Starstruk Logo MarkStarstruk

v1.6.6

Automattic/harperv1.6.6Apr 21, 2026by better-release[bot]

AI Summary

Improves session handling, performance, and security across multiple packages, including fixes for Expo session loading and SSRF vulnerabilities.

Key Highlights

  • Fixed preservation of `Set-Cookie` partitioning attribute
  • Added `mapConcurrent` utility for bounded concurrency
  • Improved performance for secondary-storage API key lookups
  • Fixed SSRF vulnerabilities in OAuth provider
  • Fixed session loading flash in Expo apps

New Features

  • Added `mapConcurrent` utility at `@better-auth/core/utils/async`

Full Release Notes

## `better-auth`

### Bug Fixes

- Fixed preservation of the `Partitioned` attribute when forwarding `Set-Cookie` headers ([#9235](https://github.com/better-auth/better-auth/pull/9235))
- Fixed boolean coercion for the `disableRefresh` query parameter in custom session validation ([#9214](https://github.com/better-auth/better-auth/pull/9214))
- Fixed incorrect inference of team additional fields in the organization plugin ([#9266](https://github.com/better-auth/better-auth/pull/9266))
- Added support for removing a phone number via `updateUser({ phoneNumber: null })` ([#9219](https://github.com/better-auth/better-auth/pull/9219))

For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/029007776025f314bac5cb9c400ff2ce5494e54e/packages/better-auth/CHANGELOG.md)

## `@better-auth/core`

### Features

- Added `mapConcurrent`, a bounded-concurrency async utility, at `@better-auth/core/utils/async` ([#9227](https://github.com/better-auth/better-auth/pull/9227))

### Bug Fixes

- Made `@opentelemetry/api` an optional peer dependency ([#9111](https://github.com/better-auth/better-auth/pull/9111))

For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/029007776025f314bac5cb9c400ff2ce5494e54e/packages/core/CHANGELOG.md)

## `@better-auth/api-key`

### Bug Fixes

- Improved performance by running secondary-storage API key lookups in parallel ([#9187](https://github.com/better-auth/better-auth/pull/9187))

For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/029007776025f314bac5cb9c400ff2ce5494e54e/packages/api-key/CHANGELOG.md)

## `@better-auth/expo`

### Bug Fixes

- Fixed session loading to read cached data from `SecureStore` on app startup, eliminating the login screen flash for returning users ([#8953](https://github.com/better-auth/better-auth/pull/8953))

For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/029007776025f314bac5cb9c400ff2ce5494e54e/packages/expo/CHANGELOG.md)

## `@better-auth/oauth-provider`

### Bug Fixes

- Fixed several SSRF vulnerabilities by unifying host classification and closing loopback bypass vectors across packages ([#9226](https://github.com/better-auth/better-auth/pull/9226))

For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/029007776025f314bac5cb9c400ff2ce5494e54e/packages/oauth-provider/CHANGELOG.md)

## `@better-auth/sso`

### Bug Fixes

- Fixed an ESM/CJS compatibility issue when loading samlify ([#9262](https://github.com/better-auth/better-auth/pull/9262))

For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/029007776025f314bac5cb9c400ff2ce5494e54e/packages/sso/CHANGELOG.md)

## Contributors

Thanks to everyone who contributed to this release:

@bytaesu, @gustavovalverde, @jonathansamines, @ping-maxwell, @terijaki

**Full changelog:** [`v1.6.5...v1.6.6`](https://github.com/better-auth/better-auth/compare/v1.6.5...v1.6.6)