[dependabot]

Bumps @better-auth/test-utils from 1.7.4 to 1.7.12.

Release notes

Sourced from @​better-auth/test-utils's releases.

v1.7.12

[!IMPORTANT] Action required

• If you use ID token sign-in with a provider that has no clientId, set clientId to every client ID your apps sign in with. (#11931)

better-auth

Bug Fixes

• Fixed the JWT plugin to verify JWTs and session cookie-cache JWTs with the stored key's algorithm instead of the token header's, and to warn when signing or verifying a JWT without an issuer or audience (#11925)
• Fixed OAuth callbacks completed through the OAuth proxy to run the same checks as the standard OAuth callback, including issuer and ID token nonce validation (#11930)
• Fixed auth.api.getSession() to keep the original database error as error.cause when the session lookup fails (#11924)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed mapProfileToUser failing to typecheck under exactOptionalPropertyTypes when it returns undefined for name, email, or image (#11918)
• Fixed ID token sign-in to reject tokens when the provider has no client ID, since their audience cannot be checked (#11931)
• Fixed a custom Facebook getUserInfo to no longer receive client-submitted access tokens issued to another Facebook app, and ID tokens missing exp or iat are now rejected (#11919)
• Restored the Twitch and Paybin ID token handling from before 1.7.11, which made account info fail once the ID token stored at sign-in expired (#11920)
• Added a cause option as a third argument to APIError.from() to keep the underlying error for server-side callers without exposing it in the response (#11924)

For detailed changes, see CHANGELOG

@better-auth/mcp

Bug Fixes

• Fixed requireMcpAuth to accept only OAuth access tokens and reject session JWTs from the JWT plugin, even when they share the issuer and audience (#11934)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed OIDC SSO sign-in to reject ID tokens missing exp or iat and providers with an empty client ID, matching social sign-in (#11935)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​alpcanaydin, @​bytaesu

... (truncated)

Changelog

Sourced from @​better-auth/test-utils's changelog.

1.7.12

1.7.11

1.7.10

1.7.9

1.7.8

1.7.7

1.7.6

1.7.5

Commits

• f4260a9 chore: release v1.7.12 (#11922)
• 52ab801 chore: release v1.7.11 (#11827)
• b734a41 chore: release v1.7.10 (#11795)
• 99cdfe7 fix(oauth-provider): keep consent separate per reference (#11801)
• d2a5f83 chore: release v1.7.9 (#11761)
• 5f4cc5c chore: release v1.7.8 (#11513)
• 369176e fix(db): keep derived replay-marker ids under uuid and serial ids (#11625)
• db02f23 chore: release v1.7.7 (#11413)
• 229a02a chore: release v1.7.6 (#11322)
• 5468e6b chore: release v1.7.5 (#11245)
• See full diff in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
stack-docs	Ready	Preview	Oct 26, 2026 11:10am UTC

[changeset-bot]

⚠️ No Changeset found

Latest commit: 9f19d83

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR