@better-auth/drizzle-adapter breaking changes

1.7.6

1 breaking change, first published September 24, 2026.

• Behavior changed maxPasswordLength
  Passwords over the configured maxPasswordLength are now rejected before hashing or verification with a PASSWORD_TOO_LONG error. Code that relied on longer passwords being accepted must shorten them or raise the limit. github.com

1.7.3

1 breaking change, first published September 6, 2026.

• Behavior changed
  Schema validation now runs during initialization by default, including in production, and rejects authentication requests when a mismatch is detected. Make sure your database schema matches Better Auth's before upgrading. github.com

1.7.1

1 breaking change, first published August 18, 2026.

• Behavior changed wantAssertionsSigned
  The wantAssertionsSigned option now correctly makes the service provider require signed assertions. Setups whose identity provider does not sign assertions may start failing sign-in until the IdP signs them or the option is turned off. github.com

1.7.0-beta.9

1 breaking change, first published August 18, 2026.

• Behavior changed customIdTokenClaims
  Remove iss, sub, aud, exp, nonce, auth_time, acr, amr, and azp from custom ID token claims. Use namespaced claim names for application data. github.com

1.7.0-beta.6

10 breaking changes, first published August 18, 2026.

• Removed BetterAuthRateLimitStorage.get
  Custom BetterAuthRateLimitStorage implementations must replace the separate get/set pattern with a single atomic consume method. github.com
• Removed oidcProvider
  The oidcProvider plugin is removed from better-auth/plugins. Use @better-auth/oauth-provider for OIDC authorization-server integrations. github.com
• Removed provider.authenticateClient
  Remove the grantType argument from provider.authenticateClient() calls in custom grant handlers. github.com
• Removed validAudiences
  validAudiences is removed in favor of resources, with clients linked through oauthClientResource. Run the schema migration before deploying. github.com
• Renamed createMcpAuthClient
  createMcpAuthClient is renamed to createMcpResourceClient in the MCP package. github.com
• Renamed withMcpAuth
  The MCP plugin moved to @better-auth/mcp. withMcpAuth is renamed to requireMcpAuth, and the schema must be migrated with npx auth migrate. github.com
• Behavior changed
  Forwarded host headers are no longer used for baseURL. Set advanced: { trustedProxyHeaders: true } if your proxy only exposes the public hostname through x-forwarded-host. github.com
• Behavior changed
  Partial prefix paths such as /sign-in no longer match. Replace them with explicit wildcards such as /sign-in/* or /sign-in/** in the captcha plugin configuration. github.com
• Configuration changed oneTap
  A Google client ID must be configured for One Tap, either via oneTap({ clientId }) or socialProviders.google.clientId. github.com
• Signature changed clientAuthentication
  Custom clientAuthentication strategies must return { clientId } instead of { clientId, client }. github.com

1.7.0-beta.4

1 breaking change, first published August 18, 2026.

• Behavior changed
  Inserts whose return values cannot be read safely now throw instead of continuing. Check MySQL insert handling if your code relied on the previous behavior. github.com

Check your code

These are the changes. To see which of them reach your code, scan a public repository, or have your coding agent call check_code with your manifest or lockfile over MCP. The API reads every change in every version, not only the newest. On Team and up, a fix pull request opens for the changes that reach a connected repository. Nothing merges or deploys.