Releases of better-auth

228 stable releases, newest first. Release notes are kept for the last 90 days; older ones link to where they were published.

1. 1.7.10

   15 October 2026

   Section of a shared release note

   better-auth

   Bug Fixes

   • Fixed Captcha and OpenAPI plugin subpath imports and type resolution for better-auth/plugins/multi-session and better-auth/test.

   • Fixed Google One Tap sign-ins not recording google as the last login method.

   Show all 9 lines

2. 1.7.9

   15 October 2026

   Section of a shared release note

   better-auth

   Bug Fixes

   • Fixed onAPIError.onError handlers to finish before responses are sent and log failures without interrupting requests

   For detailed changes, see CHANGELOG

3. 1.7.8

   14 October 2026

   Section of a shared release note

   better-auth

   Bug Fixes

   • security

     Aligned cookie security attributes with RFC 6265bis

   • Added SvelteKit 3 to the supported peer dependency range

   Show all 22 lines

4. 1.7.7

   30 September 2026

   Section of a shared release note

   better-auth

   Magic Link upgrade: Upgrade servers sharing verification storage together, request new Magic Links, and restart pending OAuth/SAML sign-ins. No database migration is required. See the critical advisory for affected configurations and custom storage changes.

   Bug Fixes

   • security

     Fixed a critical Magic Link account-takeover vulnerability.

   Show all 10 lines

5. 1.7.6

   24 September 2026

   Section of a shared release note

   better-auth

   Features

   • Added support for a bannedUserMessage function that receives the banned user, allowing sign-in errors to include details such as the ban reason.

   • Added Vercel BotID as a captcha provider for protected authentication routes.

   Show all 12 lines

6. 1.7.5

   14 September 2026

   Section of a shared release note

   better-auth

   Features

   • Added database.schemaName support for direct PostgreSQL connections.

   Bug Fixes

   Show all 9 lines

7. 1.7.4

   10 September 2026

   Section of a shared release note

   better-auth

   Features

   • Added experimental.instrumentation.enabled to disable OpenTelemetry span creation per auth instance.

   • Added support for additional session fields in testUtils auth helpers.

   Show all 6 lines

8. 1.7.3

   6 September 2026

   Section of a shared release note

   better-auth

   Features

   • Added Cloudflare as a built-in social provider with client-secret and PKCE support.

   • Enabled schema validation during initialization by default, including in production, and rejected authentication requests on detected mismatches.

   Show all 19 lines

9. 1.7.2

   26 August 2026

   Section of a shared release note

   better-auth

   Bug Fixes

   • Fixed permanent user bans to clear expiration dates from previous temporary bans.

   • Fixed client types with more plugins being assignable to types declaring fewer plugins.

   Show all 13 lines

10. 1.7.1

    18 August 2026

    Section of a shared release note

    better-auth

    Bug Fixes

    • Added native database transaction support to test instances for PostgreSQL and MySQL.

    • Updated bundled dependencies (jose, nanostores, noble crypto packages, SimpleWebAuthn) to their latest compatible releases, with no changes required to existing projects.

    Show all 5 lines

11. 1.7.0

    18 August 2026

    Section of a shared release note

    better-auth

    Breaking Changes

    • breaking

      Moved database joins out of experimental into the stable advanced.database.joins option

      Migration: Replace experimental: { joins: true } with advanced: { database: { joins: true } }. Drizzle and Prisma users should regenerate their schema (npx auth@latest generate) so it includes the required relations.

    • breaking

      Scoped account identity by trusted issuer, keying accounts on (issuer, accountId)

      Migration: Accounts now require Account.issuer. Read provider identity from accountInfo.account.accountId, drop mapping.id from SSO configs, and give the microsoftEntraId helper a concrete tenant GUID. Apply the account-identity backfill in the 1.7 upgrade guide before deploying.

    Show all 61 lines

12. 1.6.33

    14 September 2026

    @better-auth/core

    Bug Fixes

    • Fixed database option type inference for projects that do not use Cloudflare Workers.

    For detailed changes, see CHANGELOG

13. 1.6.32

    14 September 2026

    Section of a shared release note

    better-auth

    Bug Fixes

    • Improved diagnostics for Cloudflare Turnstile verification failures

    For detailed changes, see CHANGELOG

14. 1.6.31

    10 September 2026

    Section of a shared release note

    better-auth

    Features

    • Added an option to disable OpenTelemetry span creation for individual auth instances

    For detailed changes, see CHANGELOG

15. 1.6.30

    17 August 2026

    Section of a shared release note

    better-auth

    Bug Fixes

    • Fixed concurrent cold-start requests from intermittently losing authentication or transaction context due to an async storage initialization race

    For detailed changes, see CHANGELOG

16. 1.6.29

    14 August 2026

    Section of a shared release note

    better-auth

    Bug Fixes

    • Improved deleteSessions performance by running deletes in parallel instead of sequentially

    For detailed changes, see CHANGELOG

17. 1.6.28

    13 August 2026

    Section of a shared release note

    better-auth

    Bug Fixes

    • Prevented duplicate session requests during React Suspense retries while preserving revalidation for interrupted refreshes

    • Restored client plugin declaration compatibility for downstream TypeScript consumers

    Show all 5 lines

18. 1.6.27

    11 August 2026

    Section of a shared release note

    better-auth

    Bug Fixes

    • Fixed duplicate session requests being made across Suspense retries

    For detailed changes, see CHANGELOG

19. 1.6.26

    4 August 2026

    Section of a shared release note

    better-auth

    Bug Fixes

    • Fixed session cleanup on user deletion to also remove sessions from secondary storage

    • Fixed findSessions to skip invalid secondary-storage session entries without discarding other valid sessions

    Show all 14 lines

20. 1.6.25

    23 July 2026

    Section of a shared release note

    better-auth

    Bug Fixes

    • Fixed Apple OAuth not sending the PKCE code challenge during authorization, causing token exchange failures

    • Fixed Google One Tap creating new users when sign-up was disabled on the Google provider

    Show all 7 lines

21. 1.6.24

    22 July 2026

    Section of a shared release note

    better-auth

    Features

    • Added request context (ctx) as a third argument to verifyIdToken, enabling custom ID token verifiers to read request headers

    • Added beforeStoreCookie option to the last-login-method plugin for GDPR compliance

    Show all 21 lines

22. 1.6.23

    29 June 2026

23. 1.6.22

    26 June 2026

24. 1.6.21

    26 June 2026

25. 1.6.20

    20 June 2026

26. 1.6.19

    16 June 2026

27. 1.6.18

    12 June 2026

28. 1.6.17

    12 June 2026

29. 1.6.16

    10 June 2026

30. 1.6.15

    8 June 2026

31. 1.6.14

    2 June 2026

32. 1.6.13

    31 May 2026

33. 1.6.12

    29 May 2026

34. 1.6.11

    12 May 2026

35. 1.6.10

    9 May 2026

36. 1.6.9

    24 April 2026

37. 1.6.8

    23 April 2026

38. 1.6.7

    22 April 2026

39. 1.6.6

    21 April 2026

40. 1.6.5

    16 April 2026

41. 1.6.4

    15 April 2026

42. 1.6.3

    14 April 2026

43. 1.6.2

    9 April 2026

44. 1.6.1

    8 April 2026

45. 1.6.0

    6 April 2026

46. 1.5.6

    22 March 2026

47. 1.5.5

    11 March 2026

48. 1.5.4

    6 March 2026

49. 1.5.3

    4 March 2026

50. 1.5.2

    3 March 2026