v1.7.2
HKUDS/Vibe-Tradingv1.7.2Aug 26, 2026by better-release[bot]
AI Summary
v1.7.2 addresses critical bug fixes regarding user bans, session data validation, and URL handling to improve robustness and security.
Key Highlights
- Fixed permanent user bans to clear expiration dates from previous temporary bans.
- Improved validation of relative callback and redirect URLs with paths, queries, and fragments.
- Added warnings for invalid signed session data in the cookie cache.
- Standardized built-in placeholder emails to a namespaced format.
Full Release Notes
## `better-auth`
### Bug Fixes
- Fixed permanent user bans to clear expiration dates from previous temporary bans. ([#10823](https://github.com/better-auth/better-auth/pull/10823))
- Fixed client types with more plugins being assignable to types declaring fewer plugins. ([#10907](https://github.com/better-auth/better-auth/pull/10907))
- Added warnings for invalid signed session data in the cookie cache. ([#10934](https://github.com/better-auth/better-auth/pull/10934))
- Fixed disabled MyISAM indexes from satisfying migration index checks. ([#10877](https://github.com/better-auth/better-auth/pull/10877))
- Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. ([#10875](https://github.com/better-auth/better-auth/pull/10875))
- Allowed `~` in relative callback URLs validated by trusted-origin checks. ([#10041](https://github.com/better-auth/better-auth/pull/10041))
- Improved validation of relative callback and redirect URLs with paths, queries, and fragments. ([#10979](https://github.com/better-auth/better-auth/pull/10979))
- Allowed same-origin form submissions with `Referrer-Policy: no-referrer` while continuing to reject untrusted origins. ([#10959](https://github.com/better-auth/better-auth/pull/10959))
- Improved `getTestInstance` performance with a faster default password hasher. ([#10879](https://github.com/better-auth/better-auth/pull/10879))
- Standardized built-in placeholder emails to the namespaced `{identifier}@{namespace}.placeholder.invalid` format. ([#10982](https://github.com/better-auth/better-auth/pull/10982))
For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/c50200bfc716cf43f5c29a2dd5766f6485c46aa1/packages/better-auth/CHANGELOG.md)
## `@better-auth/core`
### Bug Fixes
- Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. ([#10855](https://github.com/better-auth/better-auth/pull/10855))
- Fixed auth request logs to respect the configured logger, log level, and disabled setting. ([#10939](https://github.com/better-auth/better-auth/pull/10939))
- Improved validation of relative callback and redirect URLs with paths, queries, and fragments. ([#10979](https://github.com/better-auth/better-auth/pull/10979))
- Standardized built-in placeholder emails to the namespaced `{identifier}@{namespace}.placeholder.invalid` format. ([#10982](https://github.com/better-auth/better-auth/pull/10982))
- Added synchronous and optional access to the current auth endpoint context. ([#10938](https://github.com/better-auth/better-auth/pull/10938))
For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/c50200bfc716cf43f5c29a2dd5766f6485c46aa1/packages/core/CHANGELOG.md)
## `@better-auth/oauth-provider`
### Bug Fixes
- Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. ([#11010](https://github.com/better-auth/better-auth/pull/11010))
- Improved validation of relative callback and redirect URLs with paths, queries, and fragments. ([#10979](https://github.com/better-auth/better-auth/pull/10979))
- Fixed relative redirect URLs containing fragments. ([#10983](https://github.com/better-auth/better-auth/pull/10983))
For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/c50200bfc716cf43f5c29a2dd5766f6485c46aa1/packages/oauth-provider/CHANGELOG.md)
## `@better-auth/drizzle-adapter`
### Bug Fixes
- Fixed one-to-one Drizzle relations when `usePlural` is enabled. ([#10941](https://github.com/better-auth/better-auth/pull/10941))
- Added validation for missing Drizzle schema fields in compound `where` clauses. ([#10859](https://github.com/better-auth/better-auth/pull/10859))
For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/c50200bfc716cf43f5c29a2dd5766f6485c46aa1/packages/drizzle-adapter/CHANGELOG.md)
## `@better-auth/kysely-adapter`
### Bug Fixes
- Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. ([#10875](https://github.com/better-auth/better-auth/pull/10875))
For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/c50200bfc716cf43f5c29a2dd5766f6485c46aa1/packages/kysely-adapter/CHANGELOG.md)
## `@better-auth/sso`
### Bug Fixes
- Improved validation of relative callback and redirect URLs with paths, queries, and fragments. ([#10979](https://github.com/better-auth/better-auth/pull/10979))
For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/c50200bfc716cf43f5c29a2dd5766f6485c46aa1/packages/sso/CHANGELOG.md)
## Contributors
Thanks to everyone who contributed to this release:
@bytaesu, @GautamBytes, @heliohm, @sosyz, @starslingdev[bot]
**Full changelog:** [`v1.7.1...v1.7.2`](https://github.com/better-auth/better-auth/compare/v1.7.1...v1.7.2)