chore(deps): bump better-auth from 1.6.25 to 1.6.26 in /web

[dependabot]

Bumps better-auth from 1.6.25 to 1.6.26.

Release notes

Sourced from better-auth's releases.

v1.6.26

better-auth

Bug Fixes

• Fixed session cleanup on user deletion to also remove sessions from secondary storage (#10520)
• Fixed findSessions to skip invalid secondary-storage session entries without discarding other valid sessions (#10580)
• Fixed email OTP sign-up to pass the verification type to custom OTP generators (#10608)
• Fixed email OTP password reset to allow retrying after entering an invalid password (#10552)
• Fixed email OTP verification to no longer reveal whether an email is registered before the OTP is verified (#10605)
• Fixed jwtClient() collapsing createAuthClient type inference when combined with other client plugins (#10513)
• Fixed JWT key minting inside database transactions to use the transaction-scoped adapter, preventing deadlocks on SQLite and ensuring keys commit with their surrounding transaction on Postgres and MySQL (#10623)
• Fixed oAuthProxy to preserve Apple user data from form_post callbacks (#10599)
• Fixed oneTapClient() collapsing createAuthClient type inference when combined with other client plugins (#10635)
• Fixed database rate-limit cleanup to complete when no background task handler is configured (#10619)
• Improved nextCookies performance in instrumented Next.js applications by reusing the next/headers import promise (#10467)

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added a utility for creating stable, namespaced placeholder emails on the reserved placeholder.invalid domain (#10576)

For detailed changes, see CHANGELOG

@better-auth/redis-storage

Bug Fixes

• Fixed listKeys() and clear() to use SCAN instead of KEYS so large keyspaces no longer block the Redis server (#10507)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​bytaesu, @​Emmaccen, @​gustavovalverde, @​jashkarangiya, @​jeroenvandermerwe, @​jlucaso1, @​krish-vachhani, @​mrosberghaus, @​XXMOHAMED012

Full changelog: v1.6.25...v1.6.26

Changelog

Sourced from better-auth's changelog.

1.6.26

Patch Changes

• #10619 9ede805 Thanks @​jeroenvandermerwe! - Ensure database rate-limit cleanup completes when no background task handler is configured.

• #10608 5a811f1 Thanks @​bytaesu! - Pass the email verification type to custom OTP generators after email sign-up.

• #10605 d8327f1 Thanks @​XXMOHAMED012! - The email OTP verification check no longer reveals whether an email is registered before the OTP itself is verified.

• #10513 e2c73fb Thanks @​mrosberghaus! - Fix jwtClient() collapsing createAuthClient type inference when combined with other client plugins such as inferAdditionalFields. Additional user fields (for example on updateUser) are preserved again.

• #10635 af50c45 Thanks @​krish-vachhani! - Fix oneTapClient() collapsing createAuthClient type inference when combined with other client plugins. The oneTap action is available on the client again.

• #10633 701cd43 Thanks @​gustavovalverde! - Minting or reading a JWKS signing key inside an active database transaction now uses the transaction-scoped adapter instead of the root connection. On a single-connection SQLite database with native transactions enabled, this no longer deadlocks, and on Postgres and MySQL the key commits with the surrounding transaction instead of independently of it.

• #10599 e7b0eba Thanks @​bytaesu! - Preserve Apple user data from form_post callbacks when using oAuthProxy.

• #10552 2b4a14f Thanks @​bytaesu! - Allow users to retry email OTP password resets after entering an invalid password.

• #10467 7552a3b Thanks @​jlucaso1! - Improve nextCookies performance in instrumented Next.js applications.

• #10580 ea38fca Thanks @​Emmaccen! - Skip invalid secondary-storage session entries without discarding other valid sessions.

• #10520 a03e4c1 Thanks @​bytaesu! - Ensure deleting a user also removes their sessions from secondary storage.

• Updated dependencies [a30e274]:

  • @​better-auth/core@​1.6.26
  • @​better-auth/drizzle-adapter@​1.6.26
  • @​better-auth/kysely-adapter@​1.6.26
  • @​better-auth/memory-adapter@​1.6.26
  • @​better-auth/mongo-adapter@​1.6.26
  • @​better-auth/prisma-adapter@​1.6.26
  • @​better-auth/telemetry@​1.6.26

Commits

• a16b30e chore: release v1.6.26 (#10521)
• 9ede805 fix(rate-limit): await database cleanup by default (#10619)
• af50c45 fix(one-tap): preserve client plugin inference with oneTapClient (#10635)
• 222facf fix(jwt): resolve the transaction-scoped adapter when signing (#10623)
• d8327f1 fix(email-otp): verify OTP before revealing whether the email exists (#10605)
• e7b0eba fix(oauth-proxy): preserve Apple user data (#10599)
• 5a811f1 fix(email-otp): pass verification type on sign-up (#10608)
• e18606b chore(deps): upgrade OpenTelemetry to v2 (#10601)
• ea38fca fix(db): skip null-parsed session token in findSessions instead of returning ...
• 7552a3b perf(next-js): reuse the next/headers import promise in production (#10467)
• Additional commits viewable in compare view