Bump better-auth from 1.6.21 to 1.6.22

[dependabot]

Bumps better-auth from 1.6.21 to 1.6.22.

Release notes

Sourced from better-auth's releases.

v1.6.22

better-auth

Bug Fixes

• Fixed unproven credentials not being revoked during magic link and email OTP sign-in (#10239)
• Fixed server-side OAuth requests to refuse redirect responses instead of following them (#10241)

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

• Fixed SCIM write-path operations to be properly scoped and to correctly honor the active attribute (#10242)

For detailed changes, see CHANGELOG

@better-auth/stripe

Bug Fixes

• Fixed organization subscription actions (cancel, upgrade, restore, and the billing portal) that could act on the wrong organization.

For detailed changes, see CHANGELOG

auth

Bug Fixes

• Added account-level verification lockout for two-factor authentication (#10240)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​gustavovalverde

Full changelog: v1.6.21...v1.6.22

Changelog

Sourced from better-auth's changelog.

1.6.22

Patch Changes

• #10239 c06a56d Thanks @​gustavovalverde! - Magic-link and email-OTP sign-in now reset the credentials on an account whose email had never been confirmed. When verification resolves to such an account, any existing password on it is removed and its sessions are revoked before the user is signed in, so proven control of the mailbox is the source of truth for the account.

  If you signed up with email and password but first signed in through a magic link or email OTP rather than confirming the verification email, your password is cleared and you will need to set a new one through password reset.

• #10240 3a035e9 Thanks @​gustavovalverde! - Add account-level lockout for two-factor verification. The attempt limit applies per account across sign-in challenges and across factors: TOTP, email-OTP, and backup codes share one counter, and a successful verification resets it.

  Enabled by default: an account locks for 15 minutes after 10 consecutive failed verifications, and locked attempts return 429 with the ACCOUNT_TEMPORARILY_LOCKED error code. Configure it with twoFactor({ accountLockout: { enabled, maxFailedAttempts, durationSeconds } }).

  Run a database migration after upgrading: this adds failedVerificationCount and lockedUntil columns to the twoFactor table.

• Updated dependencies [8bd43d9]:

  • @​better-auth/core@​1.6.22
  • @​better-auth/drizzle-adapter@​1.6.22
  • @​better-auth/kysely-adapter@​1.6.22
  • @​better-auth/memory-adapter@​1.6.22
  • @​better-auth/mongo-adapter@​1.6.22
  • @​better-auth/prisma-adapter@​1.6.22
  • @​better-auth/telemetry@​1.6.22

Commits

• a90d061 chore: release v1.6.22 (#10245)
• 3a035e9 fix(two-factor): add account-level verification lockout (#10240)
• c06a56d fix: revoke unproven credentials on magic-link/email-OTP sign-in (#10239)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.