Starstruk Logo MarkStarstruk

v1.6.19

yamadashy/repomixv1.6.19Jun 16, 2026by better-release[bot]

AI Summary

A bug fix release for better-auth focusing on session handling, concurrent request protection, and verification flow reliability.

Key Highlights

  • Added support for pre-binding device codes to a specific user.
  • Fixed headerless session checks and cookie cache fallback.
  • Fixed `sendVerificationEmail` errors not being surfaced to the client.
  • Fixed session and account cookie splitting to handle browser size limits.

New Features

  • Atomic recording of single-use markers via `internalAdapter.reserveVerificationValue`.
  • New `incrementOne` adapter method for atomic counter updates.

Full Release Notes

## `better-auth`

### Features

- Added support for pre-binding device codes to a specific user in the device authorization plugin ([#9995](https://github.com/better-auth/better-auth/pull/9995))

### Bug Fixes

- Fixed headerless session checks ([#10053](https://github.com/better-auth/better-auth/pull/10053))
- Fixed cookie cache fallback lookup ([#9348](https://github.com/better-auth/better-auth/pull/9348))
- Fixed `sendVerificationEmail` errors not being surfaced to the client ([#8863](https://github.com/better-auth/better-auth/pull/8863))
- Fixed auth client return types not being emitted correctly in TypeScript declaration builds ([#10071](https://github.com/better-auth/better-auth/pull/10071))
- Fixed session and account cache cookies being silently dropped when near the browser's per-cookie size limit by splitting them into chunks ([#10088](https://github.com/better-auth/better-auth/pull/10088))
- Fixed single-use verification flows (such as magic-link) hanging on connection-limited database adapters by reusing active transactions ([#10070](https://github.com/better-auth/better-auth/pull/10070))
- Fixed the domain not being included when clearing cross-subdomain cookies in the `last-login-method` plugin ([#9319](https://github.com/better-auth/better-auth/pull/9319))
- Fixed the `oauth-popup` plugin leaking internal OAuth state keys into `additionalData` ([#10067](https://github.com/better-auth/better-auth/pull/10067))
- Reverted the headerless session check fix ([#10074](https://github.com/better-auth/better-auth/pull/10074))

For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/ac4d81df748b8c09e584fdd6c440f8f327490fd1/packages/better-auth/CHANGELOG.md)

## `auth`

### Bug Fixes

- Fixed the `generate` command not handling a directory path passed to `--output` ([#9564](https://github.com/better-auth/better-auth/pull/9564))
- Fixed array `additionalField` default values not being serialized correctly in the Drizzle schema generator ([#10048](https://github.com/better-auth/better-auth/pull/10048))

For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/ac4d81df748b8c09e584fdd6c440f8f327490fd1/packages/cli/CHANGELOG.md)

## `@better-auth/drizzle-adapter`

### Bug Fixes

- Fixed password reset tokens not working with the Drizzle MySQL adapter after being consumed ([#10081](https://github.com/better-auth/better-auth/pull/10081))

For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/ac4d81df748b8c09e584fdd6c440f8f327490fd1/packages/drizzle-adapter/CHANGELOG.md)

## `@better-auth/mongo-adapter`

### Bug Fixes

- Fixed guarded state transitions (token rotation, revocation, two-factor backup-code regeneration, device-code claiming, and organization invitation acceptance) failing on Prisma and on MongoDB servers older than 5.0 ([#10086](https://github.com/better-auth/better-auth/pull/10086))

For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/ac4d81df748b8c09e584fdd6c440f8f327490fd1/packages/mongo-adapter/CHANGELOG.md)

## `@better-auth/passkey`

### Bug Fixes

- Fixed invalid OpenAPI output for callback, session, and passkey routes so client generators can consume the schema ([#9555](https://github.com/better-auth/better-auth/pull/9555))

For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/ac4d81df748b8c09e584fdd6c440f8f327490fd1/packages/passkey/CHANGELOG.md)

## `@better-auth/scim`

### Bug Fixes

- Stopped logging SCIM user filter values when listing users ([#10087](https://github.com/better-auth/better-auth/pull/10087))

For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/ac4d81df748b8c09e584fdd6c440f8f327490fd1/packages/scim/CHANGELOG.md)

## Contributors

Thanks to everyone who contributed to this release:

@brone1323, @bytaesu, @ChrisMGeo, @ElGauchooooo, @gustavovalverde, @ping-maxwell, @tsushanth, @Tushar-Khandelwal-2004

**Full changelog:** [`v1.6.18...v1.6.19`](https://github.com/better-auth/better-auth/compare/v1.6.18...v1.6.19)