v1.7.2
Leonxlnx/taste-skillv1.7.2Aug 26, 2026by better-release[bot]
AI Summary
This release focuses on a wide range of bug fixes across core packages, adapters (Drizzle, Kysely), and SSO components. Key improvements include enhanced URL validation, fixes for async context loss in Cloudflare Workers, and standardization of placeholder email formats.
Key Highlights
- Improved validation of relative callback and redirect URLs with paths, queries, and fragments
- Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions
- Fixed permanent user bans to clear expiration dates from previous temporary bans
- Standardized built-in placeholder emails to the namespaced format
New Features
- Added synchronous and optional access to the current auth endpoint context
Full Release Notes
## `better-auth`
### Bug Fixes
- Fixed permanent user bans to clear expiration dates from previous temporary bans. ([#10823](https://github.com/better-auth/better-auth/pull/10823))
- Fixed client types with more plugins being assignable to types declaring fewer plugins. ([#10907](https://github.com/better-auth/better-auth/pull/10907))
- Added warnings for invalid signed session data in the cookie cache. ([#10934](https://github.com/better-auth/better-auth/pull/10934))
- Fixed disabled MyISAM indexes from satisfying migration index checks. ([#10877](https://github.com/better-auth/better-auth/pull/10877))
- Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. ([#10875](https://github.com/better-auth/better-auth/pull/10875))
- Allowed `~` in relative callback URLs validated by trusted-origin checks. ([#10041](https://github.com/better-auth/better-auth/pull/10041))
- Improved validation of relative callback and redirect URLs with paths, queries, and fragments. ([#10979](https://github.com/better-auth/better-auth/pull/10979))
- Allowed same-origin form submissions with `Referrer-Policy: no-referrer` while continuing to reject untrusted origins. ([#10959](https://github.com/better-auth/better-auth/pull/10959))
- Improved `getTestInstance` performance with a faster default password hasher. ([#10879](https://github.com/better-auth/better-auth/pull/10879))
- Standardized built-in placeholder emails to the namespaced `{identifier}@{namespace}.placeholder.invalid` format. ([#10982](https://github.com/better-auth/better-auth/pull/10982))
For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/c50200bfc716cf43f5c29a2dd5766f6485c46aa1/packages/better-auth/CHANGELOG.md)
## `@better-auth/core`
### Bug Fixes
- Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. ([#10855](https://github.com/better-auth/better-auth/pull/10855))
- Fixed auth request logs to respect the configured logger, log level, and disabled setting. ([#10939](https://github.com/better-auth/better-auth/pull/10939))
- Improved validation of relative callback and redirect URLs with paths, queries, and fragments. ([#10979](https://github.com/better-auth/better-auth/pull/10979))
- Standardized built-in placeholder emails to the namespaced `{identifier}@{namespace}.placeholder.invalid` format. ([#10982](https://github.com/better-auth/better-auth/pull/10982))
- Added synchronous and optional access to the current auth endpoint context. ([#10938](https://github.com/better-auth/better-auth/pull/10938))
For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/c50200bfc716cf43f5c29a2dd5766f6485c46aa1/packages/core/CHANGELOG.md)
## `@better-auth/oauth-provider`
### Bug Fixes
- Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. ([#11010](https://github.com/better-auth/better-auth/pull/11010))
- Improved validation of relative callback and redirect URLs with paths, queries, and fragments. ([#10979](https://github.com/better-auth/better-auth/pull/10979))
- Fixed relative redirect URLs containing fragments. ([#10983](https://github.com/better-auth/better-auth/pull/10983))
For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/c50200bfc716cf43f5c29a2dd5766f6485c46aa1/packages/oauth-provider/CHANGELOG.md)
## `@better-auth/drizzle-adapter`
### Bug Fixes
- Fixed one-to-one Drizzle relations when `usePlural` is enabled. ([#10941](https://github.com/better-auth/better-auth/pull/10941))
- Added validation for missing Drizzle schema fields in compound `where` clauses. ([#10859](https://github.com/better-auth/better-auth/pull/10859))
For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/c50200bfc716cf43f5c29a2dd5766f6485c46aa1/packages/drizzle-adapter/CHANGELOG.md)
## `@better-auth/kysely-adapter`
### Bug Fixes
- Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. ([#10875](https://github.com/better-auth/better-auth/pull/10875))
For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/c50200bfc716cf43f5c29a2dd5766f6485c46aa1/packages/kysely-adapter/CHANGELOG.md)
## `@better-auth/sso`
### Bug Fixes
- Improved validation of relative callback and redirect URLs with paths, queries, and fragments. ([#10979](https://github.com/better-auth/better-auth/pull/10979))
For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/c50200bfc716cf43f5c29a2dd5766f6485c46aa1/packages/sso/CHANGELOG.md)
## Contributors
Thanks to everyone who contributed to this release:
@bytaesu, @GautamBytes, @heliohm, @sosyz, @starslingdev[bot]
**Full changelog:** [`v1.7.1...v1.7.2`](https://github.com/better-auth/better-auth/compare/v1.7.1...v1.7.2)