better-auth 1.7.10 → 1.7.12

package/dist/api/rate-limiter/index.mjs

@@ -88,7 +88,7 @@ function createDatabaseStorageWrapper(ctx) {
 				value: key
 			}]
 		}))[0];
-		if (typeof data?.lastRequest === "bigint") data.lastRequest = Number(data.lastRequest);
+		if (data) data.lastRequest = Number(data.lastRequest);
 		return data;
 	};
 	const consume = async (key, rule) => {

package/dist/api/routes/callback.mjs

@@ -1,13 +1,12 @@
 import { isAPIError } from "../../utils/is-api-error.mjs";
 import { setSessionCookie } from "../../cookies/index.mjs";
 import { getAwaitableValue } from "../../context/helpers.mjs";
-import { resolveOAuthAccountKey, toOAuthProfileRecord } from "../../oauth2/account-key.mjs";
 import { OAUTH_CALLBACK_ERROR_CODES, missingEmailLogMessage } from "../../oauth2/errors.mjs";
 import { getOAuthCallbackPath } from "../../oauth2/utils.mjs";
 import { handleOAuthUserInfo, linkOAuthAccount } from "../../oauth2/link-account.mjs";
 import { generateIdTokenNonce, generateState, parseState } from "../../oauth2/state.mjs";
+import { exchangeOAuthCallback } from "../../oauth2/callback.mjs";
 import { HIDE_METADATA } from "../../utils/hide-metadata.mjs";
-import { safeJSONParse } from "@better-auth/core/utils/json";
 import { appendQueryParams } from "@better-auth/core/utils/url";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import * as z from "zod";
@@ -92,56 +91,16 @@ const callbackOAuth = createAuthEndpoint("/callback/:id", {
 		c.context.logger.warn("OAuth provider not found", { providerId: c.params.id });
 		throw redirectOnError(OAUTH_CALLBACK_ERROR_CODES.PROVIDER_NOT_FOUND);
 	}
-	if (iss && provider.issuer && iss !== provider.issuer) {
-		c.context.logger.error("OAuth issuer mismatch", {
-			expected: provider.issuer,
-			received: iss
-		});
-		throw redirectOnError(OAUTH_CALLBACK_ERROR_CODES.ISSUER_MISMATCH);
-	}
-	if (provider.requiresIdTokenNonce && !idTokenNonce) {
-		c.context.logger.error("OAuth id_token nonce binding required but no expected nonce was found in state", { providerId: provider.id });
-		throw redirectOnError(OAUTH_CALLBACK_ERROR_CODES.NONCE_BINDING_MISSING);
-	}
-	let tokens;
-	try {
-		tokens = await provider.validateAuthorizationCode({
-			code,
-			codeVerifier,
-			deviceId: device_id,
-			redirectURI: `${c.context.baseURL}${getOAuthCallbackPath(provider)}`
-		});
-	} catch (e) {
-		c.context.logger.error("", e);
-		throw redirectOnError(OAUTH_CALLBACK_ERROR_CODES.INVALID_CODE);
-	}
-	if (!tokens) throw redirectOnError(OAUTH_CALLBACK_ERROR_CODES.INVALID_CODE);
-	const parsedUserData = userData ? safeJSONParse(userData) : null;
-	const providerResult = await provider.getUserInfo({
-		...tokens,
-		...idTokenNonce ? { expectedIdTokenNonce: idTokenNonce } : {},
-		/**
-		* The user object from the provider
-		* This is only available for some providers like Apple
-		*/
-		user: parsedUserData ?? void 0
+	const exchanged = await exchangeOAuthCallback(c, provider, {
+		code,
+		codeVerifier,
+		iss,
+		deviceId: device_id,
+		user: userData,
+		idTokenNonce
 	});
-	if (!providerResult?.user) {
-		c.context.logger.error("Unable to get user info");
-		return redirectOnError(OAUTH_CALLBACK_ERROR_CODES.UNABLE_TO_GET_USER_INFO);
-	}
-	const userInfo = providerResult.user;
-	const providerProfile = toOAuthProfileRecord(providerResult.data);
-	let accountKey;
-	try {
-		accountKey = await resolveOAuthAccountKey(provider, tokens, providerResult.data);
-	} catch (error) {
-		c.context.logger.error("Unable to derive provider account identity", {
-			providerId: provider.id,
-			error
-		});
-		return redirectOnError(OAUTH_CALLBACK_ERROR_CODES.UNABLE_TO_GET_USER_INFO);
-	}
+	if (exchanged.error) throw redirectOnError(exchanged.error);
+	const { tokens, userInfo, providerProfile, accountKey } = exchanged;
 	const { accountId } = accountKey;
 	if (!callbackURL) {
 		c.context.logger.error("No callback URL found");

package/dist/api/routes/session.mjs

@@ -229,7 +229,7 @@ const getSession = () => createAuthEndpoint("/get-session", {
 	} catch (error) {
 		if (isAPIError(error)) throw error;
 		ctx.context.logger.error("INTERNAL_SERVER_ERROR", error);
-		throw APIError.from("INTERNAL_SERVER_ERROR", BASE_ERROR_CODES.FAILED_TO_GET_SESSION);
+		throw APIError.from("INTERNAL_SERVER_ERROR", BASE_ERROR_CODES.FAILED_TO_GET_SESSION, { cause: error });
 	}
 });
 /**

package/dist/db/get-migration.mjs

@@ -16,6 +16,7 @@ const map = {
 		],
 		number: [
 			"int4",
+			"int8",
 			"integer",
 			"bigint",
 			"smallint",

package/dist/oauth2/callback.mjs

@@ -0,0 +1,68 @@
+import { resolveOAuthAccountKey, toOAuthProfileRecord } from "./account-key.mjs";
+import { OAUTH_CALLBACK_ERROR_CODES } from "./errors.mjs";
+import { getOAuthCallbackPath } from "./utils.mjs";
+import { safeJSONParse } from "@better-auth/core/utils/json";
+//#region src/oauth2/callback.ts
+/**
+* Turns a provider callback into a verified identity. It checks that the
+* callback answers this authorization request, exchanges the code, and
+* resolves the user and account key.
+*
+* Every route that completes a provider callback goes through here, so the
+* routes run the same checks.
+*/
+async function exchangeOAuthCallback(ctx, provider, callback) {
+	if (callback.iss && provider.issuer && callback.iss !== provider.issuer) {
+		ctx.context.logger.error("OAuth issuer mismatch", {
+			expected: provider.issuer,
+			received: callback.iss
+		});
+		return { error: OAUTH_CALLBACK_ERROR_CODES.ISSUER_MISMATCH };
+	}
+	if (provider.requiresIdTokenNonce && !callback.idTokenNonce) {
+		ctx.context.logger.error("OAuth id_token nonce binding required but no expected nonce was found in state", { providerId: provider.id });
+		return { error: OAUTH_CALLBACK_ERROR_CODES.NONCE_BINDING_MISSING };
+	}
+	let tokens;
+	try {
+		tokens = await provider.validateAuthorizationCode({
+			code: callback.code,
+			codeVerifier: callback.codeVerifier,
+			deviceId: callback.deviceId,
+			redirectURI: `${ctx.context.baseURL}${getOAuthCallbackPath(provider)}`
+		});
+	} catch (error) {
+		ctx.context.logger.error("Failed to validate authorization code", error);
+		return { error: OAUTH_CALLBACK_ERROR_CODES.INVALID_CODE };
+	}
+	if (!tokens) return { error: OAUTH_CALLBACK_ERROR_CODES.INVALID_CODE };
+	const result = await provider.getUserInfo({
+		...tokens,
+		expectedIdTokenNonce: callback.idTokenNonce,
+		/**
+		* The user object from the provider
+		* This is only available for some providers like Apple
+		*/
+		user: safeJSONParse(callback.user) ?? void 0
+	});
+	if (!result?.user) {
+		ctx.context.logger.error("Unable to get user info");
+		return { error: OAUTH_CALLBACK_ERROR_CODES.UNABLE_TO_GET_USER_INFO };
+	}
+	const accountKey = await resolveOAuthAccountKey(provider, tokens, result.data).catch((error) => {
+		ctx.context.logger.error("Unable to derive provider account identity", {
+			providerId: provider.id,
+			error
+		});
+		return null;
+	});
+	if (!accountKey) return { error: OAUTH_CALLBACK_ERROR_CODES.UNABLE_TO_GET_USER_INFO };
+	return {
+		tokens,
+		userInfo: result.user,
+		providerProfile: toOAuthProfileRecord(result.data),
+		accountKey
+	};
+}
+//#endregion
+export { exchangeOAuthCallback };

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.7.10";
+var version = "1.7.12";
 //#endregion
 export { version };

package/dist/plugins/jwt/adapter.mjs

@@ -1,5 +1,16 @@
 import { getCurrentAdapter } from "@better-auth/core/context";
 //#region src/plugins/jwt/adapter.ts
+/**
+* Algorithm of the key the plugin generates when `jwks.keyPairConfig` is unset.
+*/
+const DEFAULT_JWK_ALG = "EdDSA";
+/**
+* Algorithm for new keys, and for stored keys saved before the `alg` column
+* existed.
+*/
+function getDefaultKeyAlg(options) {
+	return options?.jwks?.keyPairConfig?.alg ?? "EdDSA";
+}
 const getJwksAdapter = (baseAdapter, options) => {
 	return {
 		getAllKeys: async (ctx) => {
@@ -38,7 +49,7 @@ const getJwksAdapter = (baseAdapter, options) => {
 		*
 		* Legacy rows persisted before the `alg` column existed have
 		* `alg: null`. Per `schema.ts`, those rows are treated as the
-		* configured default alg (`options.jwks.keyPairConfig.alg ?? "EdDSA"`),
+		* configured default alg ({@link getDefaultKeyAlg}),
 		* so deployments that have only legacy rows can still satisfy an
 		* audience-pinned `signingAlgorithm` matching the default.
 		*
@@ -48,7 +59,7 @@ const getJwksAdapter = (baseAdapter, options) => {
 		getLatestKeyByAlg: async (ctx, alg) => {
 			const candidates = options?.adapter?.getJwks ? await options.adapter.getJwks(ctx) : await (await getCurrentAdapter(baseAdapter)).findMany({ model: "jwks" });
 			if (!candidates) return void 0;
-			const configAlg = options?.jwks?.keyPairConfig?.alg ?? "EdDSA";
+			const configAlg = getDefaultKeyAlg(options);
 			const now = /* @__PURE__ */ new Date();
 			return candidates.filter((k) => k.alg === alg || k.alg == null && configAlg === alg).filter((k) => !k.expiresAt || k.expiresAt > now).sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime())[0];
 		},
@@ -65,4 +76,4 @@ const getJwksAdapter = (baseAdapter, options) => {
 	};
 };
 //#endregion
-export { getJwksAdapter };
+export { DEFAULT_JWK_ALG, getDefaultKeyAlg, getJwksAdapter };

package/dist/plugins/jwt/cookie-cache.mjs

@@ -1,5 +1,5 @@
 import { SESSION_COOKIE_JWT_AUDIENCE, SESSION_COOKIE_JWT_TYPE, getSessionCookieJwtVerifyOptions, parseSessionCookieJwtPayload } from "../../cookies/jwt.mjs";
-import { getJwksAdapter } from "./adapter.mjs";
+import { getDefaultKeyAlg, getJwksAdapter } from "./adapter.mjs";
 import { resolveSigningKey } from "./sign.mjs";
 import { BetterAuthError } from "@better-auth/core/error";
 import { SignJWT, decodeProtectedHeader, importJWK, jwtVerify } from "jose";
@@ -9,8 +9,7 @@ function getCookieCacheJwtIssuer(ctx) {
 	return typeof baseURL === "string" ? baseURL || "better-auth:session-cache" : ctx.context.baseURL || "better-auth:session-cache";
 }
 async function importLocalPublicKey(ctx, token, options) {
-	const header = decodeProtectedHeader(token);
-	const kid = header.kid;
+	const kid = decodeProtectedHeader(token).kid;
 	if (!kid) {
 		ctx.context.logger.debug("Cookie-cache JWT missing kid in header");
 		return null;
@@ -25,11 +24,7 @@ async function importLocalPublicKey(ctx, token, options) {
 		ctx.context.logger.debug(`No JWKS key found for cookie-cache JWT kid: ${kid}`);
 		return null;
 	}
-	const alg = key.alg ?? options?.jwks?.keyPairConfig?.alg ?? header.alg;
-	if (!alg) {
-		ctx.context.logger.debug(`No JWT algorithm available for cookie-cache JWT kid: ${kid}`);
-		return null;
-	}
+	const alg = key.alg ?? getDefaultKeyAlg(options);
 	return {
 		alg,
 		publicKey: await importJWK(JSON.parse(key.publicKey), alg)

package/dist/plugins/jwt/index.mjs

@@ -2,7 +2,7 @@ import { mergeSchema } from "../../db/schema.mjs";
 import { sessionMiddleware } from "../../api/routes/session.mjs";
 import { APIError as APIError$1 } from "../../api/index.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
-import { getJwksAdapter } from "./adapter.mjs";
+import { getDefaultKeyAlg, getJwksAdapter } from "./adapter.mjs";
 import { createJwk, generateExportedKeyPair, toExpJWT } from "./utils.mjs";
 import { getJwtToken, resolveSigningKey, signJWT } from "./sign.mjs";
 import { createCookieCacheSigner } from "./cookie-cache.mjs";
@@ -131,7 +131,7 @@ const jwt = (options) => {
 				const defaultCrv = keyPairConfig ? "crv" in keyPairConfig ? keyPairConfig.crv : void 0 : void 0;
 				return ctx.json({ keys: keys.map((keySet) => {
 					return {
-						alg: keySet.alg ?? options?.jwks?.keyPairConfig?.alg ?? "EdDSA",
+						alg: keySet.alg ?? getDefaultKeyAlg(options),
 						crv: keySet.crv ?? defaultCrv,
 						...JSON.parse(keySet.publicKey),
 						kid: keySet.id

package/dist/plugins/jwt/sign.mjs

@@ -1,5 +1,5 @@
 import { symmetricDecrypt } from "../../crypto/index.mjs";
-import { getJwksAdapter } from "./adapter.mjs";
+import { getDefaultKeyAlg, getJwksAdapter } from "./adapter.mjs";
 import { createJwk, toExpJWT } from "./utils.mjs";
 import { BetterAuthError } from "@better-auth/core/error";
 import { SignJWT, importJWK } from "jose";
@@ -29,13 +29,13 @@ async function resolveSigningKey(ctx, options, overrides) {
 		key = await adapter.getKeyById(ctx, overrides.signingKeyId);
 		if (!key) throw new BetterAuthError(`signJWT: signingKeyId "${overrides.signingKeyId}" not found in JWKS. The key must be provisioned before it can be referenced.`);
 		if (overrides.signingAlgorithm !== void 0) {
-			const configAlg = options?.jwks?.keyPairConfig?.alg ?? "EdDSA";
+			const configAlg = getDefaultKeyAlg(options);
 			if ((key.alg ?? configAlg) !== overrides.signingAlgorithm) throw new BetterAuthError(`signJWT: signingKeyId "${overrides.signingKeyId}" has alg "${key.alg ?? `unset (inherits keyPairConfig.alg "${configAlg}")`}" but signingAlgorithm was set to "${overrides.signingAlgorithm}".`);
 		}
 	} else if (overrides?.signingAlgorithm !== void 0) {
 		key = await adapter.getLatestKeyByAlg(ctx, overrides.signingAlgorithm);
 		if (!key) {
-			const primaryAlg = options?.jwks?.keyPairConfig?.alg ?? "EdDSA";
+			const primaryAlg = getDefaultKeyAlg(options);
 			const preconfig = options?.jwks?.keyPairConfigs?.find((c) => c.alg === overrides.signingAlgorithm);
 			const isPrimary = primaryAlg === overrides.signingAlgorithm;
 			if (preconfig || isPrimary) key = await createJwk(ctx, {
@@ -51,7 +51,7 @@ async function resolveSigningKey(ctx, options, overrides) {
 			}
 		}
 	} else {
-		const primaryAlg = options?.jwks?.keyPairConfig?.alg ?? "EdDSA";
+		const primaryAlg = getDefaultKeyAlg(options);
 		key = await adapter.getLatestKeyByAlg(ctx, primaryAlg) ?? await adapter.getLatestKey(ctx);
 	}
 	if (!key || key.expiresAt && key.expiresAt < /* @__PURE__ */ new Date()) {
@@ -64,7 +64,7 @@ async function resolveSigningKey(ctx, options, overrides) {
 	}).catch(() => {
 		throw new BetterAuthError("Failed to decrypt private key. Make sure the secret currently in use is the same as the one used to encrypt the private key. If you are using a different secret, either clean up your JWKS or disable private key encryption.");
 	}) : key.privateKey;
-	const alg = key.alg ?? options?.jwks?.keyPairConfig?.alg ?? "EdDSA";
+	const alg = key.alg ?? getDefaultKeyAlg(options);
 	const privateKey = await importJWK(JSON.parse(privateWebKey), alg);
 	return {
 		alg,
@@ -86,6 +86,7 @@ async function signJWT(ctx, config) {
 	const defaultIss = options?.jwt?.issuer ?? baseURLOrigin;
 	const aud = payload.aud;
 	const defaultAud = options?.jwt?.audience ?? baseURLOrigin;
+	if (!(iss ?? defaultIss) || !(aud ?? defaultAud)) ctx.context.logger.warn("[better-auth] The JWT plugin signed a JWT without an issuer or audience because no base URL was resolved for this call. Set `baseURL`, or `jwt.issuer` and `jwt.audience` in the JWT plugin options.");
 	if (options?.jwt?.sign) {
 		const jwtPayload = {
 			...payload,

package/dist/plugins/jwt/verify.mjs

@@ -1,4 +1,4 @@
-import { getJwksAdapter } from "./adapter.mjs";
+import { getDefaultKeyAlg, getJwksAdapter } from "./adapter.mjs";
 import { getCurrentAuthEndpointContext } from "@better-auth/core/context";
 import { base64 } from "@better-auth/utils/base64";
 import { importJWK, jwtVerify } from "jose";
@@ -28,11 +28,17 @@ async function verifyJWT(token, options) {
 			ctx.context.logger.debug(`No JWKS key found for kid: ${kid}`);
 			return null;
 		}
-		const cryptoKey = await importJWK(JSON.parse(key.publicKey), key.alg ?? options?.jwks?.keyPairConfig?.alg ?? "EdDSA");
+		const publicKey = JSON.parse(key.publicKey);
+		const alg = key.alg ?? getDefaultKeyAlg(options);
+		const cryptoKey = await importJWK(publicKey, alg);
 		const baseURLOrigin = typeof ctx.context.options.baseURL === "string" ? ctx.context.options.baseURL : void 0;
+		const issuer = options?.jwt?.issuer ?? baseURLOrigin;
+		const audience = options?.jwt?.audience ?? baseURLOrigin;
+		if (!issuer || !audience) ctx.context.logger.warn("[better-auth] The JWT plugin is verifying a JWT without checking its issuer or audience because no base URL was resolved for this call. Set `baseURL`, or `jwt.issuer` and `jwt.audience` in the JWT plugin options.");
 		const { payload } = await jwtVerify(token, cryptoKey, {
-			issuer: options?.jwt?.issuer ?? baseURLOrigin,
-			audience: options?.jwt?.audience ?? baseURLOrigin
+			issuer,
+			audience,
+			algorithms: [alg]
 		});
 		if (!payload.sub || !payload.aud) return null;
 		return payload;

package/dist/plugins/oauth-proxy/index.mjs

@@ -4,18 +4,16 @@ import { originCheck } from "../../api/middlewares/origin-check.mjs";
 import { parseSetCookieHeader } from "../../cookies/cookie-utils.mjs";
 import { symmetricDecrypt, symmetricEncrypt } from "../../crypto/index.mjs";
 import { setSessionCookie } from "../../cookies/index.mjs";
-import { resolveOAuthAccountKey, toOAuthProfileRecord } from "../../oauth2/account-key.mjs";
 import { redirectOnError } from "../../oauth2/errors.mjs";
-import { getOAuthCallbackPath } from "../../oauth2/utils.mjs";
 import { handleOAuthUserInfo, linkOAuthAccount } from "../../oauth2/link-account.mjs";
 import { setOAuthState } from "../../api/state/oauth.mjs";
 import { derivePurposeKey } from "../../crypto/purpose.mjs";
 import { getAuthStateVerificationIdentifier, parseGenericState } from "../../state.mjs";
+import { exchangeOAuthCallback } from "../../oauth2/callback.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { parseJSON } from "../../client/parser.mjs";
 import { checkSkipProxy, resolveCurrentURL, stripTrailingSlash } from "./utils.mjs";
 import { accountSchema, userSchema } from "@better-auth/core/db";
-import { safeJSONParse } from "@better-auth/core/utils/json";
 import { defu } from "defu";
 import { createAuthEndpoint, createAuthMiddleware } from "@better-auth/core/api";
 import * as z from "zod";
@@ -63,7 +61,9 @@ const oauthProxyQuerySchema = z.object({
 const oauthCallbackQuerySchema = z.object({
 	code: z.string().optional(),
 	error: z.string().optional(),
-	user: z.string().optional()
+	user: z.string().optional(),
+	iss: z.string().optional(),
+	device_id: z.string().optional()
 });
 const oAuthProxy = (opts) => {
 	const maxAge = opts?.maxAge ?? 60;
@@ -242,7 +242,7 @@ const oAuthProxy = (opts) => {
 						ctx.context.logger.warn("Invalid OAuth callback query", query.error);
 						return;
 					}
-					const { code, error, user: userData } = query.data;
+					const { code, error, user: userData, iss, device_id: deviceId } = query.data;
 					let stateData;
 					try {
 						stateData = parseJSON(await symmetricDecrypt({
@@ -269,47 +269,20 @@ const oAuthProxy = (opts) => {
 						ctx.context.logger.warn("OAuth provider not found", { providerId });
 						throw redirectOnError(ctx, errorURL, "oauth_provider_not_found");
 					}
-					let tokens;
-					try {
-						tokens = await provider.validateAuthorizationCode({
-							code,
-							codeVerifier: stateData.codeVerifier,
-							redirectURI: `${ctx.context.baseURL}${getOAuthCallbackPath(provider)}`
-						});
-					} catch (e) {
-						ctx.context.logger.error("Failed to validate authorization code", e);
-						throw redirectOnError(ctx, errorURL, "invalid_code");
-					}
-					if (!tokens) throw redirectOnError(ctx, errorURL, "invalid_code");
-					const parsedUserData = userData ? safeJSONParse(userData) : null;
-					const userInfoResult = await provider.getUserInfo({
-						...tokens,
-						/**
-						* The user object from the provider
-						* This is only available for some providers like Apple
-						*/
-						user: parsedUserData ?? void 0
+					const exchanged = await exchangeOAuthCallback(ctx, provider, {
+						code,
+						codeVerifier: stateData.codeVerifier,
+						iss,
+						deviceId,
+						user: userData,
+						idTokenNonce: stateData.idTokenNonce
 					});
-					const userInfo = userInfoResult?.user;
-					if (!userInfo) {
-						ctx.context.logger.error("Unable to get user info from provider");
-						throw redirectOnError(ctx, errorURL, "unable_to_get_user_info");
-					}
+					if (exchanged.error) throw redirectOnError(ctx, errorURL, exchanged.error);
+					const { tokens, userInfo, providerProfile, accountKey } = exchanged;
 					if (!userInfo.email) {
 						ctx.context.logger.error("Provider did not return email");
 						throw redirectOnError(ctx, errorURL, "email_not_found");
 					}
-					let accountKey;
-					try {
-						accountKey = await resolveOAuthAccountKey(provider, tokens, userInfoResult.data);
-					} catch (error) {
-						ctx.context.logger.error("Unable to derive provider account identity", {
-							providerId: provider.id,
-							error
-						});
-						throw redirectOnError(ctx, errorURL, "unable_to_get_user_info");
-					}
-					const providerProfile = toOAuthProfileRecord(userInfoResult.data);
 					const proxyCallbackURL = new URL(stateData.callbackURL);
 					const finalCallbackURL = proxyCallbackURL.searchParams.get("callbackURL") || stateData.callbackURL;
 					const payload = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-auth",
-  "version": "1.7.10",
+  "version": "1.7.12",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "license": "MIT",
@@ -497,19 +497,19 @@
     "@better-fetch/fetch": "1.3.2",
     "@noble/ciphers": "^2.2.0",
     "@noble/hashes": "^2.2.0",
-    "better-call": "1.4.2",
+    "better-call": "1.4.4",
     "defu": "^6.1.4",
     "jose": "^6.2.3",
     "kysely": "^0.28.17 || ^0.29.0",
     "nanostores": "^1.3.0",
     "zod": "^4.5.4",
-    "@better-auth/core": "1.7.10",
-    "@better-auth/drizzle-adapter": "1.7.10",
-    "@better-auth/kysely-adapter": "1.7.10",
-    "@better-auth/memory-adapter": "1.7.10",
-    "@better-auth/mongo-adapter": "1.7.10",
-    "@better-auth/prisma-adapter": "1.7.10",
-    "@better-auth/telemetry": "1.7.10"
+    "@better-auth/core": "1.7.12",
+    "@better-auth/drizzle-adapter": "1.7.12",
+    "@better-auth/kysely-adapter": "1.7.12",
+    "@better-auth/memory-adapter": "1.7.12",
+    "@better-auth/mongo-adapter": "1.7.12",
+    "@better-auth/prisma-adapter": "1.7.12",
+    "@better-auth/telemetry": "1.7.12"
   },
   "devDependencies": {
     "@lynx-js/react": "^0.121.2",