@better-auth/sso 1.7.1 → 1.7.3

package/dist/client.d.mts

@@ -1,4 +1,4 @@
-import { t as SSOPlugin } from "./index-CZytzKv6.mjs";
+import { t as SSOPlugin } from "./index-sM6JWXeV.mjs";
 import { DBFieldAttribute } from "better-auth/db";
 
 //#region src/client.d.ts

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-BbG1DbY-.mjs";
+import { t as PACKAGE_VERSION } from "./version-BA_IW5w3.mjs";
 //#region src/client.ts
 const ssoClient = (options) => {
 	return {

package/dist/{index-CZytzKv6.d.mts → index-sM6JWXeV.d.mts}

@@ -1511,7 +1511,7 @@ declare const callbackSSO: (options?: SSOOptions) => _$better_call0.StrictEndpoi
     };
     scope: "server";
   };
-}, void>;
+}, never>;
 /**
  * Shared OIDC callback endpoint (no `:providerId` in path).
  * Used when `options.redirectURI` is set — the `providerId` is read from
@@ -1539,7 +1539,7 @@ declare const callbackSSOShared: (options?: SSOOptions) => _$better_call0.Strict
     error_description: z.ZodOptional<z.ZodString>;
   }, z.core.$strip>;
   allowedMediaTypes: readonly ["application/x-www-form-urlencoded", "application/json"];
-}, void>;
+}, never>;
 declare const acsEndpoint: (options?: SSOOptions) => _$better_call0.StrictEndpoint<"/sso/saml2/sp/acs/:providerId", {
   method: ("GET" | "POST")[];
   body: z.ZodOptional<z.ZodObject<{

package/dist/index.d.mts

@@ -1,2 +1,2 @@
-import { A as SAMLIdentityProviderMetadata, B as SSOUserResolutionContext, C as deriveSAMLIdentityProviderEntityID, D as DEFAULT_MAX_SAML_RESPONSE_SIZE, E as DEFAULT_MAX_SAML_METADATA_SIZE, F as SSOProviderMutationGuardInput, G as DigestAlgorithm, H as AlgorithmValidationOptions, I as SSOProviderReference, K as KeyEncryptionAlgorithm, L as SSOProviderUserProfile, M as SSOOptions, N as SSOProvider, O as OIDCConfig, P as SSOProviderMutationGuardContext, R as SSOSAMLUserResolutionInput, S as SAMLServiceProviderPolicy, T as DEFAULT_CLOCK_SKEW_MS, U as DataEncryptionAlgorithm, V as SSOUserResolutionInput, W as DeprecatedAlgorithmBehavior, _ as REQUIRED_DISCOVERY_FIELDS, a as fetchDiscoveryDocument, b as TimestampValidationOptions, c as normalizeUrl, d as validateDiscoveryUrl, f as DiscoverOIDCConfigParams, g as OIDCDiscoveryDocument, h as HydratedOIDCConfig, i as discoverOIDCConfig, j as SSOOIDCUserResolutionInput, k as SAMLConfig, l as selectTokenEndpointAuthMethod, m as DiscoveryErrorCode, n as sso, o as needsRuntimeDiscovery, p as DiscoveryError, q as SignatureAlgorithm, r as computeDiscoveryUrl, s as normalizeDiscoveryUrls, t as SSOPlugin, u as validateDiscoveryDocument, v as RequiredDiscoveryField, w as deriveSAMLServiceProviderPolicy, x as validateSAMLTimestamp, y as SAMLConditions, z as SSOUserResolution } from "./index-CZytzKv6.mjs";
+import { A as SAMLIdentityProviderMetadata, B as SSOUserResolutionContext, C as deriveSAMLIdentityProviderEntityID, D as DEFAULT_MAX_SAML_RESPONSE_SIZE, E as DEFAULT_MAX_SAML_METADATA_SIZE, F as SSOProviderMutationGuardInput, G as DigestAlgorithm, H as AlgorithmValidationOptions, I as SSOProviderReference, K as KeyEncryptionAlgorithm, L as SSOProviderUserProfile, M as SSOOptions, N as SSOProvider, O as OIDCConfig, P as SSOProviderMutationGuardContext, R as SSOSAMLUserResolutionInput, S as SAMLServiceProviderPolicy, T as DEFAULT_CLOCK_SKEW_MS, U as DataEncryptionAlgorithm, V as SSOUserResolutionInput, W as DeprecatedAlgorithmBehavior, _ as REQUIRED_DISCOVERY_FIELDS, a as fetchDiscoveryDocument, b as TimestampValidationOptions, c as normalizeUrl, d as validateDiscoveryUrl, f as DiscoverOIDCConfigParams, g as OIDCDiscoveryDocument, h as HydratedOIDCConfig, i as discoverOIDCConfig, j as SSOOIDCUserResolutionInput, k as SAMLConfig, l as selectTokenEndpointAuthMethod, m as DiscoveryErrorCode, n as sso, o as needsRuntimeDiscovery, p as DiscoveryError, q as SignatureAlgorithm, r as computeDiscoveryUrl, s as normalizeDiscoveryUrls, t as SSOPlugin, u as validateDiscoveryDocument, v as RequiredDiscoveryField, w as deriveSAMLServiceProviderPolicy, x as validateSAMLTimestamp, y as SAMLConditions, z as SSOUserResolution } from "./index-sM6JWXeV.mjs";
 export { AlgorithmValidationOptions, DEFAULT_CLOCK_SKEW_MS, DEFAULT_MAX_SAML_METADATA_SIZE, DEFAULT_MAX_SAML_RESPONSE_SIZE, DataEncryptionAlgorithm, DeprecatedAlgorithmBehavior, DigestAlgorithm, DiscoverOIDCConfigParams, DiscoveryError, DiscoveryErrorCode, HydratedOIDCConfig, KeyEncryptionAlgorithm, OIDCConfig, OIDCDiscoveryDocument, REQUIRED_DISCOVERY_FIELDS, RequiredDiscoveryField, SAMLConditions, SAMLConfig, SAMLIdentityProviderMetadata, SAMLServiceProviderPolicy, SSOOIDCUserResolutionInput, SSOOptions, SSOPlugin, SSOProvider, SSOProviderMutationGuardContext, SSOProviderMutationGuardInput, SSOProviderReference, SSOProviderUserProfile, SSOSAMLUserResolutionInput, SSOUserResolution, SSOUserResolutionContext, SSOUserResolutionInput, SignatureAlgorithm, TimestampValidationOptions, computeDiscoveryUrl, deriveSAMLIdentityProviderEntityID, deriveSAMLServiceProviderPolicy, discoverOIDCConfig, fetchDiscoveryDocument, needsRuntimeDiscovery, normalizeDiscoveryUrls, normalizeUrl, selectTokenEndpointAuthMethod, sso, validateDiscoveryDocument, validateDiscoveryUrl, validateSAMLTimestamp };

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-BbG1DbY-.mjs";
+import { t as PACKAGE_VERSION } from "./version-BA_IW5w3.mjs";
 import { APIError, addOAuthServerContext, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
 import { XMLParser, XMLValidator } from "fast-xml-parser";
 import { X509Certificate } from "node:crypto";
@@ -18,6 +18,7 @@ import samlifyDefault from "samlify";
 import { defineErrorCodes } from "@better-auth/core/utils/error-codes";
 import { parseInputData, toZodSchema } from "better-auth/db";
 import { isAPIError } from "@better-auth/core/utils/is-api-error";
+import { appendQueryParams } from "@better-auth/core/utils/url";
 import { HIDE_METADATA, PRIVATE_KEY_JWT_SIGNING_ALGORITHMS, authorizationCodeRequest, createAuthorizationURL, createPrivateKeyJwtClientAssertionGetter, generateGenericState, generateState, getOAuth2Tokens, parseGenericState, parseState } from "better-auth";
 import { deleteSessionCookie, setAccountCookie, setSessionCookie } from "better-auth/cookies";
 import { additionalAuthorizationParamsSchema, handleOAuthUserInfo } from "better-auth/oauth2";
@@ -3040,7 +3041,6 @@ async function processSAMLResponse(ctx, params, options) {
 				},
 				account: {
 					providerId,
-					issuer: accountKey.issuer,
 					accountId: accountKey.accountId,
 					accessToken: "",
 					refreshToken: ""
@@ -3796,33 +3796,31 @@ async function handleOIDCCallback(ctx, options, providerId, stateData, parsedPro
 	const { code, error, error_description } = ctx.query;
 	if (!stateData) stateData = await parseState(ctx);
 	if (!stateData) {
-		const errorURL = ctx.context.options.onAPIError?.errorURL || `${ctx.context.baseURL}/error`;
-		throw ctx.redirect(`${errorURL}?error=invalid_state`);
+		const redirectURL = appendQueryParams(ctx.context.options.onAPIError?.errorURL || `${ctx.context.baseURL}/error`, new URLSearchParams({ error: "invalid_state" }));
+		throw ctx.redirect(redirectURL);
 	}
 	const providerReference = parsedProviderReference ?? parseSSOProviderReference(stateData.serverContext?.["ssoProviderReference"]);
 	const { callbackURL, errorURL, newUserURL, requestSignUp } = stateData;
 	const redirectOIDCError = (error, description) => {
 		const baseURL = errorURL || callbackURL;
-		const params = new URLSearchParams({
-			error,
-			error_description: description
-		});
-		const separator = baseURL.includes("?") ? "&" : "?";
-		throw ctx.redirect(`${baseURL}${separator}${params.toString()}`);
+		const params = new URLSearchParams({ error });
+		if (description) params.set("error_description", description);
+		const redirectURL = appendQueryParams(baseURL, params);
+		throw ctx.redirect(redirectURL);
 	};
-	if (!code || error) redirectOIDCError(error || "invalid_request", error_description || (error ? error : "authorization_code_not_found"));
+	if (!code || error) return redirectOIDCError(error || "invalid_request", error_description || (error ? error : "authorization_code_not_found"));
 	const provider = await resolveOIDCProvider(ctx, options, providerId);
-	if (!provider) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=provider not found`);
+	if (!provider) return redirectOIDCError("invalid_provider", "provider not found");
 	const acceptedProviderReference = providerReference ?? redirectOIDCError("invalid_state", "missing_sso_provider_reference");
-	if (!await isCurrentSSOProviderReference(provider, acceptedProviderReference)) redirectOIDCError("invalid_state", "sso_provider_changed_during_authentication");
+	if (!await isCurrentSSOProviderReference(provider, acceptedProviderReference)) return redirectOIDCError("invalid_state", "sso_provider_changed_during_authentication");
 	if (options?.domainVerification?.enabled && !("domainVerified" in provider && provider.domainVerified)) throw new APIError("UNAUTHORIZED", { message: "Provider domain has not been verified" });
 	let config = provider.oidcConfig;
-	if (!config) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=provider not found`);
+	if (!config) return redirectOIDCError("invalid_provider", "provider not found");
 	try {
 		config = await ensureRuntimeDiscovery(config, provider.issuer, (url) => ctx.context.isTrustedOrigin(url));
 	} catch (error) {
-		if (error instanceof DiscoveryError) throw ctx.redirect(`${errorURL || callbackURL}?error=discovery_failed&error_description=${encodeURIComponent(error.message)}`);
-		throw ctx.redirect(`${errorURL || callbackURL}?error=discovery_failed&error_description=unexpected_discovery_error`);
+		if (error instanceof DiscoveryError) return redirectOIDCError("discovery_failed", error.message);
+		return redirectOIDCError("discovery_failed", "unexpected_discovery_error");
 	}
 	if (!config.scopes) config = {
 		...config,
@@ -3833,7 +3831,7 @@ async function handleOIDCCallback(ctx, options, providerId, stateData, parsedPro
 			"offline_access"
 		]
 	};
-	if (!config.tokenEndpoint) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=token_endpoint_not_found`);
+	if (!config.tokenEndpoint) return redirectOIDCError("invalid_provider", "token_endpoint_not_found");
 	const tokenEndpoint = config.tokenEndpoint;
 	let tokenEndpointAuth = config.tokenEndpointAuthentication === "client_secret_post" ? { method: "client_secret_post" } : { method: "client_secret_basic" };
 	if (config.tokenEndpointAuthentication === "private_key_jwt") {
@@ -3845,7 +3843,7 @@ async function handleOIDCCallback(ctx, options, providerId, stateData, parsedPro
 			keyId: config.privateKeyId,
 			issuer: config.issuer
 		});
-		if (!resolved || !resolved.privateKeyJwk && !resolved.privateKeyPem) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=no_private_key_available`);
+		if (!resolved || !resolved.privateKeyJwk && !resolved.privateKeyPem) return redirectOIDCError("invalid_provider", "no_private_key_available");
 		const rawAlg = config.privateKeyAlgorithm ?? resolved.algorithm;
 		const algorithm = rawAlg && PRIVATE_KEY_JWT_SIGNING_ALGORITHMS.includes(rawAlg) ? rawAlg : void 0;
 		tokenEndpointAuth = {
@@ -3874,16 +3872,16 @@ async function handleOIDCCallback(ctx, options, providerId, stateData, parsedPro
 			body,
 			headers
 		}, (url) => ctx.context.isTrustedOrigin(url));
-		if (error) redirectOIDCError("invalid_provider", getOIDCErrorDescription(error, "token_response_error"));
+		if (error) return redirectOIDCError("invalid_provider", getOIDCErrorDescription(error, "token_response_error"));
 		if (!data) throw new Error("Token endpoint returned an empty response");
 		return getOAuth2Tokens(data);
 	})().catch((e) => {
 		if (isAPIError(e)) throw e;
 		ctx.context.logger.error("Error validating authorization code", e);
-		if (e instanceof DiscoveryError) redirectOIDCError("invalid_provider", e.message);
-		redirectOIDCError("invalid_provider", getOIDCErrorDescription(e, "token_response_error"));
+		if (e instanceof DiscoveryError) return redirectOIDCError("invalid_provider", e.message);
+		return redirectOIDCError("invalid_provider", getOIDCErrorDescription(e, "token_response_error"));
 	});
-	if (!tokenResponse) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=token_response_not_found`);
+	if (!tokenResponse) return redirectOIDCError("invalid_provider", "token_response_not_found");
 	let userInfo = null;
 	const mapping = config.mapping || {};
 	const readStringClaim = (claims, claim) => {
@@ -3894,28 +3892,28 @@ async function handleOIDCCallback(ctx, options, providerId, stateData, parsedPro
 	let verifiedIdToken = null;
 	if (tokenResponse.idToken) {
 		const jwksEndpoint = config.jwksEndpoint;
-		if (!jwksEndpoint) redirectOIDCError("invalid_provider", "jwks_endpoint_not_found");
+		if (!jwksEndpoint) return redirectOIDCError("invalid_provider", "jwks_endpoint_not_found");
 		const verified = await validateOIDCIdToken(tokenResponse.idToken, jwksEndpoint, {
 			audience: config.clientId,
 			issuer: provider.issuer
 		}, (url) => ctx.context.isTrustedOrigin(url)).catch((error) => {
-			if (error instanceof DiscoveryError) redirectOIDCError("invalid_provider", error.message);
+			if (error instanceof DiscoveryError) return redirectOIDCError("invalid_provider", error.message);
 			ctx.context.logger.error(error);
 			return null;
 		});
-		if (!verified) redirectOIDCError("invalid_provider", "token_not_verified");
-		if (!readStringClaim(verified.payload, "sub")) redirectOIDCError("invalid_provider", "id_token_subject_missing");
+		if (!verified) return redirectOIDCError("invalid_provider", "token_not_verified");
+		if (!readStringClaim(verified.payload, "sub")) return redirectOIDCError("invalid_provider", "id_token_subject_missing");
 		verifiedIdToken = verified;
 	}
-	if (options?.resolveUser && !verifiedIdToken) redirectOIDCError("invalid_provider", "id_token_required_for_user_resolution");
+	if (options?.resolveUser && !verifiedIdToken) return redirectOIDCError("invalid_provider", "id_token_required_for_user_resolution");
 	if (config.userInfoEndpoint) {
 		const userInfoResponse = await fetchOIDCEndpoint("userInfoEndpoint", config.userInfoEndpoint, { headers: { Authorization: `Bearer ${tokenResponse.accessToken}` } }, (url) => ctx.context.isTrustedOrigin(url)).catch((e) => {
-			if (e instanceof DiscoveryError) redirectOIDCError("invalid_provider", e.message);
+			if (e instanceof DiscoveryError) return redirectOIDCError("invalid_provider", e.message);
 			throw e;
 		});
-		if (userInfoResponse.error) redirectOIDCError("invalid_provider", userInfoResponse.error.message || userInfoResponse.error.statusText || "userinfo_response_error");
+		if (userInfoResponse.error) return redirectOIDCError("invalid_provider", userInfoResponse.error.message || userInfoResponse.error.statusText || "userinfo_response_error");
 		const rawUserInfo = userInfoResponse.data ?? redirectOIDCError("invalid_provider", "userinfo_response_not_found");
-		if (verifiedIdToken && rawUserInfo.sub !== verifiedIdToken.payload.sub) redirectOIDCError("invalid_provider", "id_token_userinfo_subject_mismatch");
+		if (verifiedIdToken && rawUserInfo.sub !== verifiedIdToken.payload.sub) return redirectOIDCError("invalid_provider", "id_token_userinfo_subject_mismatch");
 		rawProfile = rawUserInfo;
 		userInfo = {
 			...Object.fromEntries(Object.entries(mapping.extraFields || {}).map(([key, value]) => [key, rawUserInfo[value]])),
@@ -3936,8 +3934,8 @@ async function handleOIDCCallback(ctx, options, providerId, stateData, parsedPro
 			name: readStringClaim(idToken, mapping.name || "name"),
 			image: readStringClaim(idToken, mapping.image || "picture")
 		};
-	} else throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=user_info_endpoint_not_found`);
-	if (!userInfo.email || !userInfo.id) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=missing_user_info`);
+	} else return redirectOIDCError("invalid_provider", "user_info_endpoint_not_found");
+	if (!userInfo.email || !userInfo.id) return redirectOIDCError("invalid_provider", "missing_user_info");
 	const userInfoEmail = userInfo.email;
 	const userInfoId = userInfo.id;
 	const providerUser = {
@@ -3992,7 +3990,6 @@ async function handleOIDCCallback(ctx, options, providerId, stateData, parsedPro
 					idToken: tokenResponse.idToken,
 					accessToken: tokenResponse.accessToken,
 					refreshToken: tokenResponse.refreshToken,
-					issuer: accountKey.issuer,
 					accountId: userInfoId,
 					providerId: provider.providerId,
 					accessTokenExpiresAt: tokenResponse.accessTokenExpiresAt,
@@ -4025,20 +4022,10 @@ async function handleOIDCCallback(ctx, options, providerId, stateData, parsedPro
 	} catch (e) {
 		const failedAuthentication = getFailedSSOAuthenticationResult(e);
 		if (failedAuthentication) linked = failedAuthentication;
-		else if (isAPIError(e) && e.body?.code) {
-			const baseURL = errorURL || callbackURL;
-			const params = new URLSearchParams({ error: e.body.code });
-			if (e.body.message) params.set("error_description", e.body.message);
-			const sep = baseURL.includes("?") ? "&" : "?";
-			throw ctx.redirect(`${baseURL}${sep}${params.toString()}`);
-		} else throw e;
-	}
-	if (linked.error) {
-		const baseURL = errorURL || callbackURL;
-		const params = new URLSearchParams({ error: linked.error });
-		const sep = baseURL.includes("?") ? "&" : "?";
-		throw ctx.redirect(`${baseURL}${sep}${params.toString()}`);
+		else if (isAPIError(e) && e.body?.code) return redirectOIDCError(e.body.code, e.body.message);
+		else throw e;
 	}
+	if (linked.error) return redirectOIDCError(linked.error);
 	const { session, user } = linked.data;
 	if (options?.provisionUser && (linked.isRegister || options.provisionUserOnEveryLogin)) await options.provisionUser({
 		user,
@@ -4189,13 +4176,16 @@ const callbackSSOShared = (options) => {
 	}, async (ctx) => {
 		const stateData = await parseState(ctx);
 		if (!stateData) {
-			const errorURL = ctx.context.options.onAPIError?.errorURL || `${ctx.context.baseURL}/error`;
-			throw ctx.redirect(`${errorURL}?error=invalid_state`);
+			const redirectURL = appendQueryParams(ctx.context.options.onAPIError?.errorURL || `${ctx.context.baseURL}/error`, new URLSearchParams({ error: "invalid_state" }));
+			throw ctx.redirect(redirectURL);
 		}
 		const providerReference = parseSSOProviderReference(stateData.serverContext?.[SSO_PROVIDER_STATE_KEY]);
 		if (!providerReference) {
-			const errorURL = stateData.errorURL || stateData.callbackURL;
-			throw ctx.redirect(`${errorURL}?error=invalid_state&error_description=missing_sso_provider_reference`);
+			const redirectURL = appendQueryParams(stateData.errorURL || stateData.callbackURL, new URLSearchParams({
+				error: "invalid_state",
+				error_description: "missing_sso_provider_reference"
+			}));
+			throw ctx.redirect(redirectURL);
 		}
 		return handleOIDCCallback(ctx, options, providerReference.providerId, stateData, providerReference);
 	});
@@ -4230,8 +4220,8 @@ const acsEndpoint = (options) => {
 		let resolvedErrorRedirectUrl;
 		if (ctx.method === "GET" && !ctx.body?.SAMLResponse) {
 			if (!(await getSessionFromCtx(ctx))?.session) {
-				const errorURL = ctx.context.options.onAPIError?.errorURL || `${appOrigin}/error`;
-				throw ctx.redirect(`${errorURL}?error=invalid_request`);
+				const redirectURL = appendQueryParams(ctx.context.options.onAPIError?.errorURL || `${appOrigin}/error`, new URLSearchParams({ error: "invalid_request" }));
+				throw ctx.redirect(redirectURL);
 			}
 			const relayState = ctx.query?.RelayState;
 			throw ctx.redirect(getSafeRedirectUrl([relayState], currentCallbackPath, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings)));
@@ -4298,7 +4288,13 @@ const sloEndpoint = (options) => {
 		const relayState = ctx.body?.RelayState || ctx.query?.RelayState;
 		const appOrigin = new URL(ctx.context.baseURL).origin;
 		const safeErrorURL = getSafeRedirectUrl([relayState], `${appOrigin}/sso/saml2/sp/slo/${providerId}`, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
-		if (!samlRequest && !samlResponse) throw ctx.redirect(`${safeErrorURL}?error=invalid_request&error_description=missing_logout_data`);
+		if (!samlRequest && !samlResponse) {
+			const redirectURL = appendQueryParams(safeErrorURL, new URLSearchParams({
+				error: "invalid_request",
+				error_description: "missing_logout_data"
+			}));
+			throw ctx.redirect(redirectURL);
+		}
 		const provider = await findSAMLProvider(providerId, options, ctx.context.adapter);
 		if (!provider?.samlConfig) throw APIError.from("NOT_FOUND", SAML_ERROR_CODES.SAML_PROVIDER_NOT_FOUND);
 		const config = provider.samlConfig;

package/dist/{version-BbG1DbY-.mjs → version-BA_IW5w3.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.7.1";
+const PACKAGE_VERSION = "1.7.3";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/sso",
-  "version": "1.7.1",
+  "version": "1.7.3",
   "description": "SSO plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -56,12 +56,12 @@
     }
   },
   "dependencies": {
-    "@xmldom/xmldom": "^0.9.10",
+    "@xmldom/xmldom": "^0.9.12",
     "fast-xml-parser": "^5.8.0",
     "jose": "^6.2.3",
     "samlify": "^2.13.1",
     "tldts": "^7.4.3",
-    "zod": "^4.3.6"
+    "zod": "^4.5.4"
   },
   "devDependencies": {
     "@types/body-parser": "^1.19.6",
@@ -72,16 +72,16 @@
     "kysely": "^0.28.17 || ^0.29.0",
     "oauth2-mock-server": "^9.0.0",
     "tsdown": "0.21.10",
-    "@better-auth/core": "1.7.1",
-    "@better-auth/kysely-adapter": "1.7.1",
-    "better-auth": "1.7.1"
+    "@better-auth/core": "1.7.3",
+    "@better-auth/kysely-adapter": "1.7.3",
+    "better-auth": "1.7.3"
   },
   "peerDependencies": {
     "@better-auth/utils": "0.4.2",
     "@better-fetch/fetch": "1.3.1",
     "better-call": "1.4.0",
-    "@better-auth/core": "^1.7.1",
-    "better-auth": "^1.7.1"
+    "@better-auth/core": "^1.7.3",
+    "better-auth": "^1.7.3"
   },
   "scripts": {
     "build": "tsdown",