# What changed in @better-auth/expo

> 13 changes in @better-auth/expo 1 from its official release notes, upgrade guides and advisories: 2 breaking, 5 security. Each one cited. Sources checked 2026-10-20. HTML: https://unstale.sh/npm/@better-auth/expo/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @better-auth/expo 1

### Breaking changes

- Custom storage implementations must provide both synchronous and asynchronous SecureStore methods. (1.7.0) — [release notes](https://github.com/better-auth/better-auth/blob/52ab801cc6550104199bcf70a3f83005e15eb804/packages/expo/CHANGELOG.md#170)
- getCookie() now returns a promise, using asynchronous SecureStore access to prevent synchronous crashes when iOS Keychain storage is unavailable. (1.7.0) — [release notes](https://github.com/better-auth/better-auth/blob/52ab801cc6550104199bcf70a3f83005e15eb804/packages/expo/CHANGELOG.md#170)

### Security

- Leftover session data is cleared from secure storage after upgrades or sign-out. (1.7.4) — [release notes](https://github.com/better-auth/better-auth/blob/52ab801cc6550104199bcf70a3f83005e15eb804/packages/expo/CHANGELOG.md#174)
- Prevents Expo apps from sending unauthenticated requests while large stored cookies are being updated, and restores the previous cookie value if an update is interrupted or incomplete. (1.7.3) — [release notes](https://github.com/better-auth/better-auth/blob/52ab801cc6550104199bcf70a3f83005e15eb804/packages/expo/CHANGELOG.md#173)
- @better-auth/scim: account takeover and stale access via SCIM provider-id collision (1.6.22) — [security advisory](https://github.com/advisories/GHSA-RJG6-39JM-RGG4)
- @better-auth/stripe: cross-organization billing tampering in organization subscription actions (1.6.21) — [security advisory](https://github.com/advisories/GHSA-H3RM-78G3-J7CP)
- OAuth 2.1 Provider: Unprivileged users can register OAuth clients (1.6.5) — [security advisory](https://github.com/advisories/GHSA-XR8F-H2GW-9XH6)

### Fixes and other changes

- Social account linking with an ID token now sends the Expo origin header, allowing native link flows with a session cookie to pass origin validation. (1.7.11) — [release notes](https://github.com/better-auth/better-auth/blob/52ab801cc6550104199bcf70a3f83005e15eb804/packages/expo/CHANGELOG.md#1711)
- Prevents corrupted cookies during concurrent updates. (1.7.4) — [release notes](https://github.com/better-auth/better-auth/blob/52ab801cc6550104199bcf70a3f83005e15eb804/packages/expo/CHANGELOG.md#174)
- Session data containing multibyte characters is stored safely in Expo secure storage. (1.7.4) — [release notes](https://github.com/better-auth/better-auth/blob/52ab801cc6550104199bcf70a3f83005e15eb804/packages/expo/CHANGELOG.md#174)
- Expo client plugins now compose with createAuthClient without TypeScript errors, and the resulting client preserves each plugin's inferred actions. (1.7.0) — [release notes](https://github.com/better-auth/better-auth/blob/52ab801cc6550104199bcf70a3f83005e15eb804/packages/expo/CHANGELOG.md#170)
- storageAdapter.setItem() is synchronous; use setItemAsync() when the write must be awaited. (1.7.0) — [release notes](https://github.com/better-auth/better-auth/blob/52ab801cc6550104199bcf70a3f83005e15eb804/packages/expo/CHANGELOG.md#170)
- Restores client plugin declaration compatibility for downstream TypeScript consumers. (1.6.28) — [release notes](https://github.com/better-auth/better-auth/blob/52ab801cc6550104199bcf70a3f83005e15eb804/packages/expo/CHANGELOG.md#1628)