chore: sync upstream v1.6.11 + bump @btst to v2.3.0 by cursor[bot] · Pull Request #43 · better-stack-ai/better-auth

cursor · 2026-05-15T13:17:09Z

Summary

Syncs our fork with upstream better-auth tag v1.6.11 (from v1.6.2 → v1.6.11), vendors updated adapter files into @btst/* packages, and bumps all @btst/* versions to v2.3.0.

Upstream changes (v1.6.3–v1.6.11)

Key changes included in this sync:

feat(db): New consumeOne atomic adapter primitive (formerly claimOne, renamed in v1.6.11) — new adapter API surface → minor bump
fix(drizzle/kysely/prisma/memory/mongo): Various adapter fixes across all vendored adapters
fix(oauth): Block OAuth linking to unverified local accounts
fix(magic-link): Consume verification token atomically on verify
fix(organization): Default-on requireEmailVerificationOnInvitation
fix(sso): Validate user-supplied OIDC endpoint URLs; require org admin role
fix(access): Preserve exact role statement types
chore(ci): Added fallback ubuntu-24.04 runner for fork CI (replaces need for manual runner substitution)
Various security fixes and plugin improvements

What changed in `@btst`

All 5 adapter source files updated via sync-upstream.ts (drizzle, prisma, memory, mongodb, kysely + supporting files)
CLI generators/utils synced (no structural changes)
scripts/sync-upstream.ts HEADER_COMMENT fixed (trailing whitespace causing Biome lint failures)
.cspell/custom-words.txt fixed (corrupted CIBAbtst entry split back to CIBA + btst/BTST)

Version bump

2.2.1 → 2.3.0 (minor bump — new consumeOne adapter primitive is meaningful new functionality)

Peer dependency constraints unchanged (>=1.6.0 still valid).

CI checks passed locally

✅ pnpm lint (Biome)
✅ pnpm lint:dependencies (knip)
✅ pnpm lint:packages
✅ pnpm lint:spell (cspell)
✅ pnpm format:check
✅ pnpm lint:types
✅ pnpm --filter "@btst/*" exec tsc --noEmit
✅ @btst/db tests (28 passed)
✅ @btst/adapter-memory tests (11 passed)
✅ @btst/cli schema-conversion tests (7 passed)
✅ @btst/cli generate-all-orms tests (20 passed, no snapshot changes)
⏭️ @btst/cli e2e-cli tests (expected CI-only failure — needs live Postgres + MySQL)

Post-merge release

After merging, tag and release:

git checkout main && git pull
git tag btst-v2.3.0
git push origin btst-v2.3.0
# Then create GitHub Release from that tag

…tter-auth#9071)

…#9067)

Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com>

…ter-auth#9072) Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com>

…r-auth#8389) Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com> Co-authored-by: ping-maxwell <maxwell.multinite@gmail.com>

Co-authored-by: leonardo2204 <1509421+leonardo2204@users.noreply.github.com> Co-authored-by: better-release[bot] <273320539+better-release[bot]@users.noreply.github.com>

…gin (better-auth#8982) Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com> Co-authored-by: Taesu <bytaesu@gmail.com> Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com>

better-auth#8926) Co-authored-by: better-release[bot] <273320539+better-release[bot]@users.noreply.github.com>

…tter-auth#9032)

…lidation grep -coP outputs "0" to stdout on no matches but exits 1, causing the || echo 0 fallback to append a second "0". The resulting "0\n0" value fails the -lt integer comparison. Use || true instead since grep -c already outputs the correct count.

…orization code validation (better-auth#9118)

…on (better-auth#7231) Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com>

…ential clients (better-auth#9123)

…h#9109) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Taesu <bytaesu@gmail.com> Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com>

…as (better-auth#9143)

…etter-auth#9160)

…#9113)

…etter-auth#9548) Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com>

Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com>

…th#9220) Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com>

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com>

Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Taesu <bytaesu@gmail.com>

…tter-auth#9568)

…ter-auth#9542)

Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com>

)

…auth#9573)

…nce (better-auth#9579)

…ter-auth#9572)

…_token grant (better-auth#9576)

…& extend gate to get/list (better-auth#9577)

…nd update (better-auth#9574) Co-authored-by: vaadata-poyetont <poyetont@vaadata.com>

…auth#9578)

Signed-off-by: Gautam Manchandani <manchandanigautam@gmail.com>

The `authorization_code`-grant rotation in `createRefreshToken` and the explicit `revokeRefreshToken` path both updated the parent `oauthRefreshToken` row using an `id`-only predicate, so two concurrent rotations (or a rotation racing a revoke) both pass the `revoked` check and last-write-wins. Each surviving request mints a fresh refresh token, producing a forked family from one parent. Both call sites now perform a compare-and-swap (`UPDATE ... WHERE id = ? AND revoked IS NULL`) and short-circuit with `invalid_grant` when the row was already consumed. The parent stays marked revoked, so any subsequent replay trips the existing family-invalidation guard in `handleRefreshTokenGrant`. The shared family-delete is centralized in `invalidateRefreshFamily`, which clears child access tokens before refresh rows to honor the schema's foreign-key direction; the `oauthRefreshToken.token` column also gains a `unique` constraint for parity with `oauthAccessToken.token`. Strict family invalidation on contested rotations (RFC 9700 §4.14) is tracked in a FIXME for a follow-up minor that opts into transactional rotation in the adapter contract. Closes GHSA-392p-2q2v-4372. Co-authored-by: chdanielmueller <4051999+chdanielmueller@users.noreply.github.com>

The `authorization_code` grant's verification step was a `findOne` + `deleteOne` pair, so two concurrent `POST /oauth2/token` requests sharing the same `code` both pass the find, both delete, and both mint independent access/refresh/id token sets: a CAS gap that lets an authorization code be redeemed twice. The legacy `oidc-provider` and `mcp` plugins in `better-auth` share the same primitive on their `authorization_code` paths and have the same gap. All three call sites now use `internalAdapter.consumeVerificationValue` (the atomic primitive added in better-auth#9560 and renamed in better-auth#9568): the first concurrent caller receives the row and mints tokens, subsequent racers receive `null`. The consumed and expired paths return RFC 6749 §5.2 `invalid_grant` instead of the better-auth-internal `invalid_verification`, so spec-compliant clients can branch on the standard code. The redundant second `deleteVerificationByIdentifier` call after PKCE validation in the legacy paths is removed. Closes GHSA-7w99-5wm4-3g79. Co-authored-by: chdanielmueller <4051999+chdanielmueller@users.noreply.github.com>

…ect missing PKCE method (better-auth#9575)

gustavovalverde and others added 30 commits April 9, 2026 18:15

fix(ci): prevent label explosion on PRs targeting the next branch (be…

83ed1fe

…tter-auth#9071)

refactor(ci): simplify release notes to one-line entries (better-auth…

a2fbe07

…#9067)

docs: add database table names (better-auth#9062)

41679fa

Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com>

fix: incorrect operationId in password reset callback endpoint (bet…

6ce30cf

…ter-auth#9072) Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com>

fix(open-api): correct get-session nullable schema for OAS 3.1 (bette…

f6428d0

…r-auth#8389) Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com> Co-authored-by: ping-maxwell <maxwell.multinite@gmail.com>

chore(docs): format markdown including mdx files (better-auth#9085)

099ee48

docs: fix PostgreSQL Prisma native type typo (better-auth#9090)

d141a3b

feat(stripe): support Stripe SDK v21 and v22 (better-auth#9084)

5f84335

Co-authored-by: leonardo2204 <1509421+leonardo2204@users.noreply.github.com> Co-authored-by: better-release[bot] <273320539+better-release[bot]@users.noreply.github.com>

chore: replace z.union with z.xor for permission schemas in admin plu…

684154d

…gin (better-auth#8982) Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com> Co-authored-by: Taesu <bytaesu@gmail.com> Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com>

fix(stripe): omit quantity for metered prices in checkout and upgrades (

c5066fe

better-auth#8926) Co-authored-by: better-release[bot] <273320539+better-release[bot]@users.noreply.github.com>

fix(ci): rename release PR with actual version (better-auth#9066)

7fb4a55

fix(sso): unify SAML response processing and fix bugs (better-auth#9097)

52c4751

fix(cli): handle extends and mid-path wildcards in tsconfig paths (be…

4673c6d

…tter-auth#9032)

chore: fix typecheck command in CLAUDE.md (better-auth#9110)

f320994

feat(oauth-provider): add customTokenResponseFields and harden auth…

314e06f

…orization code validation (better-auth#9118)

fix(two-factor): enforce 2FA on all sign-in paths (better-auth#9122)

484ce6a

fix(two-factor): updated backup codes respect storeBackupCodes opti…

f875897

…on (better-auth#7231) Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com>

fix(oauth-provider): graceful DCR override for unauthenticated confid…

e2e25a4

…ential clients (better-auth#9123)

chore(deps-dev): bump @sveltejs/kit from 2.53.3 to 2.57.1 (better-aut…

504ea25

…h#9109) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

docs: improve enterprise contact form (better-auth#9128)

a6e9b94

docs(landing): polish sentinel section (better-auth#9142)

a6f3197

docs: fix fk references in schema tables to match actual plugin schem…

daf7ab7

…as (better-auth#9143)

docs(sso): extract inline fields to named exports (better-auth#9144)

6c946a3

docs: update not-found page (better-auth#9158)

8dcb988

docs: update Convex Labs link in documentation (better-auth#9161)

a1f6199

docs: correct wording for invocable endpoints in integration guides (b…

2514c3d

…etter-auth#9160)

fix: resolve dynamic baseURL for direct auth.api calls (better-auth…

513dabb

…#9113)

chore: minor review followups on recent main commits (better-auth#9163)

92256a2

dipan-ck and others added 30 commits May 11, 2026 10:58

fix(anonymous): call onLinkAccount on email verification sign-in (b…

142b86c

…etter-auth#9548) Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com>

chore(ci): use ubuntu-24.04 fallback runner for forks (better-auth#9544)

c20796f

Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com>

fix: add error code to change-email-disabled (better-auth#8948)

ee93485

docs: add docs for infra timeout options (better-auth#9559)

eae63a9

fix(sso): require org admin role to register SSO providers (better-au…

86765f1

…th#9220) Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com>

fix: cleanup sessions when deleting users (better-auth#9162)

a26333b

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com>

feat(db): add atomic claimOne adapter primitive (better-auth#9560)

a2c0c93

chore(deps): bump kysely from 0.28.14 to 0.28.17 (better-auth#9567)

3bec284

Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Taesu <bytaesu@gmail.com>

chore(deps): consolidate kysely into pnpm catalog (better-auth#9569)

62b8793

refactor(db): rename claimOne adapter primitive to consumeOne (be…

0cbddb8

…tter-auth#9568)

test(stripe): restructure test suite with typed Stripe factories (bet…

98e7e38

…ter-auth#9542)

chore(deps): bump mermaid from 11.13.0 to 11.15.0 (better-auth#9566)

e0f9429

Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com>

docs: add per-ip rate limit to enterprise contact form (better-auth#9570

455efb6

)

fix(device-authorization): bind approval to verifier session (better-…

99a254a

…auth#9573)

fix(scim): reject built-in provider id collisions on SCIM token issua…

2f5d91c

…nce (better-auth#9579)

fix(magic-link): consume verification token atomically on verify (bet…

5f09d56

…ter-auth#9572)

fix(oidc-provider, mcp): authenticate confidential clients on refresh…

1f2ff42

…_token grant (better-auth#9576)

fix(organization): default-on requireEmailVerificationOnInvitation …

23094a6

…& extend gate to get/list (better-auth#9577)

fix(sso): validate user-supplied OIDC endpoint URLs at registration a…

37f60cb

…nd update (better-auth#9574) Co-authored-by: vaadata-poyetont <poyetont@vaadata.com>

docs: document account storeStateStrategy (better-auth#9557)

29599d3

fix(oauth): block OAuth linking to unverified local accounts (better-…

da7e50b

…auth#9578)

fix: invalid instrumentation import list (better-auth#9582)

b0ef96f

fix(access): preserve exact role statement types (better-auth#9507)

a1c9f3c

Signed-off-by: Gautam Manchandani <manchandanigautam@gmail.com>

fix(oidc-provider, mcp): drop "none" alg, default plain PKCE off, rej…

699b09a

…ect missing PKCE method (better-auth#9575)

chore: release v1.6.11 (better-auth#9532)

f41514e

chore: merge upstream better-auth v1.6.11

f8f5e15

chore: sync upstream v1.6.11 + bump @BTST to v2.3.0

975af9a

fix: fix sync-upstream header trailing spaces + fix cspell custom-words

0030206

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: sync upstream v1.6.11 + bump @btst to v2.3.0#43

chore: sync upstream v1.6.11 + bump @btst to v2.3.0#43
cursor[bot] wants to merge 188 commits into
mainfrom
cursor/upstream-fork-sync-a3f2

cursor Bot commented May 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

Conversation

cursor Bot commented May 15, 2026

Summary

Upstream changes (v1.6.3–v1.6.11)

What changed in @btst

Version bump

CI checks passed locally

Post-merge release

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

What changed in `@btst`