deps: update dependency better-auth to v1.4.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
better-auth (source)	1.3.34 -> 1.4.1

---

Release Notes

better-auth/better-auth (better-auth)

v1.4.1

Compare Source

   🚀 Features

• api-key: Support secondary storage  -  by @​ping-maxwell and @​Bekacru in #​6014 (44308)

   🐞 Bug Fixes

• Custom fn field default values should be properly evaluted  -  by @​Bekacru and Copilot in #​6212 (590a2)
• jwt: Retrieve latest keys from storage properly  -  by @​Bekacru in #​6208 (6aca4)
• passkey: Change generate-authenticate-options from POST to GET  -  by @​mburumaxwell in #​6199 (f922c)

    View changes on GitHub

v1.4.0

Compare Source

   🚀 Features

• Bypass transaction with async local storage  -  by @​himself65 in #​4711 (52af6)
• Add returnHeaders to getSession  -  by @​frectonz in #​3983 (19d4b)
• Waku integration guide  -  by @​rmarscher in #​3990 (3e75a)
• Add support for custom callback for authorization url  -  by @​Bekacru in #​4919 (78506)
• Additional fields on account  -  by @​dvanmali in #​4935 (bf0ac)
• Add support for custom callback for token url  -  by @​acusti in #​5027 (6bb94)
• Enum support for drizzle schema  -  by @​himself65 in #​5287 (fd780)
• Nextjs 16 guide  -  by @​Kinfe123 and @​himself65 in #​5296 (8db97)
• Add storeStateStrategy  -  by @​himself65 and Copilot in #​5470 (b5f3b)
• Enhance PostgreSQL support for non-public schema by respecting search_path configuration  -  by @​okisdev in #​5449 (bef33)
• Add polar oauth provider  -  by @​ephraimduncan in #​5506 (4b075)
• Session store chunking  -  by @​himself65 and Copilot in #​5645 (0aa6d)
• Stateless session management  -  by @​Bekacru, Copilot, @​ping-maxwell and @​himself65 in #​5601 (afce9)
• Esm only  -  by @​himself65 in #​5703 (b6977)
• Implement automatic server-side IP detection  -  by @​GautamBytes in #​5695 (06e8c)
• Async import in getAdapter  -  by @​himself65 in #​5722 (10249)
• Improved API error page  -  by @​ping-maxwell and @​Bekacru in #​5272 (f9964)
• Add request state  -  by @​himself65 in #​5742 (cea5b)
• Add support for uuids  -  by @​Bekacru in #​5809 (4ac34)
• Auto-index CLI  -  by @​ping-maxwell and @​Bekacru in #​5357 (af6eb)
• Expose additional http methods  -  by @​jonathansamines and @​Bekacru in #​5754 (956e2)
• better-auth/minimal  -  by @​bytaesu and @​Bekacru in #​5704 (1ebc6)
• Add support for custom response status codes  -  by @​jonathansamines and @​Bekacru in #​5806 (fa595)
• Support pass raw function as middleware  -  by @​himself65 in #​5888 (48a20)
• Support pass raw function as middleware "  -  by @​himself65 in #​5888 (a391a)
• Adapter join support  -  by @​ping-maxwell in #​5730 (f5bbb)
• Refactor fetch plugins config disableDefaultFetchPlugins to include userAgentPlugin  -  by @​kaandok and @​himself65 in #​6020 (8e754)
• Utilize database joins across better-auth  -  by @​ping-maxwell in #​6004 (e9f5b)
• Support storing account data in a cookie  -  by @​Bekacru in #​6013 (06606)
• Adding support for SCIM provisioning  -  by @​jonathansamines in #​5685 (ffa29)
• Add support for organization slug on list members  -  by @​Bekacru in #​5862 (31a81)
• anonymous:
  • Support phone number verification for account linking  -  by @​Bekacru in #​5294 (07654)
  • Allow customizing random email generator  -  by @​bytaesu in #​5922 (5d168)
• captcha:
  • Add support for CaptchaFox  -  by @​tgrassl in #​4944 (e03e5)
• cli:
  • Add mcp client configs from cli  -  by @​Kinfe123 and @​himself65 in #​4872 (70cb4)
  • Support Cloudflare Workers virtual module imports  -  by @​chhoumann in #​5559 (cf050)
• client:
  • Refetch session when browser state changes  -  by @​himself65 and Copilot in #​5630 (522cf)
  • Add type helper AuthClient  -  by @​himself65 in #​5815 (7caa2)
  • Introduce disableSignal client option  -  by @​ping-maxwell in #​6108 (f4c43)
• core:
  • Replace ZodType with @standard-schema/spec  -  by @​himself65 in #​5629 (36315)
• db:
  • Delete hooks  -  by @​Kinfe123 and @​himself65 in #​4792 (eb76a)
• device-authorization:
  • Add verification uri  -  by @​bytaesu and @​himself65 in #​5451 (8b2b6)
• discord:
  • Allow specification of permissions  -  by @​TheUntraceable and @​Bekacru in #​4717 (69c9b)
• docs:
  • Adding missing auth & colour in builder  -  by @​okisdev in #​5982 (63518)
• email-otp:
  • Allow returning undefined in generateOTP  -  by @​ping-maxwell in #​4723 (8ac4f)
• expo:
  • Support multiple cookie prefixes for better-auth detection  -  by @​himself65 in #​6080 (f5285)
• generic-oauth:
  • Provide pre configured provider helpers  -  by @​Paola3stefania in #​6085 (07b7e)
  • Add custom token exchange support for non-standard providers  -  by @​bytaesu in #​6179 (0ac6a)
• jwt:
  • Support custom adapter option for jwt  -  by @​Bekacru in #​5812 (10cee)
  • Add JWT verification endpoint and refactor verification logic  -  by @​himself65 in #​6122 (18cf7)
  • Add key rotation  -  by @​Bekacru, Copilot and @​Paola3stefania in #​6147 (0bd9b)
• last-login-method:
  • Update OAuth login method tracking for multiple auth type  -  by @​Kinfe123 in #​4693 (5e7b5)
  • Add support for 'siwe' as a last login method and added tests  -  by @​rovertrack in #​6027 (08316)
• mongodb:
  • Support string IDs over ObjectIDs  -  by @​ping-maxwell and @​ahmedriad1 in #​5384 (0dfe6)
• oauth-proxy:
  • Stateless mode compatibility  -  by @​bytaesu and Copilot in #​6131 (05fa1)
• oidc-provider:
  • Add RP-Initiated Logout endpoint  -  by @​himself65 and Copilot in #​6094 (c9085)
• organization:
  • Support createdAt on invitations  -  by @​iRoachie and @​himself65 in #​2346 (fc321)
  • Refactor organization schema to use BetterAuth types  -  by @​himself65 in #​5515 (a58f1)
• passkey:
  • Allow multiple passkey origins  -  by @​kevcube in #​4800 (3783b)
• paybin:
  • Add Paybin OAuth provider  -  by @​redoh and Copilot in #​5626 (b5813)
• phone-number:
  • Allow custom verifyOTP implementation  -  by @​bytaesu and @​zain in #​5926 (b855a)
• plugin-openapi:
  • Allow passing nonce for CSP  -  by @​GautamBytes in #​5751 (fa147)
• prisma:
  • Enhance JSON default value handling for arrays and objects in schema generation  -  by @​rovertrack in #​5904 (09162)
• session:
  • Use JWE for cookie cache by default  -  by @​himself65 in #​5510 (f654b)
• sso:
  • DefaultSSO options and ACS endpoint  -  by @​Kinfe123 and @​Bekacru in #​3660 (b3ead)
  • Provide default service provider metadata  -  by @​dvanmali in #​4866 (e892a)
  • Add option to provide login hint  -  by @​tnkuehne and Copilot in #​5283 (6f231)
  • Add domain verification for SSO providers  -  by @​jonathansamines and @​ping-maxwell in #​5910 (da965)
• stripe:
  • Upgrade stripe support to v19.1.0  -  by @​okisdev in #​5346 (3a8f4)
  • Add StripePlugin type  -  by @​himself65 in #​5509 (34431)
  • Allow any scheme  -  by @​hyoban, @​Bekacru and Copilot in #​5725 (2451c)
  • Allow flexible types in plan limits  -  by @​bytaesu and @​Bekacru in #​5821 (4011c)

   🐞 Bug Fixes

• Device authorization plugin  -  by @​bytaesu in #​4695 (b9cbd)
• Device authorization plugin  -  by @​bytaesu in #​4695 (c3001)
• Reduce any type in generator.ts  -  by @​himself65 in #​4710 (0770c)
• Refresh secondary storage sessions on user update  -  by @​frectonz in #​4522 (ea89d)
• Allow disable database transaction  -  by @​himself65 in #​4733 (a8776)
• Wrap Math.floor around the division when calculating TTL  -  by @​DevDuki, Dusan Misic, ping-maxwell and @​himself65 in #​4768 (14b9e)
• Ttl sessions list expiration  -  by @​dvanmali in #​3836 (57e04)
• Tests failing due to clock drift  -  by @​dvanmali in #​4915 (63ca1)
• Refresh secondary storage sessions on user update  -  by @​frectonz in #​4522 (ccc7c)
• Refresh secondary storage sessions on user update  -  by @​frectonz in #​4522 (f1b0a)
• Support compressed ipv6 format  -  by @​Velka-DEV in #​4982 (d8f11)
• Add required constraint to slug filed in org plugin  -  by @​bytaesu in #​4989 (0581a)
• Use consistent messaging on requestPasswordReset  -  by @​Eazash in #​5014 (2f94b)
• Cookie size limit shouldn't throw error  -  by @​Bekacru and @​himself65 in #​5031 (72ecc)
• Handle symbols in proxy get trap to prevent TypeError  -  by @​zbeyens and @​himself65 in #​4924 (8d46c)
• Ttl for rate limited secondary storage  -  by @​dvanmali in #​4961 (f246d)
• Properly encode callback url for email verificaiton  -  by @​Bekacru in #​5052 (41d2e)
• Session update database hook should expect partial session type  -  by @​Bekacru in #​5056 (ade06)
• Deprecate options.advanced.generateId type  -  by @​himself65 (48249)
• Api keys should properly check if a request is from client or server  -  by @​Bekacru (2e236)
• Refactor account deletion functions to trigger database hooks  -  by @​xuchenhao001 in #​5114 (dade3)
• Improve username transformation logic  -  by @​ping-maxwell in #​5115 (b2a9e)
• Ensure falsy values are valid default values  -  by @​ocherry341 in #​5182 (03d62)
• Import node:async_hooks directly  -  by @​himself65 in #​5198 (0717e)
• Undeclared variable reference on docs  -  by @​Kinfe123 in #​5235 (6d6df)
• Argument where of type TwoFactorWhereUniqueInput needs at least one of id arguments  -  by @​AlexStrNik in #​5180 (2dab4)
• Mobile ai search responsiveness  -  by @​Kinfe123 in #​5269 (08d95)
• Type compatibility with exactOptionalPropertyTypes  -  by @​Kinfe123 and @​himself65 in #​5236 (f2723)
• Remove deprecated ssoClient export from client plugin  -  by @​Kinfe123 in #​5307 (ee229)
• GetAcccessToken refresh should properly refresh when oauth tokens are encrypted  -  by @​bsklaroff in #​5094 (16236)
• Resolve custom URL scheme origin matching with wildcards  -  by @​AntonVishal and antonvishal in #​5248 (82de6)
• Respect additionalFields returned config for user data when setting cookie cache  -  by @​ahmed-abdat and @​Bekacru in #​5327 (a048f)
• Correct type HookEndpointContext and InternalContext  -  by @​himself65 in #​5359 (89475)
• Add optional chaining for process.platform  -  by @​bytaesu in #​5390 (f547d)
• User-agent requirement when fetching from clients  -  by @​dvanmali in #​5420 (5deb8)
• Unused peer dependency  -  by @​himself65 in #​5465 (3a343)
• Rename sha to branch and made it canary by default  -  by @​max-programming in #​5491 (5bc26)
• Remove deprecated forgetPassword endpoints  -  by @​bytaesu in #​5455 (7b62d)
• Respect onAPIError.errorURL in OAuth callback flow  -  by @​GautamBytes and @​ping-maxwell in #​5523 (9c51f)
• Call db hooks when calling deleteUser  -  by @​ping-maxwell in #​5553 (216dc)
• Allow user update to handle additional fields and validation  -  by @​Bekacru (9c508)
• Missing email validation  -  by @​ahmedriad1 and @​ping-maxwell in #​5593 (bf8e9)
• Urls without protocol shouldn't be able to satisfy a wildcard origin  -  by @​Bekacru in #​5624 (8b355)
• Use standard validator  -  by @​himself65 in #​5627 (285e3)
• Add undefined type for optional property types  -  by @​himself65 in #​5654 (b6d40)
• Type mismatch for 'banned' on UserWithRole  -  by @​GautamBytes in #​5701 (6d7e3)
• Delete duplicate email existence check in changeEmail endpoint  -  by @​DevDuki and Dusan Misic in #​5699 (c6241)
• Add missing userId in listAccounts response  -  by @​bytaesu in #​5731 (9d4ef)
• Trigger use session on revoke sessions  -  by @​Bekacru in #​5761 (e62d3)
• string[] inference for additionalFields  -  by @​GautamBytes in #​5778 (414d0)
• Unsanitized endpoints provided dates will cause DB insert failure  -  by @​ping-maxwell and @​Bekacru in #​5042 (5c8dd)
• Update hooks return should merge with original data  -  by @​Bekacru in #​5852 (0d41f)
• Dont trigger session refresh on magic-link sign-in  -  by @​ping-maxwell in #​5221 (e843e)
• Treat generateId "serial" as numeric ID and correct UUID column types across adapters  -  by @​ping-maxwell in #​5823 (705f7)
• Validate baseURL protocol and improve error messages  -  by @​dmmulroy in #​5902 (1c0ac)
• Use ctx over request in plugin options  -  by @​ping-maxwell in #​5944 (448d7)
• Use identity instead of serial for pg schema  -  by @​ping-maxwell in #​5943 (b3927)
• Zoom refresh token  -  by @​borgoat in #​5992 (0eb6b)
• /change-email should trigger session signal  -  by @​ping-maxwell in #​6025 (3abc8)
• Resolve SESSION_IS_NOT_FRESH error with cookieCache  -  by @​GautamBytes in #​6031 (c4ee4)
• Preserve provided string IDs in the MongoDB adapter when they are not valid ObjectId  -  by @​udnes99 in #​6033 (8a5df)
• GenericOAuth and SSO ignore discoveryUrl for authorization  -  by @​GautamBytes in #​6057 (99e57)
• Remove active session requirement for change email verification  -  by @​Bekacru in #​6106 (4d2a8)
• adapter:
  • Returning null as string for optional id references  -  by @​jslno in #​4713 (23b87)
  • Use updated field values in WHERE clause during update  -  by @​QuintenStr and @​ping-maxwell in #​5004 (c8f47)
  • Foreign keys that are nullable on number ids can return string of null  -  by @​ping-maxwell in #​5036 (68608)
  • Ensure transaction function is implemented in the adapter  -  by @​himself65 in #​5046 (246a2)
  • Missing data type transformation on where clauses  -  by @​ping-maxwell in #​5158 (4b136)
  • Inconsistent mongo ends_with query  -  by @​ping-maxwell in #​5160 (cd006)
  • Kysely with CamelCasePlugin breaks for OIDC.  -  by @​ping-maxwell in #​5078 (e9157)
  • Should not apply defaultValue during find calls  -  by @​ping-maxwell in #​5779 (97c97)
  • Drizzle deleteMany result should be a number  -  by @​ping-maxwell in #​5682 (191f1)
• adapters:
  • Mongodb id issue  -  by @​okisdev and @​ping-maxwell in #​5686 (c4890)
• admin:
  • Stricter body validation with the setUserPassword api  -  by @​hieudien14310 and @​ping-maxwell in #​5075 (3b863)
  • Validate admin role updates against the configured roles to prevent setting a non-existent role  -  by @​hieudien14310 in #​4842 (dda1e)
• anonymous:
  • Provide ctx on accountLink  -  by @​ping-maxwell in #​5389 (0b0de)
  • isAnonymous should default to false instead of null  -  by @​ping-maxwell in #​6026 (da374)
• api-key:
  • Cascade api keys on user deletion  -  by @​ping-maxwell in #​4703 (d4e9c)
  • Cascade api keys on user deletion  -  by @​ping-maxwell in #​4703 (c72c3)
  • Calling client on server side  -  by @​himself65 in #​4777 (dda55)
  • Correct refill interval time calculation  -  by @​Pankaj3112 and @​himself65 in #​4871 (e2c3c)
  • Shouldn't issue api key a mock session by default  -  by @​Bekacru (e9342)
  • Don't update the lastRequest when calling updateApiKey  -  by @​ping-maxwell in #​5318 (6c93c)
  • Remove incorrect usage tracking in updateApiKey  -  by @​ahmed-abdat and @​Bekacru in #​5325 (07d99)
• better-auth:
  • Moved email verification check after password check  -  by @​QuintenStr in #​4835 (2f0f1)
• cli:
  • DefaultNow is deprecated in schema for Drizzle with SQLite  -  by @​himself65 in #​4889 (831dd)
  • Timestamp in schema for Drizzle with SQLite  -  by @​zy1p in #​4622 (98145)
  • Move type dependencies to devDependencies  -  by @​bdkopen in #​5712 (ea1bc)
• client:
  • BaseURL is undefined for SSR  -  by @​himself65 in #​4760 (a208c)
  • Add lynx client exports  -  by @​JagritGumber in #​4950 (f556b)
  • Missing isRefetching type in react useSession  -  by @​ThibautCuchet in #​5166 (af4a4)
  • Ensure refetchInterval triggers active network request  -  by @​GautamBytes and @​himself65 in #​6032 (9571c)
• cookie:
  • SameSite to "none" for oauth state  -  by @​himself65 in #​5748 (324a2)
  • SameSite to "none" for oauth state "  -  by @​Bekacru in #​5748 (956eb)
• core:
  • Correctly set typesVersions paths  -  by @​XiNiHa in #​5427 (38aa4)
• create-adapter:
  • Disable transaction by default  -  by @​ping-maxwell in #​4750 (64c5a)
• custom-session:
  • Don't overwrite the Set-Cookie header  -  by @​frectonz in #​4388 (5de83)
  • Infer.Session to infer the return type of the custom session  -  by @​Bekacru in #​5009 (c70ea)
• db:
  • onDelete is ignored  -  by @​himself65 in #​4973 (7e8de)
  • Postgres - explicitly define pg_catalog for gen_random_uuid()  -  by @​mrl5 and Jakub Kołodziejczak in #​5832 (b1b6c)
• deps:
  • Update dependency @​nanostores/react to v1  -  in #​4963 (9f54f)
• device-authorization:
  • Fix client error type for deny device  -  by @​3ddelano in #​5022 (f3ffe)
  • Sanitize user code input on device approve  -  by @​Bekacru in #​6143 (13a83)
• docs:
  • Set default tab to next-js since react was not listed  -  by @​mohit4bug in #​4803 (6e891)
  • Anchor link scrolling with conflict prevention  -  by @​Kinfe123 in #​5186 (91778)
  • Enable code block copying in documentation page  -  by @​vagxrth in #​5525 (da907)
• drizzle:
  • Replace pgEnum with text enum type in Drizzle schema generation  -  by @​eni4sure in #​5408 (03fbf)
• drizzle-adapter:
  • Handle all operators in multiple where conditions  -  by @​Kinfe123 and [@​ping-maxwell](https://redirect

---

Configuration

📅 Schedule: Branch creation - "after 10:00 before 18:00 every weekday" in timezone Asia/Tokyo, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

🚀 Preview Environment Ready

✅ プレビュー環境のセットアップが完了しました！

🗄️ Database

Name: preview-pr362-auth
URL:

🌐 Deployment

Preview URL: https://next-lift-68ixguvg7-gntks-projects.vercel.app

⚠️ このデータベースとデプロイメントはPRがクローズされると自動的に削除されます。

[github-actions]

🗑️ Preview Environment Cleaned Up

✅ プレビュー環境をクリーンアップしました！

Database Name: preview-pr362-auth

PRがクローズされたため、関連するデータベースとVercel環境変数を自動的に削除しました。