Skip to content

chore(deps)(deps): Bump @better-auth/scim from 1.7.0-rc.1 to 1.7.0-rc.5 - #9216

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/better-auth/scim-1.7.0-rc.5
Closed

chore(deps)(deps): Bump @better-auth/scim from 1.7.0-rc.1 to 1.7.0-rc.5#9216
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/better-auth/scim-1.7.0-rc.5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 17, 2026

Copy link
Copy Markdown
Contributor

Bumps @better-auth/scim from 1.7.0-rc.1 to 1.7.0-rc.5.

Release notes

Sourced from @​better-auth/scim's releases.

v1.7.0-rc.5

better-auth

❗ Breaking Changes

  • Refactored OAuth device grant ownership to use oauthDeviceAuthorization() alongside oauthProvider() or mcp() (#10746)

Migration: Replace the standalone deviceCodeGrant() plugin with oauthDeviceAuthorization() used alongside oauthProvider() or mcp(). Regenerate and apply the schema (resource column is replaced by oauthClientId and resources). Let any pending device codes expire or delete them before upgrading, as they cannot be exchanged through the new integration.

Features

  • Added option to disable displayName in the username plugin (#10330)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

❗ Breaking Changes

  • Refactored OAuth device grant ownership to use oauthDeviceAuthorization() alongside oauthProvider() or mcp() (#10746)

Migration: Replace the standalone deviceCodeGrant() plugin with oauthDeviceAuthorization() used alongside oauthProvider() or mcp(). Regenerate and apply the schema (resource column is replaced by oauthClientId and resources). Let any pending device codes expire or delete them before upgrading, as they cannot be exchanged through the new integration.

Features

  • Removed the silenceWarnings config option and startup warnings for well-known metadata endpoints (#10703)

Bug Fixes

  • Fixed device authorization flow to enforce RFC requirements (#10752)

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

  • Fixed type alignment between auth endpoints and better-call (#10657)

For detailed changes, see CHANGELOG

auth

Bug Fixes

  • Fixed CLI to align installed packages with the running CLI version (#10743)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

... (truncated)

Changelog

Sourced from @​better-auth/scim's changelog.

1.7.0-rc.5

1.7.0-rc.4

Minor Changes

  • #10682 8b96573 Thanks @​gustavovalverde! - SCIM PATCH operations that target filtered multi-valued attributes (phoneNumbers, addresses, roles, entitlements, emails) now create the value when the filter matches nothing instead of rejecting the request with a noTarget error. Microsoft Entra ID sends these operations for attributes that are not populated yet, and the rejection also discarded every other operation bundled in the same PATCH request.

1.7.0-rc.3

Minor Changes

  • #10592 26b1949 Thanks @​gustavovalverde! - Allow SCIM bearer verification to resolve application-owned connections at request time. Dynamic connections use the same scope enforcement, immutable provisioning-domain binding, decommissioning, and request fencing as code-defined connections, while an empty static connection list is supported when a verifier is configured.

  • #10620 b7683b8 Thanks @​gustavovalverde! - Add the standard Enterprise User extension (employeeNumber, costCenter, organization, division, department, manager) and the classic title, userType, preferredLanguage, locale, timezone, phoneNumbers, addresses, roles, and entitlements User attributes, plus name.middleName, name.honorificPrefix, and name.honorificSuffix. All are readable, filterable by type or primary, and writable through PATCH, including the classic Microsoft Entra manager path aliases.

    Add compatibility.microsoftEntra.acceptLegacyGroupSchema to accept Microsoft Entra's legacy, attribute-less Group schema marker on POST /Groups without storing or returning it.

    Microsoft Entra interoperability fixes:

    • A bare attributes/excludedAttributes name for an Enterprise User sub-attribute (for example ?attributes=manager) no longer drops the whole extension from the response.
    • Multi-op PATCH paths filtered by [primary eq true] (or [primary eq "true"]) with a sub-attribute target now work on emails, phoneNumbers, addresses, roles, and entitlements.
    • A single-element array wrapping a scalar PATCH replace value is unwrapped instead of rejected, on User scalars, Enterprise User fields, and Group displayName and externalId.
    • Removing the last sub-attribute of a complex attribute (for example manager.value) clears the emptied Enterprise User extension instead of leaving it declared.
    • Replacing manager with an empty string clears it, matching how Microsoft Entra removes a manager.
    • A PATCH with an empty Operations array is a valid no-op instead of an error, for both Users and Groups.
    • PATCH /Users/:id and PATCH /Groups/:id return 200 OK with the updated resource instead of 204 No Content.

  • #10592 26b1949 Thanks @​gustavovalverde! - Add an optional SCIM-owned connection and credential catalog. Configure managedConnections to let trusted server code create runtime tenant connections and issue, rotate, and revoke their bearer credentials through server-only auth.api methods, without a code-defined connection or an application-owned verifier.

Patch Changes

  • #10620 b7683b8 Thanks @​gustavovalverde! - Accept exact case-insensitive string Boolean values for SCIM User active and the primary sub-attribute of emails, phoneNumbers, addresses, roles, and entitlements at the HTTP ingress for Microsoft Entra interoperability.

  • #10592 26b1949 Thanks @​gustavovalverde! - Allow trusted server code to retain a terminal connection binding before a dynamic SCIM connection's first authenticated request by supplying its provisioning domain during decommissioning.

1.7.0-rc.2

Minor Changes

  • #10474 dec763e Thanks @​gustavovalverde! - Add acquireActiveSCIMUserLink for transaction-safe authentication of provisioned users. The helper maps an exact SCIM connection ID and externalId to an active Better Auth User while fencing concurrent subject changes, deactivation, deletion, and connection decommissioning.

    Compose the helper with SSO resolveUser to link the provisioned User without matching by email or userName.

  • #10390 0de88f5 Thanks @​gustavovalverde! - SCIM connections can now provision Users, Groups, and direct memberships into application-defined provisioning domains without the organization or SSO plugins. Applications can map Group membership to validated custom roles through projections. The service also supports SCIM 2.0 discovery, filtering, pagination, response attribute selection, atomic PATCH operations, and common request patterns used by Microsoft Entra ID and Okta.

    This replaces the previous SCIM configuration, client APIs, database schema, and organization-backed Group model. Existing SCIM installations cannot migrate provisioning state in place. Follow the SCIM cutover in the 1.7 upgrade guide, including full directory reprovisioning, before resuming traffic.

    Deferred database side effects now run only after a successful transaction. A rolled-back User update no longer refreshes its cached profile, and a rolled-back bulk session revocation no longer invalidates sessions.

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
chore(deps)(deps): Bump @better-auth/scim from 1.7.0-rc.1 to 1.7.0-rc.5
4ba9425 
Bumps [@better-auth/scim](https://github.com/better-auth/better-auth/tree/HEAD/packages/scim) from 1.7.0-rc.1 to 1.7.0-rc.5.
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/v1.7.0-rc.5/packages/scim/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.0-rc.5/packages/scim)

---
updated-dependencies:
- dependency-name: "@better-auth/scim"
  dependency-version: 1.7.0-rc.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript labels Aug 17, 2026
@github-actions

github-actions Bot commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-auth.

8 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

  • content/docs/deployment/cli.mdx (via @objectstack/plugin-auth)
  • content/docs/deployment/production-readiness.mdx (via @objectstack/plugin-auth)
  • content/docs/kernel/contracts/cache-service.mdx (via @objectstack/plugin-auth)
  • content/docs/kernel/services-checklist.mdx (via @objectstack/plugin-auth)
  • content/docs/permissions/authentication.mdx (via @objectstack/plugin-auth)
  • content/docs/permissions/sso.mdx (via @objectstack/plugin-auth)
  • content/docs/plugins/index.mdx (via @objectstack/plugin-auth)
  • content/docs/plugins/packages.mdx (via @objectstack/plugin-auth)

⛔ 2 release-owned page(s) also reference the affected code. These are read-only:

  • content/docs/releases/implementation-status.mdx (via @objectstack/plugin-auth)
  • content/docs/releases/v9.mdx (via @objectstack/plugin-auth)

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.

@dependabot @github

dependabot Bot commented on behalf of github Aug 17, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/better-auth/scim-1.7.0-rc.5 branch August 17, 2026 03:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file size/xs

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@os-project-manager