chore(auth): upgrade better-auth 1.3.12 → 1.6.11 by waleedlatif1 · Pull Request #4766 · simstudioai/sim

waleedlatif1 · 2026-05-28T00:14:10Z

Summary

Bump better-auth, @better-auth/sso, @better-auth/stripe from 1.3.12 → 1.6.11
Rename deprecated APIs: onEmailVerification → afterEmailVerification, forgetPassword → requestPasswordReset, organizationCreation.afterCreate → organizationHooks.afterCreateOrganization
Move nextCookies() to end of plugins array (1.6.10 fix — earlier position dropped Set-Cookie headers from later plugins' hooks.after)
Opt out of new requireLocalEmailVerified default to preserve OAuth-linking behavior
Gate requireEmailVerificationOnInvitation on isEmailVerificationEnabled so self-hosted invite flow still works without SMTP
Set freshAge: 0 (1.6 recalculates freshness from createdAt, not last activity)
Drop Stripe getCheckoutSessionParams line_items override (1.6.10 strips it; pre-checkout seat picker already exists)
Drop dead pages config (never a valid option) and unused signIn/signUp re-exports
Migration 0216_* adds 6 nullable columns for new better-auth Stripe + JWKS fields

Type of Change

Improvement (dependency upgrade)

Testing

Auth route tests: 60/60 passing
type-check and check:api-validation clean
Smoke-tested dev server: /api/auth/get-session, /api/auth/jwks, /api/auth/forget-password, OIDC discovery — all 200
Migration is 6 nullable ADD COLUMN only — no destructive ops

Follow-up (separate PR)

oidcProvider → @better-auth/oauth-provider migration — requires data migration of live OAuth client rows + one-way client_secret hashing. Plan documented in .context/better-auth-upgrade/OAUTH-PROVIDER-MIGRATION.md.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-05-28T00:14:16Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		May 28, 2026 4:13pm

cursor · 2026-05-28T00:14:21Z

PR Summary

High Risk
Touches core authentication, sessions, OAuth linking, Stripe checkout, and org invites; incorrect config could break login, cookies, or billing flows despite nullable DB changes.

Overview
Upgrades better-auth (and @better-auth/sso / @better-auth/stripe) from 1.3.12 → 1.6.11 and aligns the app with renamed or stricter library behavior.

API renames: forgetPassword → requestPasswordReset on the forget-password route and tests; onEmailVerification → afterEmailVerification; organization organizationCreation.afterCreate → organizationHooks.afterCreateOrganization. createAuthMiddleware is imported from better-auth/api instead of better-auth/plugins.

Auth behavior tweaks: session.freshAge set to 0; requireLocalEmailVerified: false on account linking; requireEmailVerificationOnInvitation tied to isEmailVerificationEnabled; oneTimeToken.expiresIn corrected to minutes (24 * 60). Removed invalid pages config, unused signIn/signUp exports, throwOnMissingCredentials / throwOnInvalidCredentials, and Stripe checkout line_items override (promo codes only). nextCookies() moved to the end of the plugins array so later plugins’ cookies are not dropped.

Email: OTP templates/subjects add change-email for better-auth’s expanded OTP types.

Data: Migration 0216_* adds nullable Stripe subscription and JWKS columns expected by 1.6.

^{Reviewed by Cursor Bugbot for commit 5a8b8ab. Configure here.}

greptile-apps · 2026-05-28T00:20:05Z

Greptile Summary

Upgrades better-auth, @better-auth/sso, and @better-auth/stripe from 1.3.12 to 1.6.11, applying all required API renames and behavioral opt-outs documented in the 1.6 migration guide.

API renames: onEmailVerification → afterEmailVerification, forgetPassword → requestPasswordReset, organizationCreation.afterCreate → organizationHooks.afterCreateOrganization; nextCookies() moved to last position in the plugins array to fix the 1.6.10 Set-Cookie regression; createAuthMiddleware import path updated from the plugins barrel to better-auth/api.
Behavioral adjustments: requireLocalEmailVerified: false opts out of the new account-linking default; requireEmailVerificationOnInvitation gated on isEmailVerificationEnabled to preserve self-hosted invite flow; freshAge: 0 adopted per the 1.6 createdAt-based session freshness semantics; getCheckoutSessionParams line_items override dropped since 1.6.10 strips it and a pre-checkout seat picker already handles quantity.
OTP change-email type: EmailSubjectType, OTPVerificationEmailProps.type, and renderOTPEmail's parameter union all extended to cover the new OTP type added in 1.6, replacing the previous silent fallthrough; migration 0216 adds 6 nullable columns for new Stripe subscription and JWKS expiry fields.

Confidence Score: 5/5

Safe to merge — all changes are additive API renames, behavioral opt-outs explicitly documented in the 1.6 migration guide, and a nullable-only DB migration.

Every deprecated API is correctly renamed, the plugin ordering fix resolves a real cookie-propagation bug from 1.6.10, all email type unions are fully closed with change-email, and the migration is purely additive. The PR author reports 60/60 auth route tests passing and a clean type-check run, consistent with the diff.

No files require special attention.

Important Files Changed

Filename	Overview
apps/sim/lib/auth/auth.ts	Core auth config updated with 1.6.11 API renames (afterEmailVerification, requestPasswordReset, organizationHooks), nextCookies() moved to last position, requireLocalEmailVerified: false added, freshAge: 0 set, and getCheckoutSessionParams simplified to drop the already-stripped line_items override.
apps/sim/app/api/auth/forget-password/route.ts	Single-line rename from auth.api.forgetPassword to auth.api.requestPasswordReset, matching the better-auth 1.6 API.
apps/sim/app/api/auth/forget-password/route.test.ts	All test mock references updated from mockForgetPassword to mockRequestPasswordReset; 60/60 tests passing.
apps/sim/components/emails/subjects.ts	Added 'change-email' to EmailSubjectType union and corresponding subject line, covering the new OTP type added in better-auth 1.6.
apps/sim/components/emails/render.ts	renderOTPEmail type parameter broadened to include 'change-email', making TypeScript catch any future unhandled OTP types at the call site.
packages/db/migrations/0216_colorful_cobalt_man.sql	Additive migration adding 6 nullable columns to subscription and jwks — no destructive operations.
packages/db/schema.ts	Schema updated to match the migration: 5 new nullable fields on subscription and expires_at on jwks, aligned with better-auth Stripe and JWKS plugin changes in 1.6.
apps/sim/components/emails/auth/otp-verification-email.tsx	OTPVerificationEmailProps.type union extended with 'change-email' and a dedicated subject line added to getSubjectByType.

_{Reviews (2): Last reviewed commit: "chore(auth): address Greptile review — b..." | Re-trigger Greptile}

…gration newline

waleedlatif1 · 2026-05-28T01:28:11Z

@greptile

waleedlatif1 · 2026-05-28T01:28:14Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 6d360b4. Configure here.}

Better-auth's oneTimeToken expiresIn is in minutes (multiplied by 60_000ms internally). Sim's existing 24*60*60 evaluated to ~60 days of token lifetime instead of the intended 24 hours. Tokens are one-time-use and typically consumed within seconds of generation (Socket.IO handshake), so this tightens an unused security window without affecting UX.

waleedlatif1 · 2026-05-28T16:33:10Z

@greptile

waleedlatif1 · 2026-05-28T16:33:13Z

@cursor review

chore(auth): upgrade better-auth 1.3.12 → 1.6.11

455355d

vercel Bot deployed to Preview May 28, 2026 00:17 View deployment

greptile-apps Bot reviewed May 28, 2026

View reviewed changes

Comment thread apps/sim/lib/auth/auth.ts

Comment thread apps/sim/lib/auth/auth.ts

Comment thread packages/db/migrations/0216_colorful_cobalt_man.sql Outdated

chore(auth): address Greptile review — broaden change-email type + mi…

6d360b4

…gration newline

vercel Bot deployed to Preview May 28, 2026 01:27 View deployment

cursor Bot reviewed May 28, 2026

View reviewed changes

vercel Bot temporarily deployed to Preview May 28, 2026 16:13 Inactive

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(auth): upgrade better-auth 1.3.12 → 1.6.11#4766

chore(auth): upgrade better-auth 1.3.12 → 1.6.11#4766
waleedlatif1 wants to merge 3 commits into
stagingfrom
waleedlatif1/better-auth-upgrade-audit

waleedlatif1 commented May 28, 2026

Uh oh!

vercel Bot commented May 28, 2026 •

edited

Loading

Uh oh!

cursor Bot commented May 28, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented May 28, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented May 28, 2026

Uh oh!

waleedlatif1 commented May 28, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

waleedlatif1 commented May 28, 2026

Uh oh!

waleedlatif1 commented May 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

waleedlatif1 commented May 28, 2026

Summary

Type of Change

Testing

Follow-up (separate PR)

Checklist

Uh oh!

vercel Bot commented May 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented May 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

greptile-apps Bot commented May 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented May 28, 2026

Uh oh!

waleedlatif1 commented May 28, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented May 28, 2026

Uh oh!

waleedlatif1 commented May 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented May 28, 2026 •

edited

Loading

cursor Bot commented May 28, 2026 •

edited

Loading

greptile-apps Bot commented May 28, 2026 •

edited

Loading