Starstruk Logo MarkStarstruk

v1.6.22

open-pencil/open-pencilv1.6.22Jun 26, 2026by better-release[bot]

AI Summary

This release focuses on security and stability improvements, specifically fixing credential revocation during sign-in flows and enhancing SCIM operations, alongside various bug fixes for authentication and CLI tools.

Key Highlights

  • Fixed unproven credentials not being revoked during magic link and email OTP sign-in
  • Fixed server-side OAuth requests to refuse redirect responses instead of following them
  • Added account-level verification lockout for two-factor authentication
  • Fixed SCIM write-path operations to be properly scoped and honor the active attribute

New Features

  • Account-level verification lockout for two-factor authentication

Full Release Notes

## `better-auth`

### Bug Fixes

- Fixed unproven credentials not being revoked during magic link and email OTP sign-in ([#10239](https://github.com/better-auth/better-auth/pull/10239))
- Fixed server-side OAuth requests to refuse redirect responses instead of following them ([#10241](https://github.com/better-auth/better-auth/pull/10241))

For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/a90d061de7cdbd60e796230aadf5d1082add1fe2/packages/better-auth/CHANGELOG.md)

## `@better-auth/scim`

### Bug Fixes

- Fixed SCIM write-path operations to be properly scoped and to correctly honor the `active` attribute ([#10242](https://github.com/better-auth/better-auth/pull/10242))

For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/a90d061de7cdbd60e796230aadf5d1082add1fe2/packages/scim/CHANGELOG.md)

## `@better-auth/stripe`

### Bug Fixes

- Fixed organization subscription actions (cancel, upgrade, restore, and the billing portal) that could act on the wrong organization.

For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/a90d061de7cdbd60e796230aadf5d1082add1fe2/packages/stripe/CHANGELOG.md)

## `auth`

### Bug Fixes

- Added account-level verification lockout for two-factor authentication ([#10240](https://github.com/better-auth/better-auth/pull/10240))

For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/a90d061de7cdbd60e796230aadf5d1082add1fe2/packages/cli/CHANGELOG.md)

## Contributors

Thanks to everyone who contributed to this release:

@gustavovalverde

**Full changelog:** [`v1.6.21...v1.6.22`](https://github.com/better-auth/better-auth/compare/v1.6.21...v1.6.22)