npx @buildinternet/releases get better-authFixed Apple OAuth not sending the PKCE code challenge, causing token exchange failures, and fixed Google One Tap creating new users when sign-up was disabled. Also fixed Solid client $fetch/$store exposure and an internal adapter table routing bug.
Yandex is now a supported OAuth social provider. The auth migrate command no longer aborts when adding required or unique columns to an existing table, and string default values are properly escaped in generated Drizzle schemas. Fixed affected row counting for D1 and postgres-js adapters in the drizzle adapter.
Fixed organization subscription actions (cancel, upgrade, restore, billing portal) that could act on the wrong organization. Also added Yandex as a social OAuth provider, fixed affected row counting for D1 and postgres-js drizzle adapters, and fixed string default values not being properly escaped in generated Drizzle schemas.
Fixed the listSessions endpoint to properly enforce fresh-age session checks, and OAuth hooks to run correctly when authorization resumes after sign-in, account selection, or consent. Also fixed admin endpoints to return USER_NOT_FOUND instead of a generic 500 error, Kysely migration compatibility, passkey authenticator name resolution, and SAML validation clock skew handling.