chore(deps)(deps): bump @better-auth/scim from 1.7.0-rc.1 to 1.7.0-rc.2

[dependabot]

Bumps @better-auth/scim from 1.7.0-rc.1 to 1.7.0-rc.2.

Release notes

Sourced from @​better-auth/scim's releases.

v1.7.0-rc.2

better-auth

❗ Breaking Changes

• chore!: move joins to advanced.database.joins (#10359)

  If you previously set experimental: { joins: true }, update your config to:

  advanced: {
    database: {
      joins: true,
    },
  }

  Adapters that support native joins use them when enabled. If an adapter cannot return joined data for a query, Better Auth falls back to additional queries and combines the results. Drizzle and Prisma users should ensure their schema includes the required relations (npx auth@latest generate).

• feat(auth)!: scope accounts by issuer (#10403)

  This release is breaking. Account.accountId is renamed to Account.providerAccountId, and Account.issuer is required. Account-specific APIs select the local Account.id through accountId; token and provider-profile APIs can instead select the signed account cookie with useAccountCookie: true. Credential accounts use local:credential and the linked user's stable id as their provider identity.

  OAuth provider identity now comes from raw verified profiles. OpenID Connect discovery uses sub, plain OAuth uses id, and providers can declare accountSubject for another immutable field; Better Auth no longer switches between sub and id at runtime. getUserInfo().user no longer carries provider identity, and mapProfileToUser cannot return id. Read the selected identity from accountInfo.account.providerAccountId instead of accountInfo.user.id. The generic microsoftEntraId helper now requires a concrete tenant GUID; use the built-in Microsoft provider for multi-tenant authorities.

  SSO account subjects are now protocol-defined. OIDC uses the verified sub claim, and SAML uses the signed NameID; mapping.id is removed from both configurations. A manual SAML configuration without metadata XML must set idpMetadata.entityID, because samlConfig.issuer identifies the service provider and no longer acts as the IdP identity.

  Apply the reviewed account-identity backfill in the Better Auth 1.7 upgrade guide before deploying. The generated schema migration cannot assign trusted issuers or resolve existing identity collisions automatically.

• feat(scim)!: decouple provisioning from the organization plugin (#10390)

  This replaces the previous SCIM configuration, client APIs, database schema, and organization-backed Group model. Existing SCIM installations cannot migrate provisioning state in place. Follow the SCIM cutover in the 1.7 upgrade guide, including full directory reprovisioning, before resuming traffic.

  Deferred database side effects now run only after a successful transaction. A rolled-back User update no longer refreshes its cached profile, and a rolled-back bulk session revocation no longer invalidates sessions.

Features

• feat: add ctx to verifyIdToken (#10376)
• feat(db): add compound table indexes (#10402)
• feat(last-login-method): beforeStoreCookie option for GDPR compliance (#5753)
• feat(organization): add getOrganization for metadata-only fetches (#10397)
• feat(sso): add transactional OIDC user resolution (#10473)

Bug Fixes

• chore: widen drizzle-kit peer dependency range (#10299)
• fix: get-session should have no-cache cache control headers (#10222)
• fix: recognize BIGINT as valid number type for SQLite in migrations. (#10316)
• fix(auth): handle request clone failures in callbacks (#10336)
• fix(client): preserve null in useSession().data type with throw:true (#9787)
• fix(client): restore auth query lifecycle after remount (#10379)
• fix(cookies): tighten CookieAttributes index signature type (#10441) (#10442)

... (truncated)

Changelog

Sourced from @​better-auth/scim's changelog.

1.7.0-rc.2

Minor Changes

• #10474 dec763e Thanks @​gustavovalverde! - Add acquireActiveSCIMUserLink for transaction-safe authentication of provisioned users. The helper maps an exact SCIM connection ID and externalId to an active Better Auth User while fencing concurrent subject changes, deactivation, deletion, and connection decommissioning.

  Compose the helper with SSO resolveUser to link the provisioned User without matching by email or userName.

• #10390 0de88f5 Thanks @​gustavovalverde! - SCIM connections can now provision Users, Groups, and direct memberships into application-defined provisioning domains without the organization or SSO plugins. Applications can map Group membership to validated custom roles through projections. The service also supports SCIM 2.0 discovery, filtering, pagination, response attribute selection, atomic PATCH operations, and common request patterns used by Microsoft Entra ID and Okta.

  This replaces the previous SCIM configuration, client APIs, database schema, and organization-backed Group model. Existing SCIM installations cannot migrate provisioning state in place. Follow the SCIM cutover in the 1.7 upgrade guide, including full directory reprovisioning, before resuming traffic.

  Deferred database side effects now run only after a successful transaction. A rolled-back User update no longer refreshes its cached profile, and a rolled-back bulk session revocation no longer invalidates sessions.

Commits

• cc708e5 chore: release v1.7.0-rc.2 (#10327)
• 1dd09ed docs(sync): address merged documentation comments
• 558d2de chore(sync): merge main into next
• dec763e feat(scim): expose active provisioned user links (#10474)
• 9a661c7 chore: release v1.6.24 (#10323)
• 0de88f5 feat(scim)!: decouple provisioning from the organization plugin (#10390)
• See full diff in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
spec	Ready	Preview, Comment	Jul 27, 2026 9:46am

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Jul 27, 2026 9:46am

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-auth.

9 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/deployment/cli.mdx (via @objectstack/plugin-auth)
• content/docs/deployment/production-readiness.mdx (via @objectstack/plugin-auth)
• content/docs/kernel/services-checklist.mdx (via @objectstack/plugin-auth)
• content/docs/permissions/authentication.mdx (via @objectstack/plugin-auth)
• content/docs/permissions/sso.mdx (via @objectstack/plugin-auth)
• content/docs/plugins/index.mdx (via @objectstack/plugin-auth)
• content/docs/plugins/packages.mdx (via @objectstack/plugin-auth)
• content/docs/releases/implementation-status.mdx (via @objectstack/plugin-auth)
• content/docs/releases/v9.mdx (via @objectstack/plugin-auth)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.