Starstruk Logo MarkStarstruk

v1.6.26

skaldlabs/skaldv1.6.26Aug 4, 2026by better-release[bot]

AI Summary

This release focuses on bug fixes across session management, JWT handling, and Redis storage, alongside performance optimizations for Next.js applications.

Key Highlights

  • Fixed session cleanup and retrieval to handle secondary storage correctly
  • Improved JWT key minting in database transactions to prevent deadlocks
  • Optimized Next.js `nextCookies` performance by reusing imports
  • Switched Redis storage to use `SCAN` instead of blocking `KEYS`
  • Fixed email OTP verification to not reveal user registration status

New Features

  • Added utility for creating stable, namespaced placeholder emails on the reserved domain

Full Release Notes

## `better-auth`

### Bug Fixes

- Fixed session cleanup on user deletion to also remove sessions from secondary storage ([#10520](https://github.com/better-auth/better-auth/pull/10520))
- Fixed `findSessions` to skip invalid secondary-storage session entries without discarding other valid sessions ([#10580](https://github.com/better-auth/better-auth/pull/10580))
- Fixed email OTP sign-up to pass the verification type to custom OTP generators ([#10608](https://github.com/better-auth/better-auth/pull/10608))
- Fixed email OTP password reset to allow retrying after entering an invalid password ([#10552](https://github.com/better-auth/better-auth/pull/10552))
- Fixed email OTP verification to no longer reveal whether an email is registered before the OTP is verified ([#10605](https://github.com/better-auth/better-auth/pull/10605))
- Fixed `jwtClient()` collapsing `createAuthClient` type inference when combined with other client plugins ([#10513](https://github.com/better-auth/better-auth/pull/10513))
- Fixed JWT key minting inside database transactions to use the transaction-scoped adapter, preventing deadlocks on SQLite and ensuring keys commit with their surrounding transaction on Postgres and MySQL ([#10623](https://github.com/better-auth/better-auth/pull/10623))
- Fixed `oAuthProxy` to preserve Apple user data from `form_post` callbacks ([#10599](https://github.com/better-auth/better-auth/pull/10599))
- Fixed `oneTapClient()` collapsing `createAuthClient` type inference when combined with other client plugins ([#10635](https://github.com/better-auth/better-auth/pull/10635))
- Fixed database rate-limit cleanup to complete when no background task handler is configured ([#10619](https://github.com/better-auth/better-auth/pull/10619))
- Improved `nextCookies` performance in instrumented Next.js applications by reusing the `next/headers` import promise ([#10467](https://github.com/better-auth/better-auth/pull/10467))

For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/a16b30e8437927c08350194000178073b06af8cf/packages/better-auth/CHANGELOG.md)

## `@better-auth/core`

### Features

- Added a utility for creating stable, namespaced placeholder emails on the reserved `placeholder.invalid` domain ([#10576](https://github.com/better-auth/better-auth/pull/10576))

For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/a16b30e8437927c08350194000178073b06af8cf/packages/core/CHANGELOG.md)

## `@better-auth/redis-storage`

### Bug Fixes

- Fixed `listKeys()` and `clear()` to use `SCAN` instead of `KEYS` so large keyspaces no longer block the Redis server ([#10507](https://github.com/better-auth/better-auth/pull/10507))

For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/a16b30e8437927c08350194000178073b06af8cf/packages/redis-storage/CHANGELOG.md)

## Contributors

Thanks to everyone who contributed to this release:

@bytaesu, @Emmaccen, @gustavovalverde, @jashkarangiya, @jeroenvandermerwe, @jlucaso1, @krish-vachhani, @mrosberghaus, @XXMOHAMED012

**Full changelog:** [`v1.6.25...v1.6.26`](https://github.com/better-auth/better-auth/compare/v1.6.25...v1.6.26)