chore(auth): upgrade better-auth 1.3.12 → 1.6.11 by waleedlatif1 · Pull Request #4766 · simstudioai/sim

waleedlatif1 · 2026-05-28T00:14:10Z

Summary

Bump better-auth, @better-auth/sso, @better-auth/stripe from 1.3.12 → 1.6.11
Rename deprecated APIs: onEmailVerification → afterEmailVerification, forgetPassword → requestPasswordReset, organizationCreation.afterCreate → organizationHooks.afterCreateOrganization
Move nextCookies() to end of plugins array (1.6.10 fix — earlier position dropped Set-Cookie headers from later plugins' hooks.after)
Opt out of new requireLocalEmailVerified default to preserve OAuth-linking behavior
Gate requireEmailVerificationOnInvitation on isEmailVerificationEnabled so self-hosted invite flow still works without SMTP
Set freshAge: 0 (1.6 recalculates freshness from createdAt, not last activity)
Drop Stripe getCheckoutSessionParams line_items override (1.6.10 strips it; pre-checkout seat picker already exists)
Drop dead pages config (never a valid option) and unused signIn/signUp re-exports
Migration 0216_* adds 6 nullable columns for new better-auth Stripe + JWKS fields

Type of Change

Improvement (dependency upgrade)

Testing

Auth route tests: 60/60 passing
type-check and check:api-validation clean
Smoke-tested dev server: /api/auth/get-session, /api/auth/jwks, /api/auth/forget-password, OIDC discovery — all 200
Migration is 6 nullable ADD COLUMN only — no destructive ops

Follow-up (separate PR)

oidcProvider → @better-auth/oauth-provider migration — requires data migration of live OAuth client rows + one-way client_secret hashing. Plan documented in .context/better-auth-upgrade/OAUTH-PROVIDER-MIGRATION.md.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-05-28T00:14:16Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	May 28, 2026 1:27am

cursor · 2026-05-28T00:14:21Z

PR Summary

High Risk
Touches core authentication (sessions, email verification, password reset, OAuth account linking, org invites, Stripe checkout hooks) across a major library upgrade; regression risk is mitigated by tests and explicit opt-outs for new defaults.

Overview
Upgrades better-auth (and @better-auth/sso / @better-auth/stripe) from 1.3.12 → 1.6.11 and aligns the app with renamed APIs and new defaults.

Auth integration: forgetPassword → requestPasswordReset on the forget-password route and tests; onEmailVerification → afterEmailVerification; organization organizationCreation.afterCreate → organizationHooks.afterCreateOrganization. createAuthMiddleware is imported from better-auth/api instead of plugins. nextCookies() is moved to the end of the plugins list so later plugins’ Set-Cookie headers are not dropped. Removed invalid pages config and unused signIn / signUp re-exports from auth.ts.

Behavior-preserving config: session.freshAge set to 0 (1.6 freshness semantics); accountLinking.requireLocalEmailVerified: false; requireEmailVerificationOnInvitation tied to isEmailVerificationEnabled; dropped custom Stripe getCheckoutSessionParams line_items (rely on default + existing seat UI); removed throwOnMissingCredentials / throwOnInvalidCredentials.

Email: OTP/subject types extended with change-email for 1.6 flows.

Database: Migration 0216_* adds nullable Stripe subscription and JWKS columns expected by 1.6.

Lockfile: bun.lock updated for the new better-auth package graph (core, adapters, telemetry, etc.).

^{Reviewed by Cursor Bugbot for commit 6d360b4. Configure here.}

greptile-apps · 2026-05-28T00:20:05Z

Greptile Summary

Upgrades better-auth, @better-auth/sso, and @better-auth/stripe from 1.3.12 to 1.6.11, applying all required API renames and behavioral opt-outs documented in the 1.6 migration guide.

API renames: onEmailVerification → afterEmailVerification, forgetPassword → requestPasswordReset, organizationCreation.afterCreate → organizationHooks.afterCreateOrganization; nextCookies() moved to last position in the plugins array to fix the 1.6.10 Set-Cookie regression; createAuthMiddleware import path updated from the plugins barrel to better-auth/api.
Behavioral adjustments: requireLocalEmailVerified: false opts out of the new account-linking default; requireEmailVerificationOnInvitation gated on isEmailVerificationEnabled to preserve self-hosted invite flow; freshAge: 0 adopted per the 1.6 createdAt-based session freshness semantics; getCheckoutSessionParams line_items override dropped since 1.6.10 strips it and a pre-checkout seat picker already handles quantity.
OTP change-email type: EmailSubjectType, OTPVerificationEmailProps.type, and renderOTPEmail's parameter union all extended to cover the new OTP type added in 1.6, replacing the previous silent fallthrough; migration 0216 adds 6 nullable columns for new Stripe subscription and JWKS expiry fields.

Confidence Score: 5/5

Safe to merge — all changes are additive API renames, behavioral opt-outs explicitly documented in the 1.6 migration guide, and a nullable-only DB migration.

Every deprecated API is correctly renamed, the plugin ordering fix resolves a real cookie-propagation bug from 1.6.10, all email type unions are fully closed with change-email, and the migration is purely additive. The PR author reports 60/60 auth route tests passing and a clean type-check run, consistent with the diff.

No files require special attention.

Important Files Changed

Filename	Overview
apps/sim/lib/auth/auth.ts	Core auth config updated with 1.6.11 API renames (afterEmailVerification, requestPasswordReset, organizationHooks), nextCookies() moved to last position, requireLocalEmailVerified: false added, freshAge: 0 set, and getCheckoutSessionParams simplified to drop the already-stripped line_items override.
apps/sim/app/api/auth/forget-password/route.ts	Single-line rename from auth.api.forgetPassword to auth.api.requestPasswordReset, matching the better-auth 1.6 API.
apps/sim/app/api/auth/forget-password/route.test.ts	All test mock references updated from mockForgetPassword to mockRequestPasswordReset; 60/60 tests passing.
apps/sim/components/emails/subjects.ts	Added 'change-email' to EmailSubjectType union and corresponding subject line, covering the new OTP type added in better-auth 1.6.
apps/sim/components/emails/render.ts	renderOTPEmail type parameter broadened to include 'change-email', making TypeScript catch any future unhandled OTP types at the call site.
packages/db/migrations/0216_colorful_cobalt_man.sql	Additive migration adding 6 nullable columns to subscription and jwks — no destructive operations.
packages/db/schema.ts	Schema updated to match the migration: 5 new nullable fields on subscription and expires_at on jwks, aligned with better-auth Stripe and JWKS plugin changes in 1.6.
apps/sim/components/emails/auth/otp-verification-email.tsx	OTPVerificationEmailProps.type union extended with 'change-email' and a dedicated subject line added to getSubjectByType.

_{Reviews (2): Last reviewed commit: "chore(auth): address Greptile review — b..." | Re-trigger Greptile}

…gration newline

waleedlatif1 · 2026-05-28T01:28:11Z

@greptile

waleedlatif1 · 2026-05-28T01:28:14Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 6d360b4. Configure here.}

chore(auth): upgrade better-auth 1.3.12 → 1.6.11

455355d

vercel Bot deployed to Preview May 28, 2026 00:17 View deployment

greptile-apps Bot reviewed May 28, 2026

View reviewed changes

Comment thread apps/sim/lib/auth/auth.ts

Comment thread apps/sim/lib/auth/auth.ts

Comment thread packages/db/migrations/0216_colorful_cobalt_man.sql Outdated

chore(auth): address Greptile review — broaden change-email type + mi…

6d360b4

…gration newline

vercel Bot deployed to Preview May 28, 2026 01:27 View deployment

cursor Bot reviewed May 28, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(auth): upgrade better-auth 1.3.12 → 1.6.11#4766

chore(auth): upgrade better-auth 1.3.12 → 1.6.11#4766
waleedlatif1 wants to merge 2 commits into
stagingfrom
waleedlatif1/better-auth-upgrade-audit

waleedlatif1 commented May 28, 2026

Uh oh!

vercel Bot commented May 28, 2026 •

edited

Loading

Uh oh!

cursor Bot commented May 28, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented May 28, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented May 28, 2026

Uh oh!

waleedlatif1 commented May 28, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

waleedlatif1 commented May 28, 2026

Summary

Type of Change

Testing

Follow-up (separate PR)

Checklist

Uh oh!

vercel Bot commented May 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented May 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

greptile-apps Bot commented May 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented May 28, 2026

Uh oh!

waleedlatif1 commented May 28, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented May 28, 2026 •

edited

Loading

cursor Bot commented May 28, 2026 •

edited

Loading

greptile-apps Bot commented May 28, 2026 •

edited

Loading