better-auth · Issues· 719 open

feat: email confirmation for org deletion & ownership transfer, plus opt-in confirmationMode

`maxPasswordLength` is not enforced before hashing on sign-in, verify-password, change-password (currentPassword), delete-user, two-factor and admin create-user

`trustedProviders` is not respected with social login

oauth-provider: consent deletion leaves pending codes redeemable

oauth-provider: refresh replay can leave successor usable

Support Prisma ORM 8

feat(cookies): support the `__Host-` cookie prefix

Organization: check an arbitrary member’s current permissions server-side

Allow multiple domains in the SIWE plugin

organization: `create-role` and `update-role` accept a comma in the role name, persisting a role that can never be assigned

sso: SAML ACS from samlConfig.callbackUrl never reaches expectedRecipients (binding URN passed where samlify expects "post")

The model "oauthResource" was not found in the schema object

phone-number plugin stores the OTP in clear; no storeOTP option as email-otp has

Encrypt OIDC Config at Rest

feat(organization): support opt-in soft deletion for organization members