[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
better-auth (source)	1.7.12 → 1.7.15

---

Release Notes

better-auth/better-auth (better-auth)

v1.7.15

Compare Source

Patch Changes

• #​12100 7769e91 Thanks @​bytaesu! - The admin plugin now rejects banned users when a session is created outside an endpoint, such as through internalAdapter.createSession.

• #​12099 3f17193 Thanks @​bytaesu! - The admin update-user endpoint now rejects data.id with a 400 error instead of attempting to change the user's primary key.

• #​12145 804ba8a Thanks @​bytaesu! - Headers and cookies set by a hooks.before hook that does not return early now reach the response instead of being dropped. When the endpoint sets the same header or cookie, the endpoint's value wins.

• #​12108 1391673 Thanks @​bytaesu! - The HubSpot helper in genericOAuth now encodes the access token as a single path segment when fetching token info, so tokens containing reserved characters are no longer truncated, and it returns null instead of requesting /access-tokens/undefined when no access token is present.

• #​12142 f63fb0e Thanks @​bytaesu! - Organization and API key metadata, and OAuth proxy sign-ins whose additionalData contains a constructor field, no longer fail with "Potential prototype pollution attempt detected".

• #​12098 4cdcb1c Thanks @​bytaesu! - Error messages for a malformed BETTER_AUTH_SECRETS entry now report the entry position instead of including the entry value.

• #​12097 6e7fa27 Thanks @​bytaesu! - Fixed /sign-in/username and /is-username-available rejecting a username that sign-up accepts when validationOrder.username is post-normalization. Both endpoints now validate the same value as sign-up.

• #​12109 264de2b Thanks @​bytaesu! - Fix the Vue client's useSession(useFetch) returning no session during Nuxt SSR when baseURL is inferred from the environment.

• Updated dependencies [9ef0c5b]:

  • @​better-auth/core@1.7.15
  • @​better-auth/drizzle-adapter@1.7.15
  • @​better-auth/kysely-adapter@1.7.15
  • @​better-auth/memory-adapter@1.7.15
  • @​better-auth/mongo-adapter@1.7.15
  • @​better-auth/prisma-adapter@1.7.15
  • @​better-auth/telemetry@1.7.15

v1.7.14

Compare Source

Patch Changes

• #​12031 d2cb7f5 Thanks @​bytaesu! - Two-factor TOTP now accepts imported Base32 secrets stored as base32:<secret>.

• Updated dependencies [2947ab7]:

  • @​better-auth/core@1.7.14
  • @​better-auth/drizzle-adapter@1.7.14
  • @​better-auth/kysely-adapter@1.7.14
  • @​better-auth/memory-adapter@1.7.14
  • @​better-auth/mongo-adapter@1.7.14
  • @​better-auth/prisma-adapter@1.7.14
  • @​better-auth/telemetry@1.7.14

v1.7.13

Compare Source

Patch Changes

• #​11985 9cb95fe Thanks @​bytaesu! - Type declarations no longer list type-only exports as values, so importing one as a value now fails type checking instead of failing at runtime.

• Updated dependencies [2712441, 1cf4b2c]:

  • @​better-auth/core@1.7.13
  • @​better-auth/drizzle-adapter@1.7.13
  • @​better-auth/kysely-adapter@1.7.13
  • @​better-auth/memory-adapter@1.7.13
  • @​better-auth/mongo-adapter@1.7.13
  • @​better-auth/prisma-adapter@1.7.13
  • @​better-auth/telemetry@1.7.13

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • Only on Thursday (* * * * 4)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.