---
scope: org
organization: better-auth
release_count: 10
last_release: 2026-10-15
generated: 2026-05-04
updated: 2026-10-26
canonical: https://releases.sh/better-auth/overview.md
---

Shipped a FedCM account chooser for Google sign-in buttons and breaking profile-mapping changes across five social providers in the v1.8.0 betas.

**Google sign-in buttons can offer a browser account chooser.** On supported Chrome browsers, Google sign-in buttons use FedCM to let users pick an account from the browser's own chooser.

**Profile mappings changed for five social providers (breaking).** Update mappings before moving to the v1.8.0 beta:
- Zoom: handle login types `11`, `21`, and `23` in exhaustive checks.
- VK: `user.phone` arrives as a string, not a number.
- Naver: handle omitted personal fields and supply an email when Naver shares none.
- Kakao: handle a missing `kakao_account`.
- Roblox: handle optional scoped fields, a `null` picture, and `unknown` custom claims.

**Provider token endpoint auth gained options.** The Vercel provider accepts dynamic OIDC tokens and private key JWT client assertions without replacing the built-in sign-in flow. Cloudflare added `tokenEndpointAuth: { method }`; `tokenEndpointAuthMethod` is deprecated but still supported.

**ID token sign-in needs explicit client IDs (breaking).** Providers without a `clientId` now need it set to every client ID your apps sign in with. Separately, the JWT plugin verifies tokens with the stored key's algorithm instead of the token header's, and warns when issuer or audience is missing.

**OAuth and adapter fixes.** OAuth proxy callbacks now run the standard callback checks, including issuer and ID token nonce validation. Type-only exports are no longer listed as values, so a bad value import fails type checking. PostgreSQL `int8` columns stop producing repeated migration diffs.

Earlier: the Magic Link account-takeover advisory still requires upgrading servers that share verification storage together, requesting new Magic Links, and restarting pending OAuth/SAML sign-ins — no database migration. Device-code approval keeps the stricter `assertStandaloneUse` contract from beta.0.