[Medformatik]

What changed and why

Better Auth's 2026-11-03 security release fixes twelve advisories in 1.7.16. This PR moves better-auth and every @better-auth/* package in apps/api, apps/web and packages/core from 1.7.14 to 1.7.16, as upstream asks for all packages together. It also moves the pinned auth CLI in auth:generate to 1.7.16.

The release went out a few hours ago, so the 24-hour minimumReleaseAge gate blocks it. pnpm-workspace.yaml exempts the exact patched versions, the same way node-forge@1.4.2 was exempted. better-auth pins its adapters, telemetry and better-call@1.4.5 exactly, so those versions are listed too. The age gate still applies to every other version.

Advisories that apply to the current apps/api/src/auth.ts configuration:

• GHSA-4wq4-2ppv-q3hg (critical), @better-auth/expo: the server registers expo(), so its authorization proxy endpoint is reachable. Upstream says an unauthenticated attacker who knows an email address could sign in as that user. The fix also tightens wildcard trustedOrigins matching. In production the list is the CORS_ORIGIN web origins plus openmapx://, which has no wildcard by default. The development-only exp://192.168.*.*:*/** entry now matches only IPv4 hosts, which is what it is for.
• GHSA-hwq2-v29r-p69r, core email change: emailVerification.sendVerificationEmail is configured. Verification and change links now work only for the account they were issued to. Opening a change link no longer signs the user in.
• GHSA-2f9c-7xj7-gh55, email OTP: emailOTP has changeEmail.enabled. The attempt-limit race is fixed and codes are now bound to their exact address. Email-change codes sent before the upgrade must be requested again.
• GHSA-fvxx-76fc-893x, revoked sessions: passkey registration, two-factor enrollment and account linking now check the session store even when the cookie cache is on.
• GHSA-9hm7-xhfp-cx58, OAuth verified email: OpenStreetMap and Mapillary both return emailVerified: false and are trusted linking providers. The stricter claim handling does not change their behaviour.
• GHSA-gv75-j3v8-3crm (low), passkey: the expected WebAuthn origin now comes from configuration, not from the request. passkey() already sets origin from PASSKEY_ORIGIN, so no new configuration is needed.
• GHSA-g95c-wqvr-8c3j, admin: changing a phone number through update-user now needs user:set-phone. admin() uses the default roles, which include it.

These do not apply because the plugins are not enabled: phone number (GHSA-q747-mqgr-4gh7), organization (GHSA-c85h-5mrr-mgx4), Stripe (GHSA-x8j7-xh58-rv6x), Electron (GHSA-9p5w-h4pr-fcrc) and the MySQL Kysely adapter (GHSA-48c2-w96j-mv3m; OpenMapX uses the Drizzle Postgres adapter).

Running auth:generate with 1.7.16 produces no schema change after formatting, so no migration is needed.

Verification

• pnpm verify:full: lint, workspace types, policy and OpenAPI pass. The test stage passed 24,746 tests and failed one: the test in auth-oauth-provider.test.ts that pins the Better Auth version still expected 1.7.14. The version now lives in one constant set to 1.7.16, and the file passes (9 tests).
• pnpm test:database api-privacy: 27 files and 149 tests pass, including auth-postgres.test.ts. The run used a disposable PostGIS 18-3.6 container at the CI digest, with the production Drizzle migrations applied first.
• auth:generate with auth@1.7.16: the formatted schema matches the committed auth-schema.ts.
• pnpm check-release-information passes with this description.
• Not run: browser sign-in, passkey and email-change flows, the Expo/mobile authorization path, and the ingestion and export-restore database groups, which do not exercise Better Auth.

Release and upgrade impact

Product impact: ordinary

No package release: neither public package's sources change and neither depends on Better Auth. Built from origin/main and from this branch, the @openmapx/extension-cli bundle is byte-identical. The @openmapx/extension-contracts declarations differ only in union-member order, and a second build of this branch matched origin/main exactly, so the ordering is build-to-build noise.

The upgrade itself needs no migration or configuration change. For the Expo advisory, upstream recommends rotating the application secret if the endpoint was reachable, because signatures issued before the fix stay valid until the secret changes. On OpenMapX the same secret also encrypts stored provider OAuth tokens (account.encryptOAuthTokens), so rotating it ends every session and makes people relink OpenStreetMap and Mapillary. This PR does not rotate the secret. Whether to rotate is an operator decision.