|
| 1 | +--- |
| 2 | +"@objectstack/plugin-auth": major |
| 3 | +"@objectstack/platform-objects": major |
| 4 | +"@objectstack/client": major |
| 5 | +"@objectstack/cli": patch |
| 6 | +"@objectstack/create-objectstack": patch |
| 7 | +"@objectstack/plugin-hono-server": patch |
| 8 | +"@objectstack/plugin-pinyin-search": patch |
| 9 | +"@objectstack/hono": patch |
| 10 | +--- |
| 11 | + |
| 12 | +chore(deps)!: better-auth 1.7.0-rc.2 (account identity restructuring) + the |
| 13 | +production-dependency batch from #3517 |
| 14 | + |
| 15 | +**better-auth 1.7.0-rc.1 → 1.7.0-rc.2** across the family (`better-auth`, |
| 16 | +`@better-auth/core`, `@better-auth/oauth-provider`, `@better-auth/sso`, and the |
| 17 | +adapter/telemetry overrides). `@better-auth/scim` deliberately stays on |
| 18 | +1.7.0-rc.1 — rc.2 replaces its whole model (code-defined connections; the |
| 19 | +`scimProvider` model and the generate-token endpoint are gone), which is a |
| 20 | +feature migration, not a version bump. Its peer range accepts rc.2 core, and the |
| 21 | +advisory that forced the original pin (GHSA-j8v8-g9cx-5qf4) is still fixed. |
| 22 | + |
| 23 | +**BREAKING — account identity.** better-auth renamed `account.accountId` to |
| 24 | +`account.providerAccountId` and added a REQUIRED `account.issuer`; sign-in now |
| 25 | +resolves accounts by `(issuer, providerAccountId)`. |
| 26 | + |
| 27 | +- FROM `fields: { accountId: 'account_id' }` → TO |
| 28 | + `fields: { issuer: 'issuer', providerAccountId: 'account_id' }`. The provider |
| 29 | + account id keeps its `account_id` column — only the better-auth-side name |
| 30 | + moved — and `sys_account` gains an `issuer` column. |
| 31 | +- FROM `internalAdapter.createAccount({ providerId, accountId, … })` → TO |
| 32 | + `createAccount({ providerId, issuer, providerAccountId, … })`. A local |
| 33 | + password account carries the issuer better-auth mints for itself, |
| 34 | + `local:credential`. |
| 35 | +- FROM `client.auth.accounts.unlink({ providerId, accountId })` → TO |
| 36 | + `unlink({ accountId })`, where `accountId` is now the account ROW id (the `id` |
| 37 | + from `accounts.list()`), matching better-auth's narrowed body. |
| 38 | + `accounts.list()` returns `issuer` + `providerAccountId` in place of |
| 39 | + `accountId`. |
| 40 | + |
| 41 | +**Existing deployments:** rows written before 1.7 have no issuer and are |
| 42 | +invisible to sign-in until stamped. The auth plugin now runs an idempotent |
| 43 | +boot-time backfill that stamps what it can derive — `local:credential` for |
| 44 | +password accounts, `local:oauth:<providerId>` for configured social providers, |
| 45 | +and the registered IdP's real `iss` from `sys_sso_provider` for federated ones. |
| 46 | +Accounts from a federated IdP that is no longer registered cannot be derived; |
| 47 | +they are logged with their provider id and row count rather than guessed, and |
| 48 | +those users cannot sign in through that provider until the row is stamped with |
| 49 | +the IdP's issuer or removed so a fresh login re-links it. |
| 50 | + |
| 51 | +**Also required by 1.7:** `SecondaryStorage` gained two mandatory methods, both |
| 52 | +now implemented over the kernel cache service — `getAndDelete` (single-use |
| 53 | +verification values) and `increment` (fixed-window rate-limit counter; |
| 54 | +`rateLimit.storage: 'secondary-storage'` throws at boot without it). |
| 55 | + |
| 56 | +The rest of #3517's production-dependency batch rides along: `@oclif/core` |
| 57 | +4.13.0, `@hono/node-server` 2.0.12, `hono` 4.12.32, `tar` 7.5.22, `jose` 6.2.4, |
| 58 | +`pinyin-pro` 3.28.2, plus the private docs app's fumadocs/next/react bumps. |
0 commit comments