unstale

npm / @better-auth/core

@better-auth/core

What changed in @better-auth/core 1, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-20.

3 breaking4 security2 performance1 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.2.1 on npm

@better-auth/core 110 changes

Breaking changes 3

  • Custom Paybin issuers must expose RS256 signing keys at the issuer's JWKS endpoint.

    1.7.11release notes

  • A key-set fetch taking longer than 5 seconds now fails with a JWKSTimeout error instead of waiting indefinitely.

    1.7.10release notes

  • Unreachable key sets now throw errors instead of making tokens appear invalid; with remoteVerify configured, failures no longer fall back to remote introspection.

    1.7.10release notes

Security 4

  • Twitch and Paybin sign-in verify ID token signatures and identity claims before mapping profiles, with 30 seconds of clock tolerance.

    1.7.11release notes

  • @better-auth/scim: account takeover and stale access via SCIM provider-id collision

    1.6.22security advisory

  • @better-auth/stripe: cross-organization billing tampering in organization subscription actions

    1.6.21security advisory

  • OAuth 2.1 Provider: Unprivileged users can register OAuth clients

    1.6.5security advisory

Performance 2

  • The semantic conventions production dependency was removed, reducing installation size while preserving instrumentation attribute keys.

    1.7.11release notes

  • An unknown kid triggers at most one key-set refetch every 30 seconds per server process, and concurrent verifications share that fetch, limiting requests caused by made-up key IDs.

    1.7.10release notes

Fixes and other changes 1

  • Plugins whose init returns options: undefined now typecheck when exactOptionalPropertyTypes is enabled.

    1.7.11release notes