Better Auth security update

Pro Prisma and Pro Drizzle v2.8.1 update Better Auth and @better-auth/passkey from 1.7.3 to 1.7.16.

Authentication security

The upstream security release includes fixes for revoked sessions, email verification and email changes, OAuth email-verification claims, organization role checks and passkey origin and user-verification enforcement.

Both starter kits retain required user verification for passkeys and server-side revocation of all existing sessions after a successful password reset. This release also includes the previously shipped Next.js and bundle analyzer 16.4.2 patches.

See the official Better Auth security announcement and v1.7.16 release notes for the affected configurations and complete upstream details.

Existing projects

Update both packages together:

npm install --save-exact better-auth@1.7.16 @better-auth/passkey@1.7.16

No database migration or new environment variable is required for the included starter-kit configuration. Node.js 22 remains the supported runtime.

If you customized trusted origins, passkey origins or authentication plugins, review the upstream upgrade notes for those settings before deploying.