v1.7.7

## `better-auth`

> **Magic Link upgrade:** Upgrade servers sharing verification storage together, request new Magic Links, and restart pending OAuth/SAML sign-ins. No database migration is required. See the [critical advisory](https://github.com/better-auth/better-auth/security/advisories/GHSA-965c-763c-88jm) for affected configurations and custom storage changes.

### Bug Fixes

- Fixed a critical Magic Link account-takeover vulnerability. ([#11494](https://github.com/better-auth/better-auth/pull/11494))
- Fixed ID-token sign-in ignoring the social provider’s `disableSignUp` setting. ([#11491](https://github.com/better-auth/better-auth/pull/11491))
- Fixed OAuth Proxy accepting sign-in state as a provider profile. ([#11494](https://github.com/better-auth/better-auth/pull/11494))
  Upgrade all OAuth Proxy participants together; see the [OAuth Proxy upgrade guidance](https://www.better-auth.com/docs/plugins/oauth-proxy#upgrading-existing-deployments).
- Fixed CAPTCHA errors missing the JSON `Content-Type` header. ([#11476](https://github.com/better-auth/better-auth/pull/11476))
- Fixed the active organization failing to refresh after sign-in when a session hook selects the initial organization. ([#11375](https://github.com/better-auth/better-auth/pull/11375))
- Fixed rate-limit errors missing the JSON `Content-Type` header. ([#11469](https://github.com/better-auth/better-auth/pull/11469))

For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/b96aefb4afcb2397c3a437e5f432324fbd5a4295/packages/better-auth/CHANGELOG.md)

## `@better-auth/oauth-provider`

### Features

- Added optional `validateRedirectUri` validation for trusted deployments with dynamic OAuth redirect URIs. ([#8686](https://github.com/better-auth/better-auth/pull/8686))
- Added `verifyOAuthQueryParams` to verify signed authorization queries before rendering a custom consent page. ([#11402](https://github.com/better-auth/better-auth/pull/11402))

For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/b96aefb4afcb2397c3a437e5f432324fbd5a4295/packages/oauth-provider/CHANGELOG.md)

## `@better-auth/drizzle-adapter`

### Bug Fixes

- Fixed concurrent PostgreSQL requests exceeding database-backed rate limits. ([#11331](https://github.com/better-auth/better-auth/pull/11331))

For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/b96aefb4afcb2397c3a437e5f432324fbd5a4295/packages/drizzle-adapter/CHANGELOG.md)

## `@better-auth/kysely-adapter`

### Bug Fixes

- Fixed `consumeOne` deleting a record after a concurrent write invalidates its original condition. ([#11495](https://github.com/better-auth/better-auth/pull/11495))

For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/b96aefb4afcb2397c3a437e5f432324fbd5a4295/packages/kysely-adapter/CHANGELOG.md)

## Contributors

Thanks to everyone who contributed to this release:

@aryan1306, @bytaesu, @gitmotion, @gustavovalverde, @lennondotw

**Full changelog:** [`v1.7.6...v1.7.7`](https://github.com/better-auth/better-auth/compare/v1.7.6...v1.7.7)