fix(deps): update dependency better-auth to ~1.3.18 - autoclosed

[renovate]

Coming soon: The Renovate bot (GitHub App) will be renamed to Mend. PRs from Renovate will soon appear from 'Mend'. Learn more here.

This PR contains the following updates:

Package	Change	Age	Confidence
better-auth (source)	~1.3.9 -> ~1.3.18

---

Release Notes

better-auth/better-auth (better-auth)

v1.3.18

Compare Source

   🐞 Bug Fixes

• Ttl sessions list expiration  -  by @​dvanmali in #​3836 (71129)
• Tests failing due to clock drift  -  by @​dvanmali in #​4915 (8351c)
• Moved email verification check after password check  -  by @​QuintenStr in #​4835 (0088c)
• cli: DefaultNow is deprecated in schema for Drizzle with SQLite  -  by @​himself65 in #​4889 (e979f)
• custom-session: Don't overwrite the Set-Cookie header  -  by @​frectonz in #​4388 (15b00)
• email-otp: Call reset password callback  -  by @​HoshangDEV in #​4818 (45101)

    View changes on GitHub

v1.3.17

Compare Source

   🚀 Features

• sso: Provide default service provider metadata  -  by @​dvanmali in #​4866 (4a9d1)

   🐞 Bug Fixes

• nuxt: Avoid load env base url for SSR  -  by @​himself65 in #​4887 (15cc7)

    View changes on GitHub

v1.3.16

Compare Source

No significant changes

    View changes on GitHub

v1.3.15

Compare Source

   🐞 Bug Fixes

• types: Include null in getSession return type  -  by @​jcajuab in #​4812 (d447c)

    View changes on GitHub

v1.3.14

Compare Source

   🚀 Features

• passkey: Allow multiple passkey origins  -  by @​kevcube in #​4800 (d9601)
• sso: DefaultSSO options and ACS endpoint  -  by @​Kinfe123 and Bereket Engida in #​3660 (348f3)

   🐞 Bug Fixes

• Wrap Math.floor around the division when calculating TTL  -  by @​DevDuki, Dusan Misic, ping-maxwell and @​himself65 in #​4768 (08da9)
• api-key:
  • Calling client on server side  -  by @​himself65 in #​4777 (d384e)
• mcp:
  • Missing Content-Type header for mcp DCR  -  by @​Berndwl in #​4763 (a6b2e)
• organization:
  • Pass ctx to DB hooks  -  by @​ping-maxwell in #​4769 (39c21)
  • Allow passing id through beforeCreateOrganization  -  by @​ping-maxwell in #​4765 (25a43)
• username:
  • Username should respect send on sign config  -  by @​QuintenStr in #​4799 (ac49e)

    View changes on GitHub

v1.3.13

Compare Source

   🚀 Features

• Add returnHeaders to getSession  -  by @​frectonz in #​3983 (8a4b3)
• last-login-method: Update OAuth login method tracking for multiple auth type  -  by @​Kinfe123 in #​4693 (c03fd)

   🐞 Bug Fixes

• client: BaseURL is undefined for SSR  -  by @​himself65 in #​4760 (c1514)
• organization: Remove autoCreateOnSignUp option as it's not implemented yet  -  by @​Bekacru in #​4755 (21bd4)
• passkey: Remove email from query  -  by @​himself65 in #​4740 (8709a)

    View changes on GitHub

v1.3.12

Compare Source

   🚀 Features

• discord: Allow specification of permissions  -  by @​TheUntraceable and @​Bekacru in #​4717 (c6e33)
• email-otp: Allow returning undefined in generateOTP  -  by @​ping-maxwell in #​4723 (11dbf)

   🐞 Bug Fixes

• Device authorization plugin  -  by @​bytaesu in #​4695 (578a6)
• Reduce any type in generator.ts  -  by @​himself65 in #​4710 (fd29b)
• Refresh secondary storage sessions on user update  -  by @​frectonz in #​4522 (c3354)
• Allow disable database transaction  -  by @​himself65 in #​4733 (7efd1)
• adapter:
  • Returning null as string for optional id references  -  by @​jslno in #​4713 (c6e5d)
• api-key:
  • Cascade api keys on user deletion  -  by @​ping-maxwell in #​4703 (62b50)
• create-adapter:
  • Disable transaction by default  -  by @​ping-maxwell in #​4750 (4a434)
• organization:
  • Decouple client and server permission checks  -  by @​Bekacru in #​4707 (adfc4)
  • Membership check for organizations with large member counts  -  by @​Badbird5907 and @​himself65 in #​4724 (97b02)
• stripe:
  • OnCustomerCreate should be called even if update user isn't returned  -  by @​Bekacru in #​4716 (d3509)

    View changes on GitHub

v1.3.11

Compare Source

   🚀 Features

• Flip emailVerified when link the account  -  by @​himself65 in #​4621 (cf2ca)

   🐞 Bug Fixes

• Check if user exists before banning the user  -  by @​anmol-fzr, KinfeMichael Tariku and @​himself65 in #​4649 (283c2)
• Timestamp issues in kysely  -  by @​frectonz and @​himself65 in #​4542 (e5874)
• Respect errorCallbackURL in failed oauth flows  -  by @​frectonz in #​4650 (43545)
• plugins: Asynchronous init  -  by @​LightTab2 and @​himself65 in #​4680 (9d216)

    View changes on GitHub

v1.3.10

Compare Source

   Maintenance update: We fixed lots of issues from the community. Thanks to everyone for contributing to better-auth.

   🚀 Features

• Add getActiveRoleMember  -  by @​fathisiddiqi, @​Kinfe123 and @​himself65 in #​4484 (f6f19)
• Database transaction support  -  by @​himself65 and Joel Solano in #​4414 (22c39)
• logger: Option to disable colors  -  by @​martiinii and @​himself65 in #​4402 (53076)
• passkey: Error codes in passkey client  -  by @​frectonz, @​Kinfe123 and @​Bekacru in #​3966 (4b2f5)
• sqlite: Remove autoincrement for SQLite  -  by @​pspeter3 in #​4466 (f2c9d)

   🐞 Bug Fixes

• Ignore cookiecache on auth sensitive functions  -  by @​Kinfe123 in #​4530 (e2a95)
• Custom field for refreshTokenExpiresAt  -  by @​himself65 in #​4569 (cc007)
• Return local IP in development mode  -  by @​DiiiaZoTe and @​himself65 in #​2511 (b4ad6)
• Make cookie cache respect dontRememberMe mode  -  by @​frectonz in #​4558 (acb28)
• Normalize zod imports  -  by @​gabrielmar in #​4593 (adbfc)
• Check endpoint conflicts respect method  -  by @​himself65 in #​4595 (60930)
• Respect username validator  -  by @​azaek and @​himself65 in #​3669 (b8bed)
• Set clientId in ProviderOptions to unknown by default  -  by @​himself65 in #​4596 (78250)
• Pick the first clientId for oauth provider  -  by @​himself65 in #​4598 (8df46)
• Remove use of global.crypto  -  by @​himself65 in #​4606 (ef450)
• Should infer types correctly when empty list of plugins is provided  -  by @​frectonz in #​4612 (08fa1)
• Correct MongoDB adapter import path in CLI  -  by @​aajeeth-m in #​4602 (58963)
• Make sure fetch function doesn't get called repeatedly on onMount  -  by @​frectonz in #​4669 (9d6e4)
• Prevent lastLoginMethod plugin from setting cookie on failed auth  -  by @​Kinfe123 in #​4673 (e297c)
• admin:
  • Change the order of role and user id check when both are provider on userHasPermission  -  by @​Bekacru in #​4653 (29c57)
• anonymous:
  • Prevent false positive error on first anonymous sign-in  -  by @​ajanraj and @​himself65 in #​3662 (96804)
• cli:
  • info shows the correct version  -  by @​himself65 in #​4547 (7faae)
  • Add missing JSON type to schema generation  -  by @​TheGB0077 and @​Kinfe123 in #​4494 (20e87)
• demo:
  • Update forgot password link to /forget-password  -  by @​GivenBY in #​4567 (94450)
• docs:
  • Remove duplicated RFC compliance mention  -  by @​TheUntraceable in #​4581 (5f80c)
• expo:
  • window.crypto is undefined  -  by @​himself65 in #​4620 (7dbc5)
  • Missing peer deps  -  by @​himself65 in #​4617 (16160)
• lastLoginMethod:
  • Inherit cross-subdomain cookie settings in lastLoginMethod plugin  -  by @​lumpinif in #​4572 (78424)
• memory-adapter:
  • Should respect where connector  -  by @​jslno in #​4549 (784db)
• multi-session:
  • Multi-session cookie name preface preventing multiple accounts signed in  -  by @​PacifismPostMortem in #​4505 (8eb64)
• one-time-token:
  • Typo and clean  -  by @​gabrielmar in #​4579 (01365)
• organization:
  • checkRolePermission shouldn't be a promise  -  by @​ping-maxwell in #​4533 (abfc4)
  • Member and team hooks should apply on create organization  -  by @​Bekacru in #​4600 (7fc23)
  • Before org create hooks not applying customized data  -  by @​Bekacru in #​4623 (da9b8)
  • [security] updateOrgRole should check for userId properly  -  by @​Bekacru (12a9d)
  • Restrict role check by user id  -  by @​himself65 in #​4641 (f5fd8)
• prisma:
  • Handle optional field relation types correctly  -  by @​LiYulin-s in #​4630 (80b73)
• stripe:
  • Properly resolve plans by lookup keys  -  by @​AlexProgrammerDE in #​4499 (b531d)
  • Subscription is created without completing payment  -  by @​himself65 in #​4548 (e663f)
  • Prevent multiple free trials for same user  -  by @​RikhiSingh in #​4562 (1bb12)
  • Use correct request method for billing-portal  -  by @​danielepintore in #​4613 (9f23e)
• tiktok:
  • Remove client_secrect from authorizationUrl  -  by @​arslan2012 in #​4511 (71aeb)
• username:
  • Add missing normalization  -  by @​bortoz and @​himself65 in #​3636 (9d316)
  • Sign in should work with post normalization  -  by @​Bekacru and @​himself65 in #​4599 (b2dfb)
• vue:
  • Correct baseURL  -  by @​himself65 in #​4578 (90ea9)

    View changes on GitHub

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.