JWT deadlocks fixed; session cleanup hardened; email OTP no longer leaks registration

better-auth

Bug Fixes

• Fixed session cleanup on user deletion to also remove sessions from secondary storage (#10520)
• Fixed findSessions to skip invalid secondary-storage session entries without discarding other valid sessions (#10580)
• Fixed email OTP sign-up to pass the verification type to custom OTP generators (#10608)
• Fixed email OTP password reset to allow retrying after entering an invalid password (#10552)
• Fixed email OTP verification to no longer reveal whether an email is registered before the OTP is verified (#10605)
• Fixed jwtClient() collapsing createAuthClient type inference when combined with other client plugins (#10513)
• Fixed JWT key minting inside database transactions to use the transaction-scoped adapter, preventing deadlocks on SQLite and ensuring keys commit with their surrounding transaction on Postgres and MySQL (#10623)
• Fixed oAuthProxy to preserve Apple user data from form_post callbacks (#10599)
• Fixed oneTapClient() collapsing createAuthClient type inference when combined with other client plugins (#10635)
• Fixed database rate-limit cleanup to complete when no background task handler is configured (#10619)
• Improved nextCookies performance in instrumented Next.js applications by reusing the next/headers import promise (#10467)

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added a utility for creating stable, namespaced placeholder emails on the reserved placeholder.invalid domain (#10576)

For detailed changes, see CHANGELOG

@better-auth/redis-storage

Bug Fixes

• Fixed listKeys() and clear() to use SCAN instead of KEYS so large keyspaces no longer block the Redis server (#10507)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@bytaesu, @Emmaccen, @gustavovalverde, @jashkarangiya, @jeroenvandermerwe, @jlucaso1, @krish-vachhani, @mrosberghaus, @XXMOHAMED012

Full changelog: v1.6.25...v1.6.26