build(deps): bump better-auth from 1.4.18 to 1.6.20 (#8464)
Bumps
[better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth)
from 1.4.18 to 1.6.20.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/better-auth/better-auth/releases">better-auth's
releases</a>.</em></p>
<blockquote>
<h2>v1.6.20</h2>
<h2><code>better-auth</code></h2>
<h3>Bug Fixes</h3>
<ul>
<li>Fixed account-linking logs to route through the configured logger
(<a
href="https://redirect.github.com/better-auth/better-auth/pull/10121">#10121</a>)</li>
<li>Fixed TypeScript inference errors by declaring inherited
<code>APIError</code> properties (<a
href="https://redirect.github.com/better-auth/better-auth/pull/8734">#8734</a>)</li>
<li>Fixed refresh cookie <code>Max-Age</code> to be capped at
<code>expiresIn</code> (<a
href="https://redirect.github.com/better-auth/better-auth/pull/9621">#9621</a>)</li>
</ul>
<p>For detailed changes, see <a
href="c342f42fff/packages/better-auth/CHANGELOG.md"><code>CHANGELOG</code></a></p>
<h2><code>@better-auth/i18n</code></h2>
<h3>Bug Fixes</h3>
<ul>
<li>Fixed English language fallback behavior and improved i18n
documentation (<a
href="https://redirect.github.com/better-auth/better-auth/pull/9872">#9872</a>)</li>
</ul>
<p>For detailed changes, see <a
href="c342f42fff/packages/i18n/CHANGELOG.md"><code>CHANGELOG</code></a></p>
<h2>Contributors</h2>
<p>Thanks to everyone who contributed to this release:</p>
<p><a
href="https://github.com/adityachaudhary99"><code>@adityachaudhary99</code></a>,
<a href="https://github.com/dipan-ck"><code>@dipan-ck</code></a>, <a
href="https://github.com/sleepe229"><code>@sleepe229</code></a>, <a
href="https://github.com/WilsonnnTan"><code>@WilsonnnTan</code></a></p>
<p><strong>Full changelog:</strong> <a
href="https://github.com/better-auth/better-auth/compare/v1.6.19...v1.6.20"><code>v1.6.19...v1.6.20</code></a></p>
<h2>v1.6.19</h2>
<h2><code>better-auth</code></h2>
<h3>Features</h3>
<ul>
<li>Added support for pre-binding device codes to a specific user in the
device authorization plugin (<a
href="https://redirect.github.com/better-auth/better-auth/pull/9995">#9995</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>Fixed headerless session checks (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10053">#10053</a>)</li>
<li>Fixed cookie cache fallback lookup (<a
href="https://redirect.github.com/better-auth/better-auth/pull/9348">#9348</a>)</li>
<li>Fixed <code>sendVerificationEmail</code> errors not being surfaced
to the client (<a
href="https://redirect.github.com/better-auth/better-auth/pull/8863">#8863</a>)</li>
<li>Fixed auth client return types not being emitted correctly in
TypeScript declaration builds (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10071">#10071</a>)</li>
<li>Fixed session and account cache cookies being silently dropped when
near the browser's per-cookie size limit by splitting them into chunks
(<a
href="https://redirect.github.com/better-auth/better-auth/pull/10088">#10088</a>)</li>
<li>Fixed single-use verification flows (such as magic-link) hanging on
connection-limited database adapters by reusing active transactions (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10070">#10070</a>)</li>
<li>Fixed the domain not being included when clearing cross-subdomain
cookies in the <code>last-login-method</code> plugin (<a
href="https://redirect.github.com/better-auth/better-auth/pull/9319">#9319</a>)</li>
<li>Fixed the <code>oauth-popup</code> plugin leaking internal OAuth
state keys into <code>additionalData</code> (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10067">#10067</a>)</li>
<li>Reverted the headerless session check fix (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10074">#10074</a>)</li>
</ul>
<p>For detailed changes, see <a
href="ac4d81df74/packages/better-auth/CHANGELOG.md"><code>CHANGELOG</code></a></p>
<h2><code>auth</code></h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md">better-auth's
changelog</a>.</em></p>
<blockquote>
<h2>1.6.20</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10121">#10121</a>
<a
href="21448b1b77"><code>21448b1</code></a>
Thanks <a
href="https://github.com/adityachaudhary99"><code>@adityachaudhary99</code></a>!
- OAuth account-linking and create-user error logs now respect a custom
<code>logger</code> configured in <code>betterAuth()</code>, instead of
always being written to the default console logger.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/9621">#9621</a>
<a
href="8ecf23817f"><code>8ecf238</code></a>
Thanks <a
href="https://github.com/dipan-ck"><code>@dipan-ck</code></a>! -
Session refresh no longer emits a cookie Max-Age above the browser's
400-day ceiling when using a database without fractional-second
precision.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/8734">#8734</a>
<a
href="930f5341d9"><code>930f534</code></a>
Thanks <a
href="https://github.com/sleepe229"><code>@sleepe229</code></a>! -
declare inherited APIError properties to fix TypeScript inference
errors</p>
</li>
<li>
<p>Updated dependencies []:</p>
<ul>
<li><code>@better-auth/core</code><a
href="https://github.com/1"><code>@1</code></a>.6.20</li>
<li><code>@better-auth/drizzle-adapter</code><a
href="https://github.com/1"><code>@1</code></a>.6.20</li>
<li><code>@better-auth/kysely-adapter</code><a
href="https://github.com/1"><code>@1</code></a>.6.20</li>
<li><code>@better-auth/memory-adapter</code><a
href="https://github.com/1"><code>@1</code></a>.6.20</li>
<li><code>@better-auth/mongo-adapter</code><a
href="https://github.com/1"><code>@1</code></a>.6.20</li>
<li><code>@better-auth/prisma-adapter</code><a
href="https://github.com/1"><code>@1</code></a>.6.20</li>
<li><code>@better-auth/telemetry</code><a
href="https://github.com/1"><code>@1</code></a>.6.20</li>
</ul>
</li>
</ul>
<h2>1.6.19</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10088">#10088</a>
<a
href="de4aa52e99"><code>de4aa52</code></a>
Thanks <a href="https://github.com/bytaesu"><code>@bytaesu</code></a>!
- Session and account cache cookies near the browser's per-cookie size
limit (for example with a long <code>cookiePrefix</code> or many cached
fields) are now split into chunks instead of being silently dropped by
the browser. A cache too large to fit even when chunked is skipped with
a warning rather than failing the request, so reads fall back to the
database.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/9995">#9995</a>
<a
href="b4b02660c7"><code>b4b0266</code></a>
Thanks <a
href="https://github.com/ElGauchooooo"><code>@ElGauchooooo</code></a>!
- The device authorization plugin now accepts an optional
<code>user_id</code> when issuing a device code via
<code>/device/code</code>, pre-binding the code to that user. Only the
bound user can approve or deny the code, so a publicly visible user code
can no longer be claimed by someone else.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10086">#10086</a>
<a
href="5bd5e1cc73"><code>5bd5e1c</code></a>
Thanks <a
href="https://github.com/gustavovalverde"><code>@gustavovalverde</code></a>!
- Refresh-token rotation and token revocation, two-factor backup-code
regeneration, device-code claiming, and organization invitation
acceptance now work on Prisma. Concurrent or repeat requests in these
flows could previously return an error on Prisma instead of the expected
result.</p>
<p>On MongoDB servers older than 5.0, these flows and other guarded
value updates (rate-limit window resets, API-key refills) no longer fail
with an empty-update error.</p>
<p><code>@better-auth/core</code>: <code>incrementOne</code> now reports
a clear error when called with no <code>increment</code> and no
<code>set</code>.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/9319">#9319</a>
<a
href="581f8271fb"><code>581f827</code></a>
Thanks <a
href="https://github.com/ping-maxwell"><code>@ping-maxwell</code></a>!
- fix(last-login-method): include domain when clearing cross-subdomain
cookies</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10067">#10067</a>
<a
href="840788502a"><code>8407885</code></a>
Thanks <a href="https://github.com/bytaesu"><code>@bytaesu</code></a>!
- The <code>oauth-popup</code> plugin now ignores internal OAuth state
fields passed through its <code>additionalData</code> parameter, so
<code>additionalData</code> only ever carries your own custom
values.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/9555">#9555</a>
<a
href="c1a8a64c14"><code>c1a8a64</code></a>
Thanks <a
href="https://github.com/ChrisMGeo"><code>@ChrisMGeo</code></a>! - Fix
invalid OpenAPI output for Better Auth callback, session, and passkey
routes so client generators can consume the schema.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10071">#10071</a>
<a
href="635f190870"><code>635f190</code></a>
Thanks <a
href="https://github.com/gustavovalverde"><code>@gustavovalverde</code></a>!
- Auth clients exported from wrapper packages can now be emitted in
TypeScript declaration builds without extra type annotations.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10070">#10070</a>
<a
href="a787e0b66b"><code>a787e0b</code></a>
Thanks <a
href="https://github.com/gustavovalverde"><code>@gustavovalverde</code></a>!
- Single-use verification flows no longer hang on database adapters that
use a one-connection pool. This fixes magic-link verification and
similar token checks in connection-limited serverless database
setups.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/9348">#9348</a>
<a
href="c2f718fcde"><code>c2f718f</code></a>
Thanks <a
href="https://github.com/ping-maxwell"><code>@ping-maxwell</code></a>!
- fix: cookie cache fallback lookup</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/8863">#8863</a>
<a
href="7d18175637"><code>7d18175</code></a>
Thanks <a
href="https://github.com/ping-maxwell"><code>@ping-maxwell</code></a>!
- <code>sendVerificationEmail</code> was invoked via
<code>runInBackgroundOrAwait</code>, which could defer work when
<code>advanced.backgroundTasks.handler</code> is configured (so the
handler could return <strong>200</strong> before the email callback
finished) and, in the default path, <strong>caught and logged errors
without rethrowing</strong>. User callbacks that throw
<code>APIError</code> (e.g. <strong>429</strong> from a rate limiter)
were therefore not reliably reflected in the HTTP response (<a
href="https://redirect.github.com/better-auth/better-auth/issues/8757">better-auth/better-auth#8757</a>).</p>
<p>Now we await <code>sendVerificationEmailFn</code> so failures surface
to the client with the correct status. The unauthenticated
<code>/send-verification-email</code> path enforces a constant-time
floor (500 ms) so that the response duration does not reveal whether the
email belongs to a real unverified user.</p>
</li>
<li>
<p>Updated dependencies [<a
href="08959936d2"><code>0895993</code></a>,
<a
href="5bd5e1cc73"><code>5bd5e1c</code></a>,
<a
href="a787e0b66b"><code>a787e0b</code></a>]:</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="c342f42fff"><code>c342f42</code></a>
chore: release v1.6.20 (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10108">#10108</a>)</li>
<li><a
href="21448b1b77"><code>21448b1</code></a>
fix: route account-linking logs through the configured logger (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10121">#10121</a>)</li>
<li><a
href="8ecf23817f"><code>8ecf238</code></a>
fix(session): cap refresh cookie Max-Age at expiresIn (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/9621">#9621</a>)</li>
<li><a
href="ac4d81df74"><code>ac4d81d</code></a>
chore: release v1.6.19 (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10034">#10034</a>)</li>
<li><a
href="1e69725027"><code>1e69725</code></a>
docs: clarify stateless Cognito token refresh (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10092">#10092</a>)</li>
<li><a
href="de4aa52e99"><code>de4aa52</code></a>
fix(cookies): chunk session and account cookies near the browser size
limit (...</li>
<li><a
href="5bd5e1cc73"><code>5bd5e1c</code></a>
fix: make guarded state transitions portable on Prisma (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10086">#10086</a>)</li>
<li><a
href="36f345b1bc"><code>36f345b</code></a>
revert: fix: allow headerless get session checks (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10053">#10053</a>)
(<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10074">#10074</a>)</li>
<li><a
href="635f190870"><code>635f190</code></a>
fix(client): name auth client return types (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10071">#10071</a>)</li>
<li><a
href="d009daedc7"><code>d009dae</code></a>
fix: allow headerless get session checks (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10053">#10053</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/better-auth/better-auth/commits/v1.6.20/packages/better-auth">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for better-auth since your current version.</p>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Nicky Leach <nicky@paperclip.ing>
Co-authored-by: Paperclip <noreply@paperclip.ing>
72d4f2ad99