fix(deps): update all patch dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@better-auth/api-key (source)	~1.7.7 → ~1.7.10
@better-auth/drizzle-adapter (source)	~1.7.7 → ~1.7.10
better-auth (source)	~1.7.7 → ~1.7.10
eslint-config-next (source)	16.4.0 → 16.4.2
next (source)	16.4.0 → 16.4.2
react (source)	19.3.0 → 19.3.1
react (source)	^19.3.0 → ^19.3.1
react-dom (source)	19.3.0 → 19.3.1
react-dom (source)	^19.3.0 → ^19.3.1
shadcn (source)	^4.21.4 → ^4.21.5
vitest (source)	^5.0.4 → ^5.0.5

---

Release Notes

better-auth/better-auth (@​better-auth/api-key)

v1.7.10

Compare Source

v1.7.9

Compare Source

v1.7.8

Compare Source

Patch Changes

• #​11512 4175b34 Thanks @​bytaesu! - Align the installed @better-auth/utils version with better-call while accepting ^0.4.2 || ^0.5.0 across official package peers.

better-auth/better-auth (@​better-auth/drizzle-adapter)

v1.7.10

Compare Source

v1.7.9

Compare Source

v1.7.8

Compare Source

Patch Changes

• #​11512 4175b34 Thanks @​bytaesu! - Align the installed @better-auth/utils version with better-call while accepting ^0.4.2 || ^0.5.0 across official package peers.

• #​11731 0cfe07d Thanks @​gustavovalverde! - Drizzle schemas that store dates in string columns now work: timestamp({ mode: "string" }), MySQL datetime({ mode: "string" }), and SQLite text(), including on Cloudflare D1. Before, the adapter passed a JavaScript Date to those columns. Drivers such as postgres-js, better-sqlite3 and D1 rejected it, so email sign-up, social sign-in and session refresh failed. Filtering on those columns, for example when listing sessions, failed the same way. Better Auth now writes these dates as UTC text and reads a value without a time zone as UTC.

  If your server's time zone is not UTC and you use node-postgres or mysql2 with a string column that has no time zone, existing rows were written in the server's local time. They now read back shifted by the server's UTC offset, so sessions and verification codes created before the upgrade can expire early or late. Schemas generated by the CLI use date columns and are unaffected.

better-auth/better-auth (better-auth)

v1.7.10

Compare Source

Patch Changes

• #​11393 eebd47a Thanks @​breken-ai! - If you use the lastLoginMethod plugin with oneTap, signing in through Google One Tap now records "google", the same value as signing in with the Google button. Before, a One Tap sign-in recorded nothing: the better-auth.last_used_login_method cookie kept its previous value or stayed unset, and so did user.lastLoginMethod with storeInDatabase.

  If your customResolveMethod includes a /one-tap/callback → "google" workaround, remove that mapping; keep the resolver if it handles other routes.

• #​11821 09d07e6 Thanks @​gustavovalverde! - The Google One Tap prompt (authClient.oneTap() without button) no longer calls getSkippedReason(), which Google's FedCM migration guide says to remove. Before, it called it under any promptOptions.fedCM setting.

  A skipped prompt now ends the flow and calls onPromptNotification right away instead of retrying. Google doesn't report why a prompt was skipped, and a prompt the user closed stays hidden for Google's cooldown period, so the retries could not bring it back. Dismissed prompts still retry as before.

  Google Identity Services still logs its FedCM migration warning, because it does so whenever prompt() receives a listener. The plugin needs the listener to track dismissals and skips, so the warning is expected and safe to ignore.

• #​11819 eaecb72 Thanks @​gustavovalverde! - Google One Tap now applies your socialProviders.google.mapProfileToUser and custom getUserInfo, the same as the standard Google sign-in. Before, One Tap ignored both and always stored the token's name, email, email_verified, and picture claims.

  If you configured either one, users created through One Tap now get the fields it returns, including any extra fields such as a first name from given_name. Returning users are updated from it on each One Tap sign-in when socialProviders.google.overrideUserInfoOnSignIn is on, and so are existing users that One Tap links when account.accountLinking.updateUserInfoOnLink is on. Check that your mapper suits One Tap users too.

  If you set socialProviders.google.overrideUserInfoOnSignIn, One Tap sign-ins now update returning users' name, image, and email from Google, as the redirect sign-in already does.

  Setups that configure none of these, including oneTap({ clientId }) with no Google provider, are unaffected.

• #​11820 88c9a37 Thanks @​gustavovalverde! - If you set autoSelect or cancelOnTapOutside on oneTapClient(), the One Tap prompt and the Sign in with Google button now use them. Before, only values passed to authClient.oneTap() took effect, so with autoSelect: true on the plugin, returning users still had to pick an account. Values passed to oneTap() still override the plugin's. Apps that set these options only on oneTap(), or not at all, are unaffected.

• #​11696 0cf1f7c Thanks @​drewsephski! - You can now import the One Tap plugin from better-auth/plugins/one-tap, as you can for other plugins. Previously this import failed with a "not exported" error. Imports from better-auth/plugins and better-auth/client/plugins are unchanged.

• #​11822 414e845 Thanks @​gustavovalverde! - You can now import the Captcha and OpenAPI plugins from better-auth/plugins/captcha and better-auth/plugins/open-api, as you can for other plugins. Previously these imports failed with a "not exported" error. Imports from better-auth/plugins are unchanged.

  If your TypeScript config uses "moduleResolution": "node" (or node10), better-auth/plugins/multi-session and better-auth/test now resolve their types. Previously TypeScript reported that it could not find their declarations. Projects using bundler, node16, or nodenext resolution are unaffected.

• Updated dependencies [fedd055, bbd0a19, 99cdfe7]:

  • @​better-auth/core@1.7.10
  • @​better-auth/mongo-adapter@1.7.10
  • @​better-auth/drizzle-adapter@1.7.10
  • @​better-auth/kysely-adapter@1.7.10
  • @​better-auth/memory-adapter@1.7.10
  • @​better-auth/prisma-adapter@1.7.10
  • @​better-auth/telemetry@1.7.10

v1.7.9

Compare Source

Patch Changes

• #​11766 6edaa61 Thanks @​bytaesu! - An onAPIError.onError handler that throws or rejects no longer fails the request or causes an unhandled promise rejection. The error is logged and the original error response is returned. Async handlers now finish before the response is sent.

• Updated dependencies []:

  • @​better-auth/core@1.7.9
  • @​better-auth/drizzle-adapter@1.7.9
  • @​better-auth/kysely-adapter@1.7.9
  • @​better-auth/memory-adapter@1.7.9
  • @​better-auth/mongo-adapter@1.7.9
  • @​better-auth/prisma-adapter@1.7.9
  • @​better-auth/telemetry@1.7.9

v1.7.8

Compare Source

Patch Changes

• #​11512 4175b34 Thanks @​bytaesu! - Align the installed @better-auth/utils version with better-call while accepting ^0.4.2 || ^0.5.0 across official package peers.

• #​11565 b1cfc1e Thanks @​bytaesu! - Omit non-returned custom fields from inferred output schema types.

• #​11540 678c555 Thanks @​bytaesu! - Align cookie security attributes with RFC 6265bis.

• #​10591 193efff Thanks @​kdelay! - Expired or revoked sessions now clear stale cookies when using customSession.

• #​11625 369176e Thanks @​gustavovalverde! - Fixed single-use checks for apps that set advanced.database.generateId: "uuid". Default id generation is unaffected, and no migration is needed.

  • On SQLite and MySQL, SAML sign-in, DPoP-bound requests checked against the database replay store, private_key_jwt client authentication, and magic link or email OTP sign-ins that adopt an unverified account failed with a NOT NULL error on the id column. They now work. SIWE sign-in ignored the email field and used the wallet-derived address; it now uses the supplied email when no other account has it.
  • On Postgres and MongoDB, a reused SAML assertion, DPoP proof, or client assertion was accepted. Each one is now accepted only once.

  With generateId: "serial", behavior is unchanged: these checks need string ids, and Better Auth now logs a warning the first time one of these flows runs.

• #​11391 352d04c Thanks @​breken-ai! - Fix customSession treating session lookup failures as signed-out users. Server-side getSession now throws an API error, and HTTP clients receive an error response.

• #​11750 e9d9921 Thanks @​gustavovalverde! - Generic OAuth providers configured with discoveryUrl now recover without a restart when discovery fails at startup. Since 1.7.3, a provider whose discovery request failed at boot (for example, because the identity provider was still starting) was skipped, and every sign-in returned PROVIDER_NOT_FOUND until the app restarted. Better Auth now retries discovery on the next sign-in, callback, or account-linking request for that provider, and the provider works as soon as discovery succeeds. While discovery keeps failing, sign-in and account linking still return PROVIDER_NOT_FOUND and callbacks redirect with error=oauth_provider_not_found, and each request may wait up to 10 seconds for the retry.

• #​11549 1bd5c37 Thanks @​bytaesu! - Fix lastLoginMethod failing sign-in when cookieName or maxAge is explicitly undefined.

• #​11174 766cfb3 Thanks @​Bekacru! - Stop double-decoding callbackURL, newUserCallbackURL and errorCallbackURL on magic link verify so percent-encoded characters in callback query params are preserved.

• #​11505 c46992f Thanks @​bytaesu! - Preserve the referenced model and field keys when generating Kysely migrations, so custom table names that match another model key produce the intended foreign keys.

• #​11718 1d95ebf Thanks @​bytaesu! - Fix missing device sessions and failed automatic session switching after cache eviction when storeSessionInDatabase is enabled and preserveSessionInDatabase is disabled. Automatic switching now follows the order of held sessions, and large lists or sessions whose users no longer exist no longer cause valid sessions to disappear.

• #​10266 c68b2cd Thanks @​shiminshen! - Projects that enable exactOptionalPropertyTypes can use the oauthProvider() and mcp() plugins again. Since 1.7.0, adding either plugin to betterAuth() failed to type-check with a TS2322 error.

• #​11637 2627237 Thanks @​gustavovalverde! - Projects using the organization plugin with skipLibCheck: false no longer get TS2536: Type '"role"' cannot be used to index type ... from crud-members.d.mts. The role returned by getActiveMemberRole is now typed as the organization's role names directly. Projects with skipLibCheck: true (the default in most templates) were unaffected.

• #​10866 3d1f008 Thanks @​heliohm! - The organization plugin no longer pulls every zod locale into server bundles.

• #​11626 67743ed Thanks @​gustavovalverde! - Password resets and password changes no longer keep the new password when revoking the user's sessions fails. With revokeSessionsOnPasswordReset or revokeOtherSessions, database sessions are revoked and the password is saved in one transaction when transactions are enabled for the adapter, so a failure leaves the old password and sessions in place. Sessions in secondary storage are still removed after commit, on a best-effort basis. This covers /reset-password, the email OTP and phone number reset endpoints, and /change-password. onPasswordReset now runs after sessions are revoked, so a throwing callback no longer leaves them active, and a callback that lists the user's sessions no longer sees the revoked ones.

• #​10698 f0ce580 Thanks @​jashkarangiya! - If you set the phone number plugin's verifyOTP option, /phone-number/reset-password now checks the code with it, as /phone-number/verify already does. Before, password reset always compared the code with the one Better Auth generated, so apps that verify codes through a provider such as Twilio Verify could not reset passwords. If your sendPasswordResetOTP sends the code Better Auth generates, make sure verifyOTP accepts that code. Apps that don't set verifyOTP are unaffected.

• #​11646 07a0938 Thanks @​gustavovalverde! - A failed password reset no longer spends the reset link or OTP. /reset-password, /email-otp/reset-password and /phone-number/reset-password now check the token or code without consuming it, validate and hash the new password, then consume it in the same transaction as the session revocation and password write. A rejected password, such as one refused by haveIBeenPwned, always leaves the link or OTP usable. A later failure, such as a failed session revocation or password write, also leaves it usable when the adapter's transactions are enabled and verification values are stored in the database (the default without secondary storage, or verification.storeInDatabase: true). Wrong codes still count against the OTP attempt limit.

• #​11643 92dfcea Thanks @​gustavovalverde! - A sign-up that fails after its session is created no longer leaves that session in secondary storage. With storeSessionInDatabase enabled and preserveSessionInDatabase off, the secondary-storage copy is written only after the sign-up commits, and listing a user's sessions now reads the database, so a session whose cached copy failed to write is still listed and revoked. With other secondary-storage settings, sign-up, passkey registration and SSO sign-in with resolveUser keep the session write inside their transaction, so a storage failure rolls back the new user, passkey or account instead of keeping them without a session. A session revoked by a session.create.after database hook also stays revoked.

• #​11488 e15625f Thanks @​Bekacru! - SvelteKit 3 projects can now install Better Auth without --legacy-peer-deps. The @sveltejs/kit peer range now includes ^3.0.0; SvelteKit 2 projects are unaffected.

• Updated dependencies [4175b34, 435645e, 369176e, 0cfe07d, 9904b29, e78f15a, 60525e0, 8133265, ea85d13, 916ef5c, 1d95ebf, 6214610, 67743ed, c46d2a6, 92dfcea, a9f455d, 9725f1b]:

  • @​better-auth/core@1.7.8
  • @​better-auth/drizzle-adapter@1.7.8
  • @​better-auth/kysely-adapter@1.7.8
  • @​better-auth/memory-adapter@1.7.8
  • @​better-auth/mongo-adapter@1.7.8
  • @​better-auth/prisma-adapter@1.7.8
  • @​better-auth/telemetry@1.7.8

vercel/next.js (eslint-config-next)

v16.4.2

Compare Source

What's Changed

• [lts-active] turbo-tasks snapshot consistency fixes (#​99644, #​99732, #​99649) by @​lukesandberg in #​100002
• [lts-active] Turbopack: backport Pages Router dev module graph chaining (#​98823, #​99910, #​100091) by @​sokra in #​100008
• [lts-active] fix(next-code-frame): snap visible window to char boundaries by @​lukesandberg in #​100212
• [lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependency edges by @​lukesandberg in #​100209
• [lts-active] Turbopack: Ignore realpath errors during module resolution, matching node's behavior by @​lukesandberg in #​100217
• [lts-active] Backport docs fixes since v16.4.0 by @​icyJoseph in #​100246
• [lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions by @​lukesandberg in #​100211
• [lts-active] Backport additional documentation fixes since v16.4.0 by @​aurorascharff in #​100262

Full Changelog: vercel/next.js@v16.4.1...v16.4.2

v16.4.1

Compare Source

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution in use cache functions returning typed arrays
• Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

• Denial of Service in App Router using Server Actions

react/react (react)

v19.3.1: 19.3.1 (October 14th, 2026)

Compare Source

React Server Components

• Improve transport protocol (#​37845 by @​unstubbable and @​eps1lon)

shadcn-ui/ui (shadcn)

v4.21.5

Compare Source

Patch Changes

• #​12214 4407349 Thanks @​dependabot! - Update @modelcontextprotocol/sdk, browserslist, open and postcss-selector-parser.

• #​12192 dd34945 Thanks @​shadcn! - Move @​shadcn/registry modules out of utils.

• #​12297 7aa2110 Thanks @​mattzcarey! - Fix MCP search and list results showing [object Promise] instead of the add command.

• #​12174 2af71ac Thanks @​dependabot! - Update @modelcontextprotocol/sdk to 1.31.0.

• #​12048 cfb4cb6 Thanks @​dependabot! - Update undici to 7.29.1.

• Updated dependencies [97ddbf4, dd34945, cfb4cb6]:

  • @​shadcn/registry@0.1.4

vitest-dev/vitest (vitest)

v5.0.5

Compare Source

   🐞 Bug Fixes

• Keep vite default fs.deny with api token file  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11578 (28dc1)
• Handle quoted file names in --changed  -  by @​sheremet-va in #​11583 (14921)
• Add data to the import.meta.hot stub  -  by @​sheremet-va in #​11590 (3a828)
• Set skip in skipIf, ignore undefined options  -  by @​sheremet-va in #​11591 (d523a)
• Skip builtin loading in async leak detector  -  by @​sheremet-va in #​11598 (fe86a)
• Keep the import frame in native loader errors  -  by @​sheremet-va in #​11599 (9697b)
• Run hook cleanups when a later hook fails  -  by @​sheremet-va in #​11605 (6c5a4)
• Release mocks of finished test files  -  by @​sheremet-va in #​11607 (e9c3d)
• Abort all running tests on cancel  -  by @​sheremet-va in #​11606 (6621a)
• browser:
  • Ignore synthetic pagehide events  -  by @​sheremet-va in #​11582 (ca081)
  • Run plugin buildStart on server creation  -  by @​sheremet-va in #​11593 (ea611)
  • Drop late connections of closed sessions  -  by @​sheremet-va in #​11600 (f161e)
  • Wait 30s for the browser to close  -  by @​sheremet-va in #​11601 (6498b)
  • Run global setup once with instances  -  by @​sheremet-va in #​11596 (8dd67)
• reporter:
  • End reason &#​39;failed&#​39; on worker crash  -  by @​AriPerkkio in #​11568 (6ae8e)

    View changes on GitHub

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.