[aussieljk]

Summary

This PR updates the component to Better Auth 1.7 and updates all dependencies to their latest versions. It includes the root package, the three examples, e2e and the docs site. All versions are at least 7 days old, as .npmrc requires (min-release-age=7).

Better Auth 1.7 has breaking changes, so this PR is a 0.13-level change. I added a draft migrate-to-0-13 guide. The maintainers must decide the release version.

Better Auth 1.7 changes

• Peer range: better-auth is now >=1.7.5 <1.8.0. Versions 1.7.0 to 1.7.2 added a required account.issuer column. Version 1.7.3 removed it again, so 1.7.5 is the lowest version that I tested.
• oidcProvider is removed upstream. The Convex plugin used it only to serve /convex/.well-known/openid-configuration. The plugin now serves the same document itself (same fields, same issuer and jwks_uri). The oidcProvider after hook did nothing here, because the Convex plugin does not register the /oauth2/authorize endpoint that sets its cookie. So I removed the hook. I added a test for the endpoint.
• Default component schema: oidcProvider is removed from auth-options.ts. So the oauthApplication, oauthAccessToken and oauthConsent tables are removed from the default schema. OIDC Provider is not on the supported plugins list. I did not add @better-auth/oauth-provider, because src/component/adapter.ts loads auth-options.ts at runtime, and it would become a new runtime dependency for all users. I did a test on a local backend: a deployment with documents in oauthApplication deploys the new schema without errors, and the documents stay.
• New optional fields from 1.7: twoFactor.failedVerificationCount, twoFactor.lockedUntil, jwks.alg, jwks.crv.
• Joins: experimental.joins moved to advanced.database.joins. The adapter still sets it to false.
• Adapter contract: update must now return null when no row matches. Before, updateOne threw Failed to update <model>. A new upstream adapter test checks this.
• Generic OAuth is now a social provider (/sign-in/social, /callback/:id). I removed the old /sign-in/oauth2 and /oauth2/callback matchers from the Convex and cross-domain plugins, and I updated the tests.
• React AuthClient type: in 1.7, the generic BetterAuthClientPlugin in the plugins union made useSession().data resolve to never. The type now uses only the Convex and cross-domain client plugins. I did a check that clients with more plugins (organization, two factor, anonymous) can still be given to ConvexBetterAuthProvider.
• Schema header: the 1.7 CLI gives an absolute --output path to createSchema, and this path went into the generated file header. The header now shows the path relative to cwd.

Tooling majors

• TypeScript 6.0.3. TypeScript 7 is not possible yet, because typescript-eslint supports <6.1.0. TS 6 has types: [] as the default and deprecates baseUrl. So I added "types": ["node"] to the example Convex tsconfigs, removed baseUrl, and changed two imports that used baseUrl to relative imports.
• ESLint 10: eslint-plugin-import does not support ESLint 10. I replaced it with eslint-plugin-import-x, which has the same consistent-type-specifier-style rule. I did a check that the rule still reports inline type specifiers. I removed eslint-plugin-react, because it was not used and it blocked ESLint 10.
• @convex-dev/eslint-plugin 5 has a new rule, no-duplicate-indexes. It reports errors on the generated src/component/schema.ts, because the adapter queries by those index names. I turned the rule off for that one generated file.
• Vitest 5, Convex 1.46, Next 16.3, Vite 8, React 19.3, convex-test 0.0.59.
• @types/node stays on 24.x, because CI uses Node 24.

Examples, e2e and docs

• Next example: genericOAuthClient() is removed, and signIn.oauth2 is replaced with signIn.social.
• Next and TanStack examples: the twoFactor.enable result is narrowed on method === "totp".
• TanStack example: with Vite 8, the SSR build failed on @import 'tailwindcss' through PostCSS. I moved it to @tailwindcss/vite, which the React example already uses.
• New codegen for the component and all examples, and new Local Install schemas in the next and tanstack examples.
• Docs: install pins changed to better-auth@~1.7.5, and a new migrate-to-0-13 guide. The docs site dependencies are updated too (fumadocs-mdx 15, TS 6).
• Lockfiles: a fresh npm install in examples/next and examples/react crashes npm (Cannot read properties of null (reading 'matches')). npm places the convex peer of @convex-dev/resend before the file: link to convex. I made the lockfiles in two steps (first the file: links only, then the full package.json). npm ci works on all lockfiles.

Test plan

• npm run build
• npm run test: 185 passed, 31 skipped, no type errors
• npm run typecheck: root and all 6 example projects
• npm run lint: 0 errors (3 warnings, the same as on main)
• npm run test:e2e: 4 passed against a local backend
• Production builds: react (vite build), tanstack (vite build), next (next build --webpack), docs (next build)
• npm ci on the root and all example lockfiles

Notes for reviewers

• I added an Unreleased entry to CHANGELOG.md. I did not change src/version.ts, because the release script updates it.
• next build with Turbopack cannot resolve the file: links outside the example root. This also happens on main. The dev script already uses --webpack.
• Prettier 3.9 reports style issues in 7 source files. These issues also occur on main, and CI does not check Prettier. I did not reformat those files, to keep this diff small.

[vercel]

@aussieljk is attempting to deploy a commit to the Convex Team on Vercel.

A member of the Team first needs to authorize it.