v1.6.24

## `better-auth`

### Features

- Added request context (`ctx`) as a third argument to `verifyIdToken`, enabling custom ID token verifiers to read request headers ([#10376](https://github.com/better-auth/better-auth/pull/10376))
- Added `beforeStoreCookie` option to the last-login-method plugin for GDPR compliance ([#5753](https://github.com/better-auth/better-auth/pull/5753))

### Bug Fixes

- Replaced flaky MongoDB where-coercion integration test with a direct unit test for more reliable test runs ([#10369](https://github.com/better-auth/better-auth/pull/10369))
- Fixed the `get-session` endpoint to include `no-store` cache control headers, preventing stale session data from being served ([#10222](https://github.com/better-auth/better-auth/pull/10222))
- Fixed SQLite migration diffs to recognize `BIGINT` as a valid number type, preventing spurious pending changes on rate limiter columns ([#10316](https://github.com/better-auth/better-auth/pull/10316))
- Fixed auth requests failing when request cloning throws an error inside verification callbacks ([#10336](https://github.com/better-auth/better-auth/pull/10336))
- Fixed `useSession({ throw: true })` incorrectly excluding `null` from its `data` type ([#9787](https://github.com/better-auth/better-auth/pull/9787))
- Fixed auth query revalidation and signal listeners not being restored after a client component remounts ([#10379](https://github.com/better-auth/better-auth/pull/10379))
- Fixed the `CookieAttributes` index signature type to be more precise ([#10442](https://github.com/better-auth/better-auth/pull/10442))
- Fixed silent misrouting of adapter queries when `user.modelName` was set to a value that collides with another schema key ([#10235](https://github.com/better-auth/better-auth/pull/10235))
- Fixed Kysely migration generation producing duplicate indexes for fields marked both `unique` and `index` ([#10357](https://github.com/better-auth/better-auth/pull/10357))
- Fixed magic-link and email-OTP send endpoints to validate the `Origin` header on cookieless requests, preventing cross-origin abuse ([#10368](https://github.com/better-auth/better-auth/pull/10368))
- Fixed remote MCP auth 401 challenge headers being hidden from browser clients due to missing CORS exposure ([#10290](https://github.com/better-auth/better-auth/pull/10290))
- Fixed OpenAPI schema to include plugin user fields (such as `username` and `displayUsername`) in `/sign-up/email` and `/update-user` request bodies ([#10453](https://github.com/better-auth/better-auth/pull/10453))
- Fixed `organization.listMembers` failing with "User not found for member" for organizations with more than ~100 members ([#10342](https://github.com/better-auth/better-auth/pull/10342))
- Fixed organization invitations to use database-generated IDs when `advanced.database.generateId` is configured, matching the behavior of other models ([#10040](https://github.com/better-auth/better-auth/pull/10040))
- Fixed `getDefaultModelName` to prefer exact schema key matches over `modelName` aliases, preventing adapter queries from being misrouted when a built-in table's name collides with another schema key

For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9a661c7b7abceaa81123b2c56757ee24f3ad2ed6/packages/better-auth/CHANGELOG.md)

## `auth`

### Bug Fixes

- Fixed SvelteKit builds by stubbing explicit-environment-variables modules ([#10221](https://github.com/better-auth/better-auth/pull/10221))
- Fixed Drizzle schema generation producing duplicate indexes for fields marked both `unique` and `index` ([#10333](https://github.com/better-auth/better-auth/pull/10333))
- Fixed Drizzle schema generation for tables with multiple foreign keys to the same model by adding disambiguating `relationName` values ([#10352](https://github.com/better-auth/better-auth/pull/10352))
- Fixed `auth generate` failing when the config file imports the not-yet-generated output file (e.g. on a Convex first run) ([#10302](https://github.com/better-auth/better-auth/pull/10302))

For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9a661c7b7abceaa81123b2c56757ee24f3ad2ed6/packages/cli/CHANGELOG.md)

## `@better-auth/electron`

### Bug Fixes

- Updated compatibility testing to include Electron 43 (peer range unchanged at `>=36.0.0`) ([#10440](https://github.com/better-auth/better-auth/pull/10440))
- Fixed `/electron/init-oauth-proxy` forwarding multiple `Set-Cookie` headers as a single comma-joined string, which caused the browser to drop the transfer-token cookie during OAuth handoff ([#9672](https://github.com/better-auth/better-auth/pull/9672))

For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9a661c7b7abceaa81123b2c56757ee24f3ad2ed6/packages/electron/CHANGELOG.md)

## `@better-auth/core`

### Bug Fixes

- Fixed an intermittent "No request state found" error caused by a race condition in `AsyncLocalStorage` initialization on serverless cold starts (e.g. Cloudflare Workers) ([#9862](https://github.com/better-auth/better-auth/pull/9862))

For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9a661c7b7abceaa81123b2c56757ee24f3ad2ed6/packages/core/CHANGELOG.md)

## `@better-auth/sso`

### Bug Fixes

- Fixed IdP-initiated SAML sign-ins in split-origin deployments to redirect users to the configured application URL instead of the authentication server, using `idpInitiatedCallbackUrl` ([#10388](https://github.com/better-auth/better-auth/pull/10388))

For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9a661c7b7abceaa81123b2c56757ee24f3ad2ed6/packages/sso/CHANGELOG.md)

## `@better-auth/stripe`

### Bug Fixes

- Fixed `beforeDeleteOrganization` and `afterDeleteOrganization` hooks not receiving the endpoint context as the second argument ([#10190](https://github.com/better-auth/better-auth/pull/10190))

For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9a661c7b7abceaa81123b2c56757ee24f3ad2ed6/packages/stripe/CHANGELOG.md)

## Contributors

Thanks to everyone who contributed to this release:

@akshatmalik-bruh, @ayushman46, @c-nicol, @gaurav-init, @gaurav0107, @GautamBytes, @momomuchu, @OrangeManLi, @paoloricciuti, @ping-maxwell, @shiminshen, @swithek, @Tushar-Khandelwal-2004, @vinay-oppuri

**Full changelog:** [`v1.6.23...v1.6.24`](https://github.com/better-auth/better-auth/compare/v1.6.23...v1.6.24)