npm / @better-auth/expo

@better-auth/expo

What changed in @better-auth/expo 1, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-20.

2 breaking5 security6 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@better-auth/expo 113 changes

Custom storage implementations must provide both synchronous and asynchronous SecureStore methods.
1.7.0release notes
getCookie() now returns a promise, using asynchronous SecureStore access to prevent synchronous crashes when iOS Keychain storage is unavailable.
1.7.0release notes

Leftover session data is cleared from secure storage after upgrades or sign-out.
1.7.4release notes
Prevents Expo apps from sending unauthenticated requests while large stored cookies are being updated, and restores the previous cookie value if an update is interrupted or incomplete.
1.7.3release notes
@better-auth/scim: account takeover and stale access via SCIM provider-id collision
1.6.22security advisory
@better-auth/stripe: cross-organization billing tampering in organization subscription actions
1.6.21security advisory
OAuth 2.1 Provider: Unprivileged users can register OAuth clients
1.6.5security advisory

Social account linking with an ID token now sends the Expo origin header, allowing native link flows with a session cookie to pass origin validation.
1.7.11release notes
Prevents corrupted cookies during concurrent updates.
1.7.4release notes
Session data containing multibyte characters is stored safely in Expo secure storage.
1.7.4release notes
Expo client plugins now compose with createAuthClient without TypeScript errors, and the resulting client preserves each plugin's inferred actions.
1.7.0release notes
storageAdapter.setItem() is synchronous; use setItemAsync() when the write must be awaited.
1.7.0release notes
Restores client plugin declaration compatibility for downstream TypeScript consumers.
1.6.28release notes