chore(deps): bump better-auth from 1.4.6 to 1.4.9

[dependabot]

Bumps better-auth from 1.4.6 to 1.4.9.

Release notes

Sourced from better-auth's releases.

v1.4.9

   🚀 Features

• Add ctx.isTrustedDomain helper  -  by @​jonathansamines in better-auth/better-auth#6462 (d09c5)
• Drizzle pg supports JSON  -  by @​dvanmali in better-auth/better-auth#6518 (7d5f1)
• Add Refresh Token Support to Kick OAuth Provider  -  by @​CesarRodrigu in better-auth/better-auth#6263 (b1102)
• Add additionalFields option in verification table schema  -  by @​noctarius in better-auth/better-auth#6747 (eab5b)
• Add patreon social provider  -  by @​Spuffynism, benkingcode and Kinfe123 in better-auth/better-auth#6245 (07cdd)
• Add a global backgroundTasks config option to defer actions like sending email and updates to run after response is sent  -  by @​nexxeln and @​Bekacru in better-auth/better-auth#6713 (d544b)
• admin:
  • Prevent impersonating admins by default [breaking]  -  by @​jslno and @​Bekacru in better-auth/better-auth#6454 (5fb83)
  • Add support role with permissions for user updates and enforce role change validation  -  by @​Bekacru and Copilot in better-auth/better-auth#6699 (a0a16)
• expo:
  • Last-login-method client plugin  -  by @​jslno and @​himself65 in better-auth/better-auth#6413 (381f2)
• multi-session:
  • Allow to infer additional fields  -  by @​jslno in better-auth/better-auth#6585 (13786)
  • Allow to infer additional fields "  -  by @​Bekacru in better-auth/better-auth#6585 (e26fc)
• oauth-provider:
  • An oauth 2.1 compliant plugin  -  by @​dvanmali in better-auth/better-auth#4163 (686fb)
• oauth-proxy:
  • Add expirty timestamp for encrypted tokens  -  by @​Bekacru and Copilot in better-auth/better-auth#6538 (9f6b8)
• one-time-token:
  • Support setting session cookie on ott verify  -  by @​Bekacru in better-auth/better-auth#3659 (08e05)
• organization:
  • Allow invited users to see organization name  -  by @​GautamBytes and Copilot in better-auth/better-auth#6602 (a2476)
• phone-number:
  • Add password length validation for reset functionality  -  by @​Bekacru in better-auth/better-auth#6674 (4cdf8)
• saml:
  • Assertion timestamp validation with per-provider clock skew  -  by @​Paola3stefania in better-auth/better-auth#6706 (90c59)
  • Validate SAML crypto algorithms during initial phase  -  by @​Paola3stefania in better-auth/better-auth#6785 (b56d7)
  • Enforce one-time use of SAML assertions  -  by @​Paola3stefania in better-auth/better-auth#6719 (2053f)
  • Reject deprecated SAML signature and digest algorithms  -  by @​Paola3stefania in better-auth/better-auth#6784 (1f171)
  • Reject deprecated SAML signature and digest algorithms  -  by @​Paola3stefania in better-auth/better-auth#6784 (5bab6)
• sso:
  • Use domain verified flag to trust providers automatically  -  by @​Paola3stefania (6f283)
  • Add InResponseTo validation  -  by @​Paola3stefania in better-auth/better-auth#6557 (50ffe)
  • Add OIDC discovery  -  by @​Paola3stefania and @​Bekacru in better-auth/better-auth#6395 (57400)
  • Add URL normalization and validation to all discovery URLs  -  by @​jonathansamines, Paola Estefanía de Campos, @​Paola3stefania and @​Bekacru in better-auth/better-auth#6503 (17ff1)

   🐞 Bug Fixes

• Add helper types to exports  -  by @​himself65 in better-auth/better-auth#6479 (9b556)
• Avoid throwing on client side  -  by @​landoncolburn and @​Bekacru in better-auth/better-auth#6361 (b4f45)
• Export organization plugin types  -  by @​pffigueiredo in better-auth/better-auth#6490 (8efd5)
• Pathname should be normalized when basePath is set to root  -  by @​Bekacru (9228c)
• Prematurely deleting active sessions in secondary storage  -  by @​DevDuki in better-auth/better-auth#3885 (45cf4)
• Make sure non-chunked session data cookie is cleared  -  by @​Bekacru (26b2b)
• Array field handling across adapters and schema generation  -  by @​ping-maxwell and @​Bekacru in better-auth/better-auth#6601 (9d3d1)
• StoreStateStrategy default to database if provided  -  by @​himself65 in better-auth/better-auth#6619 (880e7)
• Should always remove 2FA verification token after successful verification  -  by @​delfortrie in better-auth/better-auth#6604 (13efb)

... (truncated)

Commits

• 35fcd1a chore: release v1.4.9
• b96c38b Merge branch 'canary'
• 148b32e chore: release v1.4.8
• 5c2180e fix: correct wildcard pattern matching for trustedOrigins (#6904)
• ae90b48 fix: correct wildcard pattern matching for trustedOrigins (#6904)
• 70d49e7 fix: don't set state query param if state is not provided (#6822)
• cd77223 fix: don't set state query param if state is not provided (#6822)
• 60c77fa fix: use operator in list members where clause (#6850)
• da82085 fix: use operator in list members where clause (#6850)
• d808c31 fix(client): set session data on refreshManager (#6932)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
marble-app	Error		Apr 5, 2026 6:39am
marble-web	Ready	Preview, Comment	Apr 5, 2026 6:39am

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
2 out of 3 committers have signed the CLA.

✅ mezotv
✅ taqh
❌ dependabot[bot]
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	marble-api	d4df01a	Commit Preview URL Branch Preview URL	Apr 05 2026, 06:38 AM

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.