From 69e858514668c28b9a523f5185803736d2652fc8 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 25 Aug 2026 11:16:22 -0700
Subject: [PATCH] build(deps): bump better-auth from 1.6.28 to 1.7.0 (#11886)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth)
from 1.6.28 to 1.7.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/better-auth/better-auth/releases">better-auth's
releases</a>.</em></p>
<blockquote>
<h2>v1.7.0</h2>
<p><strong>Blog post:</strong> <a
href="https://better-auth.com/blog/1-7">Better Auth 1.7</a></p>
<h2><code>better-auth</code></h2>
<h3>❗ Breaking Changes</h3>
<ul>
<li>Moved database joins out of <code>experimental</code> into the
stable <code>advanced.database.joins</code> option (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10359">#10359</a>)
<blockquote>
<p><strong>Migration:</strong> Replace <code>experimental: { joins: true
}</code> with <code>advanced: { database: { joins: true } }</code>.
Drizzle and Prisma users should regenerate their schema (<code>npx
auth@latest generate</code>) so it includes the required relations.</p>
</blockquote>
</li>
<li>Scoped account identity by trusted issuer, keying accounts on
<code>(issuer, accountId)</code> (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10403">#10403</a>)
<blockquote>
<p><strong>Migration:</strong> Accounts now require
<code>Account.issuer</code>. Read provider identity from
<code>accountInfo.account.accountId</code>, drop <code>mapping.id</code>
from SSO configs, and give the <code>microsoftEntraId</code> helper a
concrete tenant GUID. Apply the account-identity backfill in the 1.7
upgrade guide before deploying.</p>
</blockquote>
</li>
<li>Required captcha endpoint entries to match full auth paths, with
wildcard support (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10004">#10004</a>)
<blockquote>
<p><strong>Migration:</strong> Replace partial paths such as
<code>/sign-in</code> with explicit wildcards like
<code>/sign-in/*</code> or <code>/sign-in/**</code>.</p>
</blockquote>
</li>
<li>Moved the MCP plugin into its own <code>@better-auth/mcp</code>
package built on the OAuth provider (<a
href="https://redirect.github.com/better-auth/better-auth/pull/9992">#9992</a>)
<blockquote>
<p><strong>Migration:</strong> Install <code>@better-auth/mcp</code> and
<code>@better-auth/cimd</code>, add the now-required <code>jwt()</code>
plugin, and move options nested under <code>oidcConfig</code> to flat
<code>mcp({ ... })</code> options. Rename <code>withMcpAuth</code> to
<code>requireMcpAuth</code> and <code>mcpHandler</code> to
<code>createMcpProtectedRequestHandler</code>. Regenerate the schema
(<code>npx auth migrate</code>): <code>oauthApplication</code> becomes
<code>oauthClient</code>, plus new <code>oauthRefreshToken</code> and
<code>oauthClientAssertion</code> tables.</p>
</blockquote>
</li>
<li>Added OIDC back-channel logout so ending a session cuts off every
connected app's API access (<a
href="https://redirect.github.com/better-auth/better-auth/pull/9304">#9304</a>)
<blockquote>
<p><strong>Migration:</strong> Introspecting an access token whose
session has ended now returns <code>{ active: false }</code>, and
<code>/oauth2/userinfo</code> rejects it. Clients opt into notifications
by registering <code>backchannel_logout_uri</code>. Run the schema
migration for the new <code>oauthClient</code> and
<code>oauthAccessToken</code> columns.</p>
</blockquote>
</li>
<li>Modeled OAuth protected resources explicitly, with per-resource
TTLs, scopes, claims, and signing pins (<a
href="https://redirect.github.com/better-auth/better-auth/pull/9648">#9648</a>)
<blockquote>
<p><strong>Migration:</strong> <code>validAudiences</code> is removed:
move each resource identifier into <code>resources</code> and link
restricted clients through <code>oauthClientResource</code>.
<code>@better-auth/mcp</code> now requires an explicit
<code>resource</code>. Run <code>npx @better-auth/cli generate</code>
and apply the migration before deploying.</p>
</blockquote>
</li>
<li>Decoupled SCIM provisioning from the organization plugin (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10390">#10390</a>)
<blockquote>
<p><strong>Migration:</strong> SCIM configuration, client APIs, database
schema, and the Group model are all replaced, and provisioning state
cannot migrate in place. Follow the SCIM cutover in the 1.7 upgrade
guide, including a full directory reprovision, before resuming
traffic.</p>
</blockquote>
</li>
<li>Added OTP-only two-factor enablement with a discriminated
<code>enableTwoFactor</code> response (<a
href="https://redirect.github.com/better-auth/better-auth/pull/9057">#9057</a>)
<blockquote>
<p><strong>Migration:</strong> <code>enableTwoFactor</code> now returns
a <code>method</code> field (<code>&quot;otp&quot;</code> or
<code>&quot;totp&quot;</code>); narrow on it before reading
<code>totpURI</code> and <code>backupCodes</code>. Pass <code>method:
&quot;otp&quot;</code> for OTP enrollment, which requires
<code>otpOptions.sendOTP</code>.</p>
</blockquote>
</li>
<li>Resolved the auth origin from <code>Host</code> by default when
using a dynamic <code>baseURL</code> (<a
href="https://redirect.github.com/better-auth/better-auth/pull/9134">#9134</a>)
<blockquote>
<p><strong>Migration:</strong> If your proxy exposes the public hostname
only through <code>x-forwarded-host</code>, set
<code>advanced.trustedProxyHeaders: true</code>. Deployments where the
proxy rewrites <code>Host</code> (nginx default, Vercel, Cloudflare,
Netlify) are unaffected.</p>
</blockquote>
</li>
<li>Added unique lookup indexes for the device authorization
<code>deviceCode</code> and <code>userCode</code> columns (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10059">#10059</a>)
<blockquote>
<p><strong>Migration:</strong> Resolve duplicate code values before
applying the migration. MySQL and SQL Server installations must also
convert both columns to bounded strings and clean up values longer than
191 characters.</p>
</blockquote>
</li>
<li>Enforced S256 PKCE in the Electron sign-in flow and hardened
custom-scheme origin checks (<a
href="https://redirect.github.com/better-auth/better-auth/pull/9645">#9645</a>)
<blockquote>
<p><strong>Migration:</strong> Upgrade the
<code>@better-auth/electron</code> client and server together and add
your app's scheme to <code>trustedOrigins</code>. The
<code>code_challenge_method</code> parameter and
<code>disableOriginOverride</code> option are removed, and host-bearing
custom-scheme entries now match that host exactly.</p>
</blockquote>
</li>
<li>Identified Microsoft Entra accounts by the stable <code>oid</code>
claim (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10204">#10204</a>)
<blockquote>
<p><strong>Migration:</strong> Migrate existing Microsoft account rows
created from <code>sub</code> before upgrading. Tokens without a valid
<code>oid</code> are rejected.</p>
</blockquote>
</li>
<li>Required a Google client ID before Google One Tap verifies ID tokens
(<a
href="https://redirect.github.com/better-auth/better-auth/pull/10036">#10036</a>)
<blockquote>
<p><strong>Migration:</strong> Configure <code>oneTap({ clientId
})</code> or <code>socialProviders.google.clientId</code>.</p>
</blockquote>
</li>
<li>Removed the deprecated <code>oidcProvider</code> plugin (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10031">#10031</a>)
<blockquote>
<p><strong>Migration:</strong> Move OIDC authorization-server
integrations to <code>@better-auth/oauth-provider</code>.</p>
</blockquote>
</li>
<li>Rewrote the generic OAuth plugin as a first-class social provider
with OAuth 2.1 defaults (<a
href="https://redirect.github.com/better-auth/better-auth/pull/9069">#9069</a>)
<blockquote>
<p><strong>Migration:</strong> Replace <code>signIn.oauth2({ providerId
})</code> with <code>signIn.social({ provider })</code>,
<code>oauth2.link()</code> with <code>linkSocial()</code>, and drop
<code>genericOAuthClient()</code>. Callbacks move to
<code>/api/auth/callback/:id</code>, <code>pkce</code> now defaults to
<code>true</code>, and <code>issuer</code> and
<code>requireIssuerValidation</code> are removed in favor of OIDC
discovery.</p>
</blockquote>
</li>
<li>Separated OAuth device grant ownership into
<code>oauthDeviceAuthorization()</code> (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10746">#10746</a>)
<blockquote>
<p><strong>Migration:</strong> The OAuth integration replaces the
optional <code>resource</code> column with <code>oauthClientId</code>
and <code>resources</code>, so regenerate and apply the schema. Let
pending device codes expire before upgrading from an earlier 1.7
prerelease.</p>
</blockquote>
</li>
<li>Verified provider <code>id_tokens</code> with a single shared
verifier (<a
href="https://redirect.github.com/better-auth/better-auth/pull/9828">#9828</a>)
<blockquote>
<p><strong>Migration:</strong> Custom <code>UpstreamProvider</code>
implementations replace the removed <code>verifyIdToken</code> method
with an <code>idToken</code> config carrying a JWKS source, issuer, and
audience. PayPal client <code>id_token</code> sign-in now returns
<code>ID_TOKEN_NOT_SUPPORTED</code>; its redirect flow is unchanged.</p>
</blockquote>
</li>
</ul>
<h3>Features</h3>
<ul>
<li>Added <code>clientAssertion</code> support to the Microsoft Entra ID
social provider (<a
href="https://redirect.github.com/better-auth/better-auth/pull/9898">#9898</a>)</li>
<li>Made the <code>Auth</code> instance directly fetchable (<a
href="https://redirect.github.com/better-auth/better-auth/pull/9431">#9431</a>)</li>
<li>Added per-provider <code>requireEmailVerification</code> for social
sign-in (<a
href="https://redirect.github.com/better-auth/better-auth/pull/9929">#9929</a>)</li>
<li>Added a <code>user.validateUserInfo</code> gate for rejecting an
identity before a user is created or linked (<a
href="https://redirect.github.com/better-auth/better-auth/pull/9864">#9864</a>)</li>
<li>Added <code>hydrateSession</code> so <code>useSession</code> returns
server-fetched data on the first render (<a
href="https://redirect.github.com/better-auth/better-auth/pull/8733">#8733</a>)</li>
<li>Added compound table indexes to plugin database schemas (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10402">#10402</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md">better-auth's
changelog</a>.</em></p>
<blockquote>
<h2>1.7.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/8733">#8733</a>
<a
href="https://github.com/better-auth/better-auth/commit/4e8e4c7fc5fb2723144cbf41c4a1bfa28de8d671"><code>4e8e4c7</code></a>
Thanks <a href="https://github.com/bytaesu"><code>@​bytaesu</code></a>!
- Add <code>hydrateSession</code> to seed the client with a
server-fetched session so <code>useSession</code> returns data on the
first render.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/9930">#9930</a>
<a
href="https://github.com/better-auth/better-auth/commit/0cbaf81bed9dec4c56880ee78a532262386e1ec5"><code>0cbaf81</code></a>
Thanks <a
href="https://github.com/gustavovalverde"><code>@​gustavovalverde</code></a>!
- Anonymous account linking now works after social and generic OAuth
sign-in in Expo and other in-app browsers, where the OAuth callback
returns without the session cookie. <code>onLinkAccount</code> fires and
the anonymous user is migrated; before, it was silently skipped.</p>
<p>Plugins can now carry server-trusted data across an OAuth redirect
with the new <code>addOAuthServerContext</code> API, read back on the
callback via <code>getOAuthState().serverContext</code>. Unlike
<code>additionalData</code>, it cannot be set from the request body, so
it is the right place for values the server must trust.</p>
<p>For <code>@better-auth/oauth-provider</code>, the post-login
authorization query now travels through that server-only channel, so it
can no longer be injected through <code>additionalData</code>.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10004">#10004</a>
<a
href="https://github.com/better-auth/better-auth/commit/b36c38f9842d3416689340552989449a32007819"><code>b36c38f</code></a>
Thanks <a href="https://github.com/bytaesu"><code>@​bytaesu</code></a>!
- The captcha plugin now requires endpoint entries to match full auth
paths unless they use wildcard patterns. This prevents requests like
<code>/sign-in//email</code> from bypassing captcha while preserving
trailing-slash matches like <code>/sign-in/email/</code>. To protect
multiple routes, replace partial paths like <code>/sign-in</code> with
explicit wildcards such as <code>/sign-in/*</code> or
<code>/sign-in/**</code>.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10746">#10746</a>
<a
href="https://github.com/better-auth/better-auth/commit/6782647d7c2d248246f9ef3980e656725c29ce64"><code>6782647</code></a>
Thanks <a
href="https://github.com/gustavovalverde"><code>@​gustavovalverde</code></a>!
- OAuth device grants now use <code>oauthDeviceAuthorization()</code>
alongside <code>oauthProvider()</code> or <code>mcp()</code>. This
single integration replaces both the standalone
<code>deviceCodeGrant()</code> plugin and the shared-grant
configuration. Standalone Device Authorization no longer accepts or
stores RFC 8707 resources, and <code>onDeviceAuthRequest</code> receives
only <code>clientId</code> and <code>scope</code>. The OAuth integration
rejects resource indicators that are not absolute, fragment-free
URIs.</p>
<p>The OAuth integration replaces the optional <code>resource</code>
column with <code>oauthClientId</code> and <code>resources</code>.
Regenerate and apply the schema when using it. Before upgrading from an
earlier 1.7 prerelease, let pending OAuth device codes expire or delete
them because they cannot be exchanged through the new integration.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10402">#10402</a>
<a
href="https://github.com/better-auth/better-auth/commit/763a2671c5372d88c291881977c8a1c2e29034b1"><code>763a267</code></a>
Thanks <a
href="https://github.com/gustavovalverde"><code>@​gustavovalverde</code></a>!
- Plugin database schemas can now define named or generated table-level
indexes across multiple fields. SQL migrations and generated Drizzle or
Prisma schemas resolve configured table and column names consistently,
while the MongoDB adapter creates the same indexes before the first
index-enforcing write.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/9766">#9766</a>
<a
href="https://github.com/better-auth/better-auth/commit/bf39cbf13f3b934f728cde72b1e7ebdc4c85f641"><code>bf39cbf</code></a>
Thanks <a
href="https://github.com/GautamBytes"><code>@​GautamBytes</code></a>! -
Add a server-only <code>auth.api.consumePhoneNumberOTP</code> API for
custom phone OTP flows that need to verify and consume a code without
creating or updating users or sessions.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10330">#10330</a>
<a
href="https://github.com/better-auth/better-auth/commit/081d3c379c720926295067d878c421b5e8684c78"><code>081d3c3</code></a>
Thanks <a
href="https://github.com/ping-maxwell"><code>@​ping-maxwell</code></a>!
- Allow the username plugin's separate <code>displayUsername</code>
field to be omitted by
setting <code>displayUsername: false</code> on both the server and
client plugins.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10059">#10059</a>
<a
href="https://github.com/better-auth/better-auth/commit/49b5cf650e1264ecc4c917ca193ea05c3b58a3b9"><code>49b5cf6</code></a>
Thanks <a
href="https://github.com/GautamBytes"><code>@​GautamBytes</code></a>! -
Device Authorization now creates unique database indexes for
<code>deviceCode</code> and <code>userCode</code>, so each generated
code must be unique in its column. Existing installations on every
adapter must resolve duplicate values before applying the migration.
MySQL and SQL Server installations must also convert both columns to
bounded strings and clean up values longer than 191 characters before
running it.</p>
<p>Generated codes are limited to 191 characters. Issuance makes up to 3
attempts to overcome unique-key collisions, then returns
<code>server_error</code> if it cannot create a unique
<code>deviceCode</code> and <code>userCode</code>. Default-generated
user codes accept case changes and readability separators during
verification, approval, and denial; custom codes outside the default
alphabet are matched exactly. The <code>/device</code> limiter allows 5
requests over a window equal to the configured code lifetime, while
<code>/device/token</code> polling keeps its separate interval
behavior.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/9645">#9645</a>
<a
href="https://github.com/better-auth/better-auth/commit/e0140297a59ddb59cccbcb4ba46c513de8cb86a7"><code>e014029</code></a>
Thanks <a
href="https://github.com/ping-maxwell"><code>@​ping-maxwell</code></a>!
- Harden the Electron OAuth flow and tighten custom-scheme
trusted-origin matching.</p>
<p>The Electron sign-in flow now mandates PKCE S256. Plain PKCE is
rejected: the <code>code_challenge_method</code> parameter is gone and
every authorization code is verified by hashing the verifier with
SHA-256. The server no longer trusts an <code>electron-origin</code>
header to set the request Origin. The Electron client now sends a real
<code>Origin</code> (for example <code>myapp:/</code>), so upgrade the
<code>@better-auth/electron</code> client and server together and make
sure your app's scheme is in <code>trustedOrigins</code>. The unused
<code>disableOriginOverride</code> option is removed.</p>
<p>Custom-scheme entries in <code>trustedOrigins</code> now match by
scheme and authority instead of string prefix. A host-less entry such as
<code>myapp://</code> or <code>exp://</code> still trusts every host of
that scheme, but a host-bearing entry such as
<code>myapp://callback</code> matches that host exactly, so it is no
longer satisfied by <code>myapp://callback.attacker.tld</code>.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/9948">#9948</a>
<a
href="https://github.com/better-auth/better-auth/commit/3d04fababbf3efd4c46a4012f46ed9397715c2e3"><code>3d04fab</code></a>
Thanks <a href="https://github.com/yordis"><code>@​yordis</code></a>! -
feat(generic-oauth): add <code>refreshTokenParams</code> config to
forward extra params on token refresh</p>
<p>Multi-tenant OIDC providers (Zitadel multi-org, Auth0 with
<code>audience</code>) need to send extra body params on the refresh
call to rescope tokens without a full authorization redirect. The
generic-oauth plugin now accepts a <code>refreshTokenParams</code>
option (object or sync/async function) that is merged into the refresh
request body, with <code>grant_type</code> and
<code>refresh_token</code> protected from override. The function form
receives request metadata for the request that triggered the refresh, so
request-scoped data (headers, cookies) is available without out-of-band
state like AsyncLocalStorage.</p>
<p><code>UpstreamProvider.refreshAccessToken</code> now accepts an
optional second <code>ctx</code> argument; the change is backwards
compatible because existing implementations that take only
<code>refreshToken</code> remain valid. See <a
href="https://redirect.github.com/better-auth/better-auth/issues/7554">#7554</a>.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/9069">#9069</a>
<a
href="https://github.com/better-auth/better-auth/commit/c7d22539ec4f7322d9625ae2953d397c3863d097"><code>c7d2253</code></a>
Thanks <a
href="https://github.com/gustavovalverde"><code>@​gustavovalverde</code></a>!
- Rewrite the generic OAuth plugin as a first-class social provider with
OAuth 2.1 security defaults. Providers now use
<code>signIn.social</code> + <code>callback/:id</code> instead of
dedicated plugin endpoints, with PKCE required by default (OAuth 2.1),
RFC 9207 issuer validation, OIDC auto-discovery with <code>openid</code>
scope injection, and typed provider IDs.</p>
<p><strong>Breaking changes:</strong></p>
<ul>
<li><code>signIn.oauth2({ providerId })</code> replaced by
<code>signIn.social({ provider })</code></li>
<li><code>oauth2.link()</code> replaced by
<code>linkSocial()</code></li>
<li>Callback URL changed from <code>/api/auth/oauth2/callback/:id</code>
to <code>/api/auth/callback/:id</code></li>
<li><code>genericOAuthClient()</code> removed; generic OAuth providers
now use the standard social client APIs</li>
<li><code>pkce</code> defaults to <code>true</code> (was
<code>false</code>); set <code>pkce: false</code> for providers that
reject PKCE</li>
<li><code>authorizationUrlParams</code> and <code>tokenUrlParams</code>
only accept <code>Record&lt;string, string&gt;</code></li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/better-auth/better-auth/commit/ccd57c2dcb145a40a30c75ab3f6c89b94af08701"><code>ccd57c2</code></a>
docs(changelog): align v1.7 release notes with final behavior (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10846">#10846</a>)</li>
<li><a
href="https://github.com/better-auth/better-auth/commit/f577ec5c766c4ccd0a677ad18ca5f4f17b245289"><code>f577ec5</code></a>
chore: exit pre-release mode for v1.7.0</li>
<li><a
href="https://github.com/better-auth/better-auth/commit/69258d16709b977e519aa00a323ae54aea2b6164"><code>69258d1</code></a>
chore: sync main to next</li>
<li><a
href="https://github.com/better-auth/better-auth/commit/e84ec5e76d30e10fd692e8084177360484d538c1"><code>e84ec5e</code></a>
chore: release v1.6.30 (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10840">#10840</a>)</li>
<li><a
href="https://github.com/better-auth/better-auth/commit/bc93b27542cbdf74f6455e6f66a0b4292c247a12"><code>bc93b27</code></a>
chore: release v1.7.0-rc.6 (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10772">#10772</a>)</li>
<li><a
href="https://github.com/better-auth/better-auth/commit/58c49eb97f04ff18aa823318a3856a013353fdc2"><code>58c49eb</code></a>
chore: release v1.6.29 (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10809">#10809</a>)</li>
<li><a
href="https://github.com/better-auth/better-auth/commit/e6e1b4e8146a84d2a2c5fe2c497c81d03dfc2ad3"><code>e6e1b4e</code></a>
perf(db): replace sequential get-then-delete loop with parallel deletes
in de...</li>
<li><a
href="https://github.com/better-auth/better-auth/commit/80799e69314d4d13c875457d932545d54fbc7ada"><code>80799e6</code></a>
chore: sync main to next</li>
<li><a
href="https://github.com/better-auth/better-auth/commit/3e485bf730c62b4ef3df2e55198179c3d15b5a9f"><code>3e485bf</code></a>
docs(username): fix displayUsername release notes (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10776">#10776</a>)</li>
<li><a
href="https://github.com/better-auth/better-auth/commit/65fc17c755c3e2c8c77d5b401d612737764c219d"><code>65fc17c</code></a>
fix(deps): align <code>drizzle-orm</code> peer range with
drizzle-adapter (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10501">#10501</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/better-auth/better-auth/commits/v1.7.0/packages/better-auth">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pnpm-lock.yaml      | 106 ++++++++++++++++++++++----------------------
 server/package.json |   2 +-
 2 files changed, 54 insertions(+), 54 deletions(-)

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 6feb84c95b..fdcdd0a8b8 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -839,8 +839,8 @@ importers:
         specifier: ^3.0.1
         version: 3.0.1(ajv@8.20.0)
       better-auth:
-        specifier: 1.6.28
-        version: 1.6.28(@opentelemetry/api@1.9.1)(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@electric-sql/pglite@0.3.15)(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9)(sqlite3@5.1.7))(pg@8.18.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(vitest@4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.3.0))(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12)))
+        specifier: 1.7.0
+        version: 1.7.0(@opentelemetry/api@1.9.1)(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@electric-sql/pglite@0.3.15)(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9)(sqlite3@5.1.7))(pg@8.18.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(vitest@4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.3.0))(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12)))
       chokidar:
         specifier: ^5.0.0
         version: 5.0.0
@@ -1443,8 +1443,8 @@ packages:
       '@types/react':
         optional: true
 
-  '@better-auth/core@1.6.28':
-    resolution: {integrity: sha512-UzRh0Tx8OFmjl2iN+e+wNb3oZaBIXLw/DNgTotaEbatZdQePpekjq/0WBOHkLh6XEuOWQpF1VSJD8stgrQvP2Q==}
+  '@better-auth/core@1.7.0':
+    resolution: {integrity: sha512-tUYocrJx6vYyf0k9CTAgAYtUFFRZIrcwNIhG3+WSUQGTPrcyl/hbo29Y9ynF2LwOZOwIwWCiis1A6Iqej4jC/g==}
     peerDependencies:
       '@better-auth/utils': 0.4.2
       '@better-fetch/fetch': 1.3.1
@@ -1460,46 +1460,46 @@ packages:
       '@opentelemetry/api':
         optional: true
 
-  '@better-auth/drizzle-adapter@1.6.28':
-    resolution: {integrity: sha512-TXuiTUuAqwQ6vlLS4X2yPl+cqhqPBtbxsC8mqyVVpg5UlUmxPBv89iGDue/fROIqjHFX8rjkD5f8IiDTyOSlnw==}
+  '@better-auth/drizzle-adapter@1.7.0':
+    resolution: {integrity: sha512-PQ7kT9unMmRFl8u3iwri31Ztx3vluuWL4Lq/SRpOpdU5Y0BMII5zpNLfahY5DOVRg9SHAcnWjs0gcwRxxQMuWQ==}
     peerDependencies:
-      '@better-auth/core': ^1.6.28
+      '@better-auth/core': ^1.7.0
       '@better-auth/utils': 0.4.2
-      drizzle-orm: ^0.45.2
+      drizzle-orm: ^0.45.2 || >=1.0.0-rc.1 <2.0.0
     peerDependenciesMeta:
       drizzle-orm:
         optional: true
 
-  '@better-auth/kysely-adapter@1.6.28':
-    resolution: {integrity: sha512-EJ8qhdIvOAb+lisGIaWT4T1a8S2Fs2O22U+1GvTYhyra4+MVRakNLkn9og6rH2ILRibTpJ4itzanhpuWrkah3A==}
+  '@better-auth/kysely-adapter@1.7.0':
+    resolution: {integrity: sha512-hpLMMJiLGsLF35D6Z0dMRtyax4c1uKMRgCNeHs8v+hBVJr8gh+PuKTPAS4p7P9gAYSz74kqG+i/+Ot/EnBl6xA==}
     peerDependencies:
-      '@better-auth/core': ^1.6.28
+      '@better-auth/core': ^1.7.0
       '@better-auth/utils': 0.4.2
       kysely: ^0.28.17 || ^0.29.0
     peerDependenciesMeta:
       kysely:
         optional: true
 
-  '@better-auth/memory-adapter@1.6.28':
-    resolution: {integrity: sha512-fl000Re8x8RsXNooZ7BJEq19f5UMOnbdkQKkY5qQJmLwWo/Sa1ODkfj6Mq1knFkOdJ5e6ABU2lh3a8WyqSH2aA==}
+  '@better-auth/memory-adapter@1.7.0':
+    resolution: {integrity: sha512-87D5BW931Uh+ap8al7nPZZjLHK3Qje3KuvOJ4cJ9yLkb7n6+CLHJAbwJ8yDTe4RY52smCaMm+uEq3vCtlOmLUw==}
     peerDependencies:
-      '@better-auth/core': ^1.6.28
+      '@better-auth/core': ^1.7.0
       '@better-auth/utils': 0.4.2
 
-  '@better-auth/mongo-adapter@1.6.28':
-    resolution: {integrity: sha512-tJUmg7Z/TeOzpcdGceTkHVuyViVuHcradK1CFonLBuW4Vv+R5w8e2g9xuXOfjH4Wt9ZKd0LxyXWhpVVWWtyIQg==}
+  '@better-auth/mongo-adapter@1.7.0':
+    resolution: {integrity: sha512-2FPZ/gvFnkFWQowXmfcxL+Ae27ZFGmXSsldD7Z29Gneh17tJGPTPpIW22d/ci2J1+744f1bQku+PdCkbZ6j6JA==}
     peerDependencies:
-      '@better-auth/core': ^1.6.28
+      '@better-auth/core': ^1.7.0
       '@better-auth/utils': 0.4.2
       mongodb: ^6.0.0 || ^7.0.0
     peerDependenciesMeta:
       mongodb:
         optional: true
 
-  '@better-auth/prisma-adapter@1.6.28':
-    resolution: {integrity: sha512-Fr26MGainOZN6Oidz/AxiVDrHE5PN2v2z7hTlQGbHC4ZaVV8wrOt+QoQcJhQHZXJSzmOnVAQwW7dj3TWDbZhHA==}
+  '@better-auth/prisma-adapter@1.7.0':
+    resolution: {integrity: sha512-LLyyNaXzZrUZ4wLEp58JzpCgbQvuyZFCZqinqd8LTfMwuZG6Z+DEDKIkIsCfUb5wrZjUZ+v2o898EEO0yLHnwQ==}
     peerDependencies:
-      '@better-auth/core': ^1.6.28
+      '@better-auth/core': ^1.7.0
       '@better-auth/utils': 0.4.2
       '@prisma/client': ^5.0.0 || ^6.0.0 || ^7.0.0
       prisma: ^5.0.0 || ^6.0.0 || ^7.0.0
@@ -1509,10 +1509,10 @@ packages:
       prisma:
         optional: true
 
-  '@better-auth/telemetry@1.6.28':
-    resolution: {integrity: sha512-FTa0TTcW1/FsodjnmE1oisAXg6lMjKEhgQExNafF05oHW624Qrz7GU7eFuBV/0qj5Jn3yIYyOsbqkVTRvSwKnw==}
+  '@better-auth/telemetry@1.7.0':
+    resolution: {integrity: sha512-sIYgwq/Oc/QlgBGNjWju0gwa1hWlkrrpdTiPd7gGBMS9nzp+6l9zU6k6QFug6wjbDSzUsRHOZIXs2EIn9NcOFQ==}
     peerDependencies:
-      '@better-auth/core': ^1.6.28
+      '@better-auth/core': ^1.7.0
       '@better-auth/utils': 0.4.2
       '@better-fetch/fetch': 1.3.1
 
@@ -5309,8 +5309,8 @@ packages:
   bcrypt-pbkdf@1.0.2:
     resolution: {integrity: sha512-qeFIXtP4MSoi6NLqO12WfqARWWuCKi2Rn/9hJLEmtB5yTNr9DqFWkJRCf2qShWzPeAMRnOgCrq0sg/KLv5ES9w==}
 
-  better-auth@1.6.28:
-    resolution: {integrity: sha512-PW1y6mepLINbv04mimKbF3qjy4B/3ynG/Kc0jT3X+qepu1M+9UJJj3kS8parSnpT8cPEHWhu5sJCuL7iyMyddw==}
+  better-auth@1.7.0:
+    resolution: {integrity: sha512-azEG/7e4TLZ25TvvgcsolnzOzLfDFovdIYUb7xKeZQOm0p6Vj+rRKKaIvwE4MvXZCff6NAiIH2dMPl8O5yxI+A==}
     peerDependencies:
       '@lynx-js/react': '*'
       '@prisma/client': ^5.0.0 || ^6.0.0 || ^7.0.0
@@ -5318,8 +5318,8 @@ packages:
       '@tanstack/react-start': ^1.0.0
       '@tanstack/solid-start': ^1.0.0
       better-sqlite3: ^12.0.0
-      drizzle-kit: '>=0.31.4'
-      drizzle-orm: ^0.45.2
+      drizzle-kit: '>=0.31.4 || >=1.0.0-beta.1'
+      drizzle-orm: ^0.45.2 || >=1.0.0-rc.1 <2.0.0
       mongodb: ^6.0.0 || ^7.0.0
       mysql2: ^3.0.0
       next: ^14.0.0 || ^15.0.0 || ^16.0.0
@@ -7144,8 +7144,8 @@ packages:
     engines: {node: ^22 || ^24 || >=26}
     hasBin: true
 
-  nanostores@1.5.0:
-    resolution: {integrity: sha512-E0SrU7uLV/k4E6YbBIpQNDnRj00vgE5wlutM1sYVSAXDtHQosiRCGS9eKMKyiGg4ChXfDiJmTB+NCR3yXr6UAw==}
+  nanostores@1.5.2:
+    resolution: {integrity: sha512-B0UbxzK1s0CN8Xht6r+7iT5+xV8PTaRERR1nATeplRv1Rw5YLWfVAid0hkqY3EceqpG4RjTk8GAwIxQY39Rnwg==}
     engines: {node: ^20.0.0 || >=22.0.0}
 
   napi-build-utils@2.0.0:
@@ -9012,7 +9012,7 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.2.18
 
-  '@better-auth/core@1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0)':
+  '@better-auth/core@1.7.0(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.2)':
     dependencies:
       '@better-auth/utils': 0.4.2
       '@better-fetch/fetch': 1.3.1
@@ -9021,43 +9021,43 @@ snapshots:
       better-call: 1.4.0(zod@4.4.3)
       jose: 6.2.9
       kysely: 0.29.5
-      nanostores: 1.5.0
+      nanostores: 1.5.2
       zod: 4.4.3
     optionalDependencies:
       '@opentelemetry/api': 1.9.1
 
-  '@better-auth/drizzle-adapter@1.6.28(@better-auth/core@1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0))(@better-auth/utils@0.4.2)(drizzle-orm@0.45.2(@electric-sql/pglite@0.3.15)(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9)(sqlite3@5.1.7))':
+  '@better-auth/drizzle-adapter@1.7.0(@better-auth/core@1.7.0(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.2))(@better-auth/utils@0.4.2)(drizzle-orm@0.45.2(@electric-sql/pglite@0.3.15)(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9)(sqlite3@5.1.7))':
     dependencies:
-      '@better-auth/core': 1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0)
+      '@better-auth/core': 1.7.0(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.2)
       '@better-auth/utils': 0.4.2
     optionalDependencies:
       drizzle-orm: 0.45.2(@electric-sql/pglite@0.3.15)(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9)(sqlite3@5.1.7)
 
-  '@better-auth/kysely-adapter@1.6.28(@better-auth/core@1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0))(@better-auth/utils@0.4.2)(kysely@0.29.5)':
+  '@better-auth/kysely-adapter@1.7.0(@better-auth/core@1.7.0(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.2))(@better-auth/utils@0.4.2)(kysely@0.29.5)':
     dependencies:
-      '@better-auth/core': 1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0)
+      '@better-auth/core': 1.7.0(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.2)
       '@better-auth/utils': 0.4.2
     optionalDependencies:
       kysely: 0.29.5
 
-  '@better-auth/memory-adapter@1.6.28(@better-auth/core@1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0))(@better-auth/utils@0.4.2)':
+  '@better-auth/memory-adapter@1.7.0(@better-auth/core@1.7.0(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.2))(@better-auth/utils@0.4.2)':
     dependencies:
-      '@better-auth/core': 1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0)
+      '@better-auth/core': 1.7.0(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.2)
       '@better-auth/utils': 0.4.2
 
-  '@better-auth/mongo-adapter@1.6.28(@better-auth/core@1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0))(@better-auth/utils@0.4.2)':
+  '@better-auth/mongo-adapter@1.7.0(@better-auth/core@1.7.0(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.2))(@better-auth/utils@0.4.2)':
     dependencies:
-      '@better-auth/core': 1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0)
+      '@better-auth/core': 1.7.0(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.2)
       '@better-auth/utils': 0.4.2
 
-  '@better-auth/prisma-adapter@1.6.28(@better-auth/core@1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0))(@better-auth/utils@0.4.2)':
+  '@better-auth/prisma-adapter@1.7.0(@better-auth/core@1.7.0(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.2))(@better-auth/utils@0.4.2)':
     dependencies:
-      '@better-auth/core': 1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0)
+      '@better-auth/core': 1.7.0(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.2)
       '@better-auth/utils': 0.4.2
 
-  '@better-auth/telemetry@1.6.28(@better-auth/core@1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)':
+  '@better-auth/telemetry@1.7.0(@better-auth/core@1.7.0(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.2))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)':
     dependencies:
-      '@better-auth/core': 1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0)
+      '@better-auth/core': 1.7.0(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.2)
       '@better-auth/utils': 0.4.2
       '@better-fetch/fetch': 1.3.1
 
@@ -12711,15 +12711,15 @@ snapshots:
     dependencies:
       tweetnacl: 0.14.5
 
-  better-auth@1.6.28(@opentelemetry/api@1.9.1)(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@electric-sql/pglite@0.3.15)(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9)(sqlite3@5.1.7))(pg@8.18.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(vitest@4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.3.0))(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))):
+  better-auth@1.7.0(@opentelemetry/api@1.9.1)(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@electric-sql/pglite@0.3.15)(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9)(sqlite3@5.1.7))(pg@8.18.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(vitest@4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.3.0))(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))):
     dependencies:
-      '@better-auth/core': 1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0)
-      '@better-auth/drizzle-adapter': 1.6.28(@better-auth/core@1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0))(@better-auth/utils@0.4.2)(drizzle-orm@0.45.2(@electric-sql/pglite@0.3.15)(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9)(sqlite3@5.1.7))
-      '@better-auth/kysely-adapter': 1.6.28(@better-auth/core@1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0))(@better-auth/utils@0.4.2)(kysely@0.29.5)
-      '@better-auth/memory-adapter': 1.6.28(@better-auth/core@1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0))(@better-auth/utils@0.4.2)
-      '@better-auth/mongo-adapter': 1.6.28(@better-auth/core@1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0))(@better-auth/utils@0.4.2)
-      '@better-auth/prisma-adapter': 1.6.28(@better-auth/core@1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0))(@better-auth/utils@0.4.2)
-      '@better-auth/telemetry': 1.6.28(@better-auth/core@1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)
+      '@better-auth/core': 1.7.0(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.2)
+      '@better-auth/drizzle-adapter': 1.7.0(@better-auth/core@1.7.0(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.2))(@better-auth/utils@0.4.2)(drizzle-orm@0.45.2(@electric-sql/pglite@0.3.15)(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9)(sqlite3@5.1.7))
+      '@better-auth/kysely-adapter': 1.7.0(@better-auth/core@1.7.0(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.2))(@better-auth/utils@0.4.2)(kysely@0.29.5)
+      '@better-auth/memory-adapter': 1.7.0(@better-auth/core@1.7.0(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.2))(@better-auth/utils@0.4.2)
+      '@better-auth/mongo-adapter': 1.7.0(@better-auth/core@1.7.0(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.2))(@better-auth/utils@0.4.2)
+      '@better-auth/prisma-adapter': 1.7.0(@better-auth/core@1.7.0(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.2))(@better-auth/utils@0.4.2)
+      '@better-auth/telemetry': 1.7.0(@better-auth/core@1.7.0(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.2))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)
       '@better-auth/utils': 0.4.2
       '@better-fetch/fetch': 1.3.1
       '@noble/ciphers': 2.3.0
@@ -12728,7 +12728,7 @@ snapshots:
       defu: 6.1.7
       jose: 6.2.9
       kysely: 0.29.5
-      nanostores: 1.5.0
+      nanostores: 1.5.2
       zod: 4.4.3
     optionalDependencies:
       drizzle-kit: 0.31.10
@@ -14930,7 +14930,7 @@ snapshots:
 
   nanoid@6.0.1: {}
 
-  nanostores@1.5.0: {}
+  nanostores@1.5.2: {}
 
   napi-build-utils@2.0.0:
     optional: true
diff --git a/server/package.json b/server/package.json
index fa31868a7e..c4bb50fc7a 100644
--- a/server/package.json
+++ b/server/package.json
@@ -63,7 +63,7 @@
     "@paperclipai/hermes-paperclip-adapter": "workspace:*",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
-    "better-auth": "1.6.28",
+    "better-auth": "1.7.0",
     "chokidar": "^5.0.0",
     "detect-port": "^2.1.0",
     "dompurify": "^3.4.13",