Bump better-auth from 1.4.18 to 1.5.6

[dependabot]

Bumps better-auth from 1.4.18 to 1.5.6.

Release notes

Sourced from better-auth's releases.

v1.5.6

   🚀 Features

• Agent auth plugin  -  by @​Bekacru in better-auth/better-auth#8696 (a0b53)
• core: Add experimental opentelemetry instrumentation  -  by @​jonathansamines and @​bytaesu in better-auth/better-auth#8027 (1ed42)
• email-otp: Add resendStrategy option to reuse existing OTP  -  by @​bytaesu in better-auth/better-auth#8560 (98c8e)
• magic-link: Add request metadata to sendMagicLink  -  by @​mrgrauel in better-auth/better-auth#8571 (cb240)
• mongo-adapter: Store UUIDs as native BSON UUID  -  by @​bytaesu in better-auth/better-auth#8681 (d1bff)
• oauth-provider: Public client prelogin endpoint  -  by @​dvanmali in better-auth/better-auth#8214 (a0eb1)
• organization: Explicit organizationId in team endpoints  -  by @​xiaoyu2er and @​himself65 in better-auth/better-auth#5062 (8f470)
• social-provider: Add wechat social provider  -  by @​Eric-Song-Nop, Claude and @​himself65 in better-auth/better-auth#5189 (c4402)
• stripe: Allow customizable prorationBehavior per plan  -  by @​bytaesu in better-auth/better-auth#8525 (98cea)
• test-utils: Export adapter test suites from @better-auth/test-utils/adapter  -  by @​bytaesu in better-auth/better-auth#8564 (6be0f)
• two-factor: Add twoFactorPage in config  -  by @​wuzgood98 in better-auth/better-auth#5329 (4f41b)

   🐞 Bug Fixes

• Handle skipOriginCheck array  -  by @​jslno in better-auth/better-auth#8582 (331c4)
• Prevent revoked sessions from being restored via database fallback  -  by @​bytaesu in better-auth/better-auth#8708 (d4efa)
• api:
  • Return Response for HTTP request contexts  -  by @​gustavovalverde in better-auth/better-auth#7521 (9e3e8)
• client:
  • Handle throw:true in session refresh  -  by @​bytaesu in better-auth/better-auth#8610 (275ca)
• core:
  • Prioritize generateId "uuid" over adapter customIdGenerator  -  by @​bytaesu in better-auth/better-auth#8679 (fc0bc)
• docs:
  • Improve AI chat security and cleanup  -  by @​himself65 in better-auth/better-auth#8597 (5c0c8)
  • Add missing Encore icon to sidebar icons  -  by @​himself65 in better-auth/better-auth#8663 (cd5b8)
• electron:
  • Handle safeStorage encryption failures gracefully  -  by @​jslno in better-auth/better-auth#8530 (04766)
• oauth-provider:
  • Support prompt=none  -  by @​dvanmali in better-auth/better-auth#8554 (812fd)
  • Improve allowed paths for oauth_query for client plugin  -  by @​dvanmali in better-auth/better-auth#8320 (ccded)
  • Fix dist declaration type errors  -  by @​gustavovalverde in better-auth/better-auth#8701 (ec79f)
• organization:
  • Filter null organizations in listUserInvitations  -  by @​raihanbrillmark and Raihan Sharif in better-auth/better-auth#8694 (a62cb)
• sso:
  • Use namespace import for samlify to fix ESM compatibility  -  by @​himself65 in better-auth/better-auth#8697 (71f70)
• stripe:
  • Replace {CHECKOUT_SESSION_ID} placeholder in success callbackURL  -  by @​bytaesu in better-auth/better-auth#8568 (32704)
  • Improve organization customer search by adding customerType check  -  by @​bytaesu in better-auth/better-auth#8609 (74ec7)

    View changes on GitHub

v1.5.5

   🚀 Features

• oauth-provider: Pairwise subject identifiers (OIDC Core §8)  -  by @​gustavovalverde and @​himself65 in better-auth/better-auth#8292 (6c09f)

   🐞 Bug Fixes

... (truncated)

Commits

• 275ca46 fix(client): handle throw:true in session refresh (#8610)
• 1ed4271 feat(core): add experimental opentelemetry instrumentation (#8027)
• d4efa8e fix: prevent revoked sessions from being restored via database fallback (#8708)
• 0cfd514 chore(deps): bump kysely from 0.28.11 to 0.28.12 (#8700)
• a9f3497 chore: release v1.5.6
• 1a4ddce chore(deps): bump next.js from 16.1.6 to 16.2.0 (#8682)
• 9e3e8e6 fix(api): return Response for HTTP request contexts (#7521)
• 98c8e4e feat(email-otp): add resendStrategy option to reuse existing OTP (#8560)
• 4f41b62 feat(two-factor): add twoFactorPage in config (#5329)
• a62cb04 fix(organization): filter null organizations in listUserInvitations (#8694)
• Additional commits viewable in compare view

[netlify]

❌ Deploy Preview for servicestart failed. Why did it fail? →

Name	Link
🔨 Latest commit	513c2d6
🔍 Latest deploy log	https://app.netlify.com/projects/servicestart/deploys/69c5e2606d501a0008c19d63

[greptile-apps]

Greptile Summary

This PR is an automated dependabot bump of better-auth from 1.4.18 to 1.5.6, updating package.json and pnpm-lock.yaml. No application code is modified.\n\nKey changes pulled in by the new version:\n\n- Security fix: Revoked sessions can no longer be restored via database fallback (better-auth#8708) — a meaningful improvement for the project's auth security posture.\n- Internal sub-packages: Adapters (drizzle, kysely, memory, mongo, prisma) are now shipped as separate @better-auth/* packages that the main better-auth bundle depends on. The project's existing import paths remain unchanged.\n- Optional OpenTelemetry support: @opentelemetry/api@1.9.1 and @opentelemetry/semantic-conventions@1.40.0 added as optional/peer dependencies — not used by the project, no runtime cost.\n- Transitive bumps: better-call 1.1.8 → 1.3.2, jose 6.1.3 → 6.2.2, nanostores 1.1.0 → 1.2.0, set-cookie-parser 2.7.2 → 3.1.0 (internal to better-call).\n- The project's own auth configuration is fully compatible with the updated API surface.

Confidence Score: 5/5

Safe to merge — automated dependency bump with no application code changes, includes a security fix, and all existing import paths and config options are API-stable.

Purely a lockfile + manifest update generated by dependabot. The project's auth usage is part of the stable public API unchanged between 1.4.x and 1.5.x. The bump ships an important security fix and several bug fixes. New optional OpenTelemetry packages add no runtime overhead.

No files require special attention.

Important Files Changed

Filename	Overview
package.json	Single-line version bump for better-auth from ^1.4.18 to ^1.5.6; no other changes.
pnpm-lock.yaml	Lockfile updated to reflect new better-auth 1.5.6 dependency tree, including new adapter sub-packages, updated better-call, jose, nanostores, set-cookie-parser, and new optional OpenTelemetry packages.

_{Reviews (1): Last reviewed commit: "Bump better-auth from 1.4.18 to 1.5.6" | Re-trigger Greptile}

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.