All of the changes made will be available here.

Sep 16, 2025

v1.3.11

Sep 16, 2025

🚀 Features

---

• Flip emailVerified when link the account –

🐞 Bug Fixes

---

• Check if user exists before banning the user –
• Timestamp issues in kysely –
• Respect errorCallbackURL in failed oauth flows –
• plugins: Asynchronous init –

    View changes on GitHub

Sep 15, 2025

v1.3.10

Sep 15, 2025

   Maintenance update: We fixed lots of issues from the community. Thanks to everyone for contributing to better-auth.

🚀 Features

---

• Add getActiveRoleMember –
• Database transaction support –
• logger: Option to disable colors –
• passkey: Error codes in passkey client –
• sqlite: Remove autoincrement for SQLite –

🐞 Bug Fixes

---

• Ignore cookiecache on auth sensitive functions –
• Custom field for refreshTokenExpiresAt –
• Return local IP in development mode –
• Make cookie cache respect dontRememberMe mode –
• Normalize zod imports –
• Check endpoint conflicts respect method –
• Respect username validator –
• Set clientId in ProviderOptions to unknown by default –
• Pick the first clientId for oauth provider –
• Remove use of global.crypto –
• Should infer types correctly when empty list of plugins is provided –
• Correct MongoDB adapter import path in CLI –
• Make sure fetch function doesn't get called repeatedly on onMount –
• Prevent lastLoginMethod plugin from setting cookie on failed auth –
• admin:
  • Change the order of role and user id check when both are provider on userHasPermission –
• anonymous:
  • Prevent false positive error on first anonymous sign-in –
• cli:
  • info shows the correct version –
  • Add missing JSON type to schema generation –
• demo:
  • Update forgot password link to /forget-password –
• docs:
  • Remove duplicated RFC compliance mention –
• expo:
  • window.crypto is undefined –
  • Missing peer deps –
• lastLoginMethod:
  • Inherit cross-subdomain cookie settings in lastLoginMethod plugin –
• memory-adapter:
  • Should respect where connector –
• multi-session:
  • Multi-session cookie name preface preventing multiple accounts signed in –
• one-time-token:
  • Typo and clean –
• organization:
  • checkRolePermission shouldn't be a promise –
  • Member and team hooks should apply on create organization –
  • Before org create hooks not applying customized data –
  • [security] updateOrgRole should check for userId properly –
  • Restrict role check by user id –
• prisma:
  • Handle optional field relation types correctly –
• stripe:
  • Properly resolve plans by lookup keys –
  • Subscription is created without completing payment –
  • Prevent multiple free trials for same user –
  • Use correct request method for billing-portal –
• tiktok:
  • Remove client_secrect from authorizationUrl –
• username:
  • Add missing normalization –
  • Sign in should work with post normalization –
• vue:
  • Correct baseURL –

    View changes on GitHub

Sep 8, 2025

v1.3.9

Sep 8, 2025

🚀 Features

---

• Add support for not in operator –
• Lynx integration –
• mcp: Customize resource in protected resource metadata –
• rate-limiter: Allow disabling custom paths to not be rate limited –

🐞 Bug Fixes

---

• Cloudflare build warning with node:sqlite –
• Shouldn't update personal sub when upgrading with org ref id –
• Properly generate OpenAPI schema for nested ZodObject and ZodOptional –
• Respect allow different email linking option on callbacks –
• expo: Handle link social –
• jwt: Revert set default iat for /token endpoint –
• mcp: Remove duplicate /api/auth from wwwAuthenticateValue and properly format the header –
• org: List user teams had incorrect path method in jsdoc –
• paypal: Use base64.encode –
• stripe: Prevent multiple free trials –
• tiktok: Refresh token flow uses client_key –

    View changes on GitHub

Sep 4, 2025

v1.3.8

Sep 4, 2025

🚀 Features

---

• Support to infer error types from endpoint –
• Support node:sqlite –
• Remote sign a jwt payload –
• Support device authorization –
• Support custom schema merging in SIWE plugin –
• Add figma provider –
• Enhance Microsoft Entra ID type definitions –
• Add onUpdate field on db schema generation –
• Add onInvitationAccepted callback for org invitations –
• Add query parameter to useSession().refetch() for cache control consistency –
• Add last login method plugin –
• Check endpoint conflits –
• Add json field type –
• Add @default and @updatedAt for prisma generator –
• Use defaultNow() for drizzle timestamp fields –
• admin:
  • Get user –
  • /admin/update-user role as array –
• atlassian:
  • Add atlassian social provider –
• cli:
  • Add info script –
• cognito:
  • Add amazon cognito provider –
• demo:
  • Improve sign-up component –
• jwt:
  • Add disableSettingJwtHeader flag to prevent issuance of signed jwt –
  • Jwks remote url –
• mcp:
  • Add protected-resource metadata endpoint –
• microsoft:
  • Add support for setting authority –
• openapi:
  • Support Scalar Theme –
• org:
  • Dynamic Access Control –
• organization:
  • Organization life cycle hooks –
• paypal:
  • Add paypal OAuth2 provider –
• salesforce:
  • Add salesforce provider –
• social:
  • Add Line provider –
  • Add Kakao, Naver provider –
• stripe:
  • Add locale to stripe billing portal options –

🐞 Bug Fixes

---

• Constant time compare –
• Secondary storage should allow returning both string and parsed json –
• Telemetry should be opt in not opt out –
• Show error stack in debug mode –
• Move stack check into inner function –
• Check x-api-key for all auth endpoint –
• Avoid general oauth flow duplicate user –
• Small dx for device login –
• Invalid pages on docs throw a 500 server error instead of 404 –
• Make zod as dependency –
• Device authorization interval –
• Schema onUpdate not working –
• Member not exist on org –
• Never type still requires setting clientId to never –
• Team id zod schema meta property for array type –
• Resolve field naming inconsistency in account listing endpoint –
• Changelogs incorrect mentions –
• Leave error from fetch API as-is –
• Update organization requiring all additional fields for update payload –
• Prevent build error for node:sqlite –
• Prevent undefined from passed to adapter in username plugin –
• Add missing defaultValue on core schema –
• Strict social provider type –
• apple:
  • Ensures name is always present in profile for mapProfileToUser –
  • Allow audience to be `string
• cli:
  • Check for undefined defaultValue instead of truthy value when generating drizzle schema –
  • generate throws error with default export –
  • Incorrect drizzle schema gen –
  • Simplify and correct comma insertion logic in plugin array –
• client:
  • Prevent proxy promise-like behavior –
  • Prevent proxy promise-like behavior –
  • Avoid atom to be proxy –
• custom-session:
  • Also mutate multi-session response –
• db:
  • Special case schema generation ID –
• expo:
  • Fix the inability to dynamically import a dependency –
  • Fix signout clobbering store session properties –
• oauth2:
  • Correct basic auth header construction for refresh token –
• oidc:
  • Allow custom schemas –
  • Specify foreign key references in the schema –
• oidc-provider:
  • Handle string timestamps in user profile claims –
• organization:
  • Was possible to remove sole org owner –
• stripe:
  • Fix unset values on session completed with trial –
  • Allow sync function to get plans –

    View changes on GitHub

Aug 17, 2025

v1.3.7

Aug 17, 2025

🚀 Features

---

• Add disableRedirect to linkSocial –
• admin:
  • Add control to prevent admin users from deleting themselves –
• cli:
  • Resolves tsconfig references for path aliases –
  • Support sveltekit $ imports in CLI generate cmd –
• email-otp:
  • Add check verification otp endpoint –
• jwt:
  • Sign with jwt for artbitrary payload –
• vk:
  • Add user name mapping by default –

🐞 Bug Fixes

---

• Throw proper error if session is null when deleting organization –
• Prevent file system access when telemetry is disabled –
• Memory leak in custom session plugin –
• Use wider types for database hooks payloads –
• admin:
  • ImpersonatedBy not appearing in client (type fix) –
• cli:
  • Clean up unused pg and mysql import in drizzle schema generator –
  • Add FK onDelete cascade and CURRENT_TIMESTAMP defaults on generation –
  • Clean up unused pg and mysql import in drizzle schema generator –
• organization:
  • Prevent fk constraint violation when creating invitation without teams –
  • Resend invitation should reuse existing invitation instead of creating duplicate –
• sso:
  • [⚠︎Security] - membership check should be required before allowing users to create sso for an organization –
• stripe:
  • Prevent undefined assignment to optional properties –
• sveltekit:
  • Use permissive typing for RequestEvent params –
• telemetry:
  • process referenced on non-nodejs runtime –

    View changes on GitHub