chore(deps): update dependency better-auth to v1.7.7

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
better-auth (source)	dependencies	patch	1.7.6 → 1.7.7

---

Release Notes

better-auth/better-auth (better-auth)

v1.7.7

Compare Source

Patch Changes

• #​11476 4186e36 Thanks @​bytaesu! - Return CAPTCHA errors with the correct JSON Content-Type header.

• #​11469 8620aa9 Thanks @​aryan1306! - Return rate limit errors with a JSON Content-Type header.

• #​11491 55cb92e Thanks @​bytaesu! - Respect social provider disableSignUp when signing in with an ID token.

• #​11375 69defbc Thanks @​bytaesu! - Refresh the active organization after sign-in when a session hook selects the initial organization.

• #​11494 ac54bfd Thanks @​gustavovalverde! - Isolate OAuth state cookies and each OAuth Proxy payload with purpose-specific encryption keys. The oAuthProxy options and supported configuration remain unchanged.

  Upgrade all Better Auth nodes that handle the same cookie-backed OAuth or SAML relay-state flow together. Upgrade every OAuth Proxy participant, including production and preview or development deployments, in the same cutover. OAuth sign-in, account-linking, and cookie-backed SAML sign-in flows started before the upgrade must be restarted. Mixed old and new participants cannot exchange existing state or proxy payloads, and there is no fallback to the previous shared key.

• #​11494 ac54bfd Thanks @​gustavovalverde! - Magic Link verification now accepts only records issued for Magic Link. Magic
  Link records and database-backed OAuth or SAML state use separate verification
  identifier prefixes. Links and database-backed sign-ins started before the
  upgrade cannot complete; request new Magic Links and restart those sign-ins.
  Upgrade servers sharing verification storage together, and update
  verification.storeIdentifier.overrides rules for these flows to match the new
  magic-link: and auth-state: prefixes. The link token, callback state,
  endpoints, and public option types are unchanged.

  Upgrade installed Better Auth adapters, plugins, and integrations released
  with better-auth alongside it so participating packages use the same release
  version.

• Updated dependencies [35d7cd3, 07bdf7e]:

  • @​better-auth/drizzle-adapter@1.7.7
  • @​better-auth/kysely-adapter@1.7.7
  • @​better-auth/core@1.7.7
  • @​better-auth/memory-adapter@1.7.7
  • @​better-auth/mongo-adapter@1.7.7
  • @​better-auth/prisma-adapter@1.7.7
  • @​better-auth/telemetry@1.7.7

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	better-auth@​1.7.6 ⏵ 1.7.7	+1		+1	+2

View full report

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 67003333-17be-4f97-aa0f-e19ad4e0c548

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}