Bump better-auth from 1.7.1 to 1.7.2

[dependabot]

Bumps better-auth from 1.7.1 to 1.7.2.

Release notes

Sourced from better-auth's releases.

v1.7.2

better-auth

Bug Fixes

• Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
• Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
• Added warnings for invalid signed session data in the cookie cache. (#10934)
• Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
• Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
• Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
• Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
• Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
• Improved getTestInstance performance with a faster default password hasher. (#10879)
• Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
• Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
• Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
• Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
• Added synchronous and optional access to the current auth endpoint context. (#10938)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
• Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
• Fixed relative redirect URLs containing fragments. (#10983)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
• Added validation for missing Drizzle schema fields in compound where clauses. (#10859)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.2

Patch Changes

• #10875 d5d889b Thanks @​bytaesu! - Fix programmatic migrations failing on Cloudflare D1 while preserving existing-index validation across supported databases.

• #10982 b4ad5a1 Thanks @​bytaesu! - Built-in placeholder emails now consistently use the namespaced {identifier}@{namespace}.placeholder.invalid format.

• #10934 c7a5c1a Thanks @​bytaesu! - Cookie-cache reads now warn when signed session data is invalid instead of silently appearing as a signed-out session.

• #10879 78f0c39 Thanks @​starslingdev! - Test suites using getTestInstance now run faster because the shared fixture avoids production password-hashing costs by default. Custom emailAndPassword.password implementations continue to take precedence.

• #10823 ce8a3ab Thanks @​sosyz! - Ensure permanently banning a user clears any expiration from a previous temporary ban.

• #10907 a021eaf Thanks @​heliohm! - A client created with more plugins is again assignable to a client type declaring fewer plugins, as in 1.6.

• #10959 c8dcfa5 Thanks @​bytaesu! - Allow same-origin form submissions from pages using Referrer-Policy: no-referrer while continuing to reject untrusted request origins.

• #10979 fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.

• #10041 f6891a2 Thanks @​GautamBytes! - Allow ~ in relative callback URLs validated by trusted origin checks.

• #10877 649818a Thanks @​bytaesu! - Prevent disabled MyISAM indexes from satisfying migration index checks.

• Updated dependencies [557e19b, 64da15b, d5d889b, b4ad5a1, ea77118, 5aea9f7, fced1a5, e1d4011]:

  • @​better-auth/core@​1.7.2
  • @​better-auth/kysely-adapter@​1.7.2
  • @​better-auth/drizzle-adapter@​1.7.2
  • @​better-auth/memory-adapter@​1.7.2
  • @​better-auth/mongo-adapter@​1.7.2
  • @​better-auth/prisma-adapter@​1.7.2
  • @​better-auth/telemetry@​1.7.2

Commits

• ba12fcd chore: release v1.7.2 (#10870)
• 79904f0 fix(origin-check): support fragments in relative redirect URLs (#10983)
• c8dcfa5 fix(origin-check): validate null origins using fetch metadata (#10959)
• e1d4011 fix(logger): respect configured logger in auth request context (#10939)
• 557e19b refactor(context): clarify auth endpoint context access (#10938)
• b4ad5a1 refactor: centralize placeholder email generation (#10982)
• fced1a5 fix(origin-check): improve relative callback URL validation (#10979)
• f6891a2 fix(origin-check): allow tilde in relative callback URLs (#10041)
• ce8a3ab fix(admin): ban without a duration should clear the previous expiration (#10823)
• a021eaf fix(client): a client with more plugins fits a narrower client type again (#1...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
learn-postgres	Ready	Preview	Aug 31, 2026 11:27pm UTC