--- collection: auth-identity collection_name: Auth & Identity week_start: 2026-11-02 title: Clerk tightens session control as Better Auth hardens its core release_count: 34 generated: 2026-11-09 canonical: https://releases.sh/collections/auth-identity/digest/2026-11-02 --- # Clerk tightens session control as Better Auth hardens its core Clerk shipped per-session expiry overrides, separate native-app session lifetimes, and minimum-version enforcement across mobile SDKs, while Better Auth closed a run of session-revocation and OAuth holes and began rejecting repeated authorize parameters. ### Session control gets granular Clerk's biggest theme this week was making session lifetimes settings you can actually aim. [Per-session expiry overrides](https://clerk.com/changelog/2026-11-06-custom-session-limits) let you set one session's `expire_at` anywhere from five minutes to ten years through a new Backend API endpoint, with new session token shortcodes exposing a session's age and expiry to custom claims. Alongside it, [native sessions now have their own maximum lifetime](https://clerk.com/changelog/2026-11-04-native-session-lifetimes) separate from web browser sessions — handy for shared devices and long-lived mobile apps, though the setting is a paid-plan feature in production. The same instinct shows up on mobile: [minimum app version enforcement](https://clerk.com/changelog/2026-11-03-minimum-app-version) lets you pin a floor per iOS and Android app from the Dashboard, blocking old builds with an update screen while keeping users signed in. The [iOS SDK's update screen](https://github.com/clerk/clerk-ios/releases/tag/1.7.0) landed the client side, and the [iOS device-token and magic-link fixes](https://github.com/clerk/clerk-ios/releases/tag/1.7.1) keep identity intact when the cached client is unreadable or a resend is rejected. ### Better Auth's security sweep Better Auth spent the week in the weeds of session correctness, and the aggregate is a meaningful hardening pass. [Revoked sessions can no longer linger](https://github.com/better-auth/better-auth/releases/tag/v1.7.16) via secondary storage or the cookie cache, phone numbers are stored only after verification, and OAuth's string `"false"` is no longer read as verified. Follow-ups tightened [revoke-all-sessions races](https://github.com/better-auth/better-auth/releases/tag/v1.7.18), then [remembered sign-ins, phone linking, and TOTP with API key sessions](https://github.com/better-auth/better-auth/releases/tag/v1.7.17). The newest beta goes further on OAuth: [repeated authorize parameters in form POSTs](https://github.com/better-auth/better-auth/releases/tag/v1.8.0-beta.6) now return `invalid_request` instead of silently using the last value. ### Logs, groups, and directory sync Clerk's observability story widened. [Email events are now in Application Logs and GET /v1/logs](https://clerk.com/changelog/2026-11-06-email-events-in-application-logs), filterable by recipient, and [sign-ins and sign-ups collapse into single rows](https://clerk.com/changelog/2026-11-06-log-groups) with event counts and outcomes (pass `view=flat` for the old shape). Directory Sync gained [group webhooks and a pause switch](https://clerk.com/changelog/2026-11-03-directory-sync-updates), and the backend ships [typed narrowing for those group events](https://github.com/clerk/javascript/releases/tag/%40clerk/backend%403.27.0). ### SDK housekeeping worth noticing The JavaScript SDK's [10-second React Native token timeouts and safer sign-out](https://github.com/clerk/javascript/releases/tag/%40clerk/clerk-js%406.42.3) avert hangs, the [Chrome extension SDK stops loading Device Intelligence scripts remotely](https://github.com/clerk/javascript/releases/tag/%40clerk/chrome-extension%403.1.105), and Mosaic added [drag-and-drop avatar and logo uploads](https://github.com/clerk/javascript/releases/tag/%40clerk/mosaic%400.2.2). Two changes ask for migration: [rootAuthLoader no longer takes an options argument](https://github.com/clerk/javascript/releases/tag/%40clerk/react-router%403.7.0) in React Router, and [Apple sign-in now throws when email verification is required](https://github.com/clerk/javascript/releases/tag/%40clerk/expo%404.15.1) instead of failing silently. A broad wave of dependency bumps carried the rest of the week, plus a single [Auth release candidate](https://github.com/supabase/auth/releases/tag/rc2.198.0-rc.38) with no notes to speak of. ## Releases covered ### Better Auth - [better-auth v1.7.16 ends revoked sessions and enforces phone verification](https://github.com/better-auth/better-auth/releases/tag/v1.7.16) - [better-auth v1.7.18 fixes revoke-all-sessions race with secondary storage](https://github.com/better-auth/better-auth/releases/tag/v1.7.18) - [better-auth v1.7.17 fixes session revocation, phone number, and TOTP issues](https://github.com/better-auth/better-auth/releases/tag/v1.7.17) - [better-auth v1.8.0-beta.6 rejects repeated OAuth authorize parameters](https://github.com/better-auth/better-auth/releases/tag/v1.8.0-beta.6) ### Clerk - [Clerk adds per-session expiry overrides and session token shortcodes](https://clerk.com/changelog/2026-11-06-custom-session-limits) - [Clerk adds separate maximum session lifetimes for native apps](https://clerk.com/changelog/2026-11-04-native-session-lifetimes) - [Clerk adds minimum app version enforcement for iOS, Android, and Expo](https://clerk.com/changelog/2026-11-03-minimum-app-version) - [Clerk iOS SDK 1.7.0 adds minimum-version update screen and password-reset reverification](https://github.com/clerk/clerk-ios/releases/tag/1.7.0) - [Clerk iOS SDK 1.7.1 keeps device token and earlier magic link on resend](https://github.com/clerk/clerk-ios/releases/tag/1.7.1) - [Clerk email events now appear in Application Logs and the Backend API](https://clerk.com/changelog/2026-11-06-email-events-in-application-logs) - [Clerk Application Logs group sign-ins and sign-ups into single rows](https://clerk.com/changelog/2026-11-06-log-groups) - [Clerk adds group webhooks and pause to Directory Sync](https://clerk.com/changelog/2026-11-03-directory-sync-updates) - [Clerk JavaScript SDK 3.27.0 narrows directory group webhook events](https://github.com/clerk/javascript/releases/tag/%40clerk/backend%403.27.0) - [Clerk JavaScript SDK 6.42.3 fixes startup hangs and sign-out after sign-up](https://github.com/clerk/javascript/releases/tag/%40clerk/clerk-js%406.42.3) - [Clerk Chrome extension SDK 3.1.105 blocks remote Device Intelligence scripts](https://github.com/clerk/javascript/releases/tag/%40clerk/chrome-extension%403.1.105) - [Clerk Mosaic 0.2.2 adds drag-and-drop uploads to avatar and logo rows](https://github.com/clerk/javascript/releases/tag/%40clerk/mosaic%400.2.2) - [Clerk React Router SDK 3.7.0 removes rootAuthLoader options argument](https://github.com/clerk/javascript/releases/tag/%40clerk/react-router%403.7.0) - [Clerk JavaScript SDK @clerk/expo 4.15.1 throws error on Apple sign-in email verification](https://github.com/clerk/javascript/releases/tag/%40clerk/expo%404.15.1) ### Supabase - [Supabase Auth v2.198.0-rc.38 release candidate](https://github.com/supabase/auth/releases/tag/rc2.198.0-rc.38)