[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
better-auth (source)	1.7.16 → 1.7.18

---

Release Notes

better-auth/better-auth (better-auth)

v1.7.18

Compare Source

Patch Changes

• #​12259 9e2a0ec Thanks @​gustavovalverde! - Fixed "revoke all sessions" with secondaryStorage and storeSessionInDatabase so that sessions created while the revocation runs are revoked too. Sessions created by a session.delete.after hook still stay active.

• #​12244 85f4342 Thanks @​gustavovalverde! - getTestInstance with testWith: "mysql" no longer hangs. It expects a MySQL server at 127.0.0.1:3306 whose root password is root_password, and it creates and drops a separate database for each instance, so several instances can run in one test file.

• #​12250 278bb28 Thanks @​gustavovalverde! - getTestInstance from better-auth/test now closes the Postgres connection pool and the SQLite database it created when the test file finishes. Previously both stayed open until the test worker exited. With Vitest's default sequence.hooks: "stack", afterAll hooks in your test files still run before this cleanup and can keep using the instance.

• Updated dependencies [9342a73]:

  • @​better-auth/core@1.7.18
  • @​better-auth/drizzle-adapter@1.7.18
  • @​better-auth/kysely-adapter@1.7.18
  • @​better-auth/memory-adapter@1.7.18
  • @​better-auth/mongo-adapter@1.7.18
  • @​better-auth/prisma-adapter@1.7.18
  • @​better-auth/telemetry@1.7.18

v1.7.17

Compare Source

Patch Changes

• #​12181 b6a87ad Thanks @​aliamanatali! - A remembered sign-in or sign-up now refreshes its session like any other remembered session, even if an earlier sign-in in the same browser used rememberMe: false. Previously the earlier choice stayed in a dont_remember cookie until the browser closed, so the new session stopped sliding and expired expiresIn after it was created.

• #​12216 cff7c1c Thanks @​bytaesu! - Denying a device authorization request now rejects a session that was revoked but still present in the cookie cache, matching the behavior of approving a request.

• #​12217 16aa412 Thanks @​bytaesu! - IP wildcard trusted origins such as exp://192.168.*.*:* no longer match custom-scheme hosts with out-of-range or zero-padded octets like 192.168.999.999.

• #​12219 9150314 Thanks @​bytaesu! - Signing up with an empty phoneNumber with the phone number plugin no longer stores the empty string or makes later sign-ups fail. Linking an account whose profile maps an empty phone number no longer replaces the user's verified number.

• #​12212 f5be351 Thanks @​bytaesu! - Fixed sessions created by a session.delete.after hook during "revoke all sessions" being treated as revoked immediately when secondaryStorage is used with storeSessionInDatabase.

• #​12211 98bcd98 Thanks @​bytaesu! - Fixed TOTP verification rejecting sessions created from an API key, so API-key sessions can now finish two-factor enrollment.

• #​12228 fbff537 Thanks @​bytaesu! - Trusted devices are honored again when an app runs the two-factor sign-in step from its own hook on another sign-in path, such as email OTP.

• Updated dependencies [fc2e00b]:

  • @​better-auth/kysely-adapter@1.7.17
  • @​better-auth/core@1.7.17
  • @​better-auth/drizzle-adapter@1.7.17
  • @​better-auth/memory-adapter@1.7.17
  • @​better-auth/mongo-adapter@1.7.17
  • @​better-auth/prisma-adapter@1.7.17
  • @​better-auth/telemetry@1.7.17

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • Only on Thursday (* * * * 4)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.