bc2 fix(generic-oauth): skip providers whose discovery fails (#10978)
• a9d8c12 feat(haveibeenpwned): expose password compromise check (#11147)
• 74a7369 fix(last-login-method): handle email otp logins (#10963)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	better-auth@​1.7.2 ⏵ 1.7.3			+1	-1

View full report