build(deps): Bump better-auth from 1.4.18 to 1.4.19 in /apps/api

[dependabot]

Bumps better-auth from 1.4.18 to 1.4.19.

Release notes

Sourced from better-auth's releases.

v1.4.19

   🚀 Features

• adapter:
  • Improve select support  -  by @​jslno in better-auth/better-auth#7667 (4aae0)
• oauth-provider:
  • Add iss parameter to authorization responses (RFC 9207)  -  by @​Paola3stefania in better-auth/better-auth#7669 (766fc)
  • Add configurable rate limiting for OAuth endpoints  -  by @​Paola3stefania in better-auth/better-auth#7666 (2410d)
  • Enforce HTTPS for redirect URIs  -  by @​Paola3stefania in better-auth/better-auth#7670 (cf473)
• phone-number:
  • Support user additionalFields in signUpOnVerification flow  -  by @​bytaesu and @​himself65 in better-auth/better-auth#7699 (f3080)

   🐞 Bug Fixes

• Skip sending email verification to already verified users without a session  -  by @​bytaesu in better-auth/better-auth#7712 (1667f)
• Improve Headers detection with instanceof check and cross-realm fallback  -  by @​bytaesu in better-auth/better-auth#7651 (1dc6a)
• Safely coerce date values from DB in OAuth provider plugin  -  by @​himself65 in better-auth/better-auth#7937 (f7074)
• Correct error redirect URL construction  -  by @​bytaesu in better-auth/better-auth#7799 (61cc2)
• Encode callbackURL in delete-user verification email  -  by @​Paola3stefania in better-auth/better-auth#8007 (fab61)
• Add error handling for id token verification in Apple and Google providers  -  by @​Paola3stefania in better-auth/better-auth#8011 (90ffd)
• access:
  • Allow passing statements directly into newRole  -  by @​jslno in better-auth/better-auth#7687 (9312d)
• adapter:
  • Use getCurrentAdapter for user lookup to avoid transaction deadlock  -  by @​sakamoto-wk in better-auth/better-auth#7758 (327ee)
• admin:
  • Change list type from never[] to UserWithRole[]  -  by @​LovelessCodes in better-auth/better-auth#7701 (3c0c5)
  • Apply listUsers filter when filterValue is defined  -  by @​coderrshyam, @​bytaesu and Taesu in better-auth/better-auth#7827 (5f611)
  • Optional chain user in hooks  -  by @​jslno in better-auth/better-auth#8026 (17407)
• api-key:
  • Error details not passed to response  -  by @​ping-maxwell and @​himself65 in better-auth/better-auth#7692 (8fd94)
• cli:
  • Add .env.local to dotenv  -  by @​himself65 in better-auth/better-auth#7831 (e804e)
• cookie:
  • Relax cookie retrieval for getSessionCookie  -  by @​jslno in better-auth/better-auth#8008 (81f50)
• custom-session:
  • Use getSetCookie() to preserve individual Set-Cookie headers  -  by @​thomaspeklak in better-auth/better-auth#7879 (0f035)
• db:
  • Infer default value for required attr properly  -  by @​jslno in better-auth/better-auth#7996 (c44a8)
• email-otp:
  • Typo in OpenAPI response metadata  -  by @​smsunarto and Claude Opus 4.5 in better-auth/better-auth#7737 (defcb)
• expo:
  • Construct the new Request to avoid immutable headers error on Cloudflare Workers  -  by @​bytaesu in better-auth/better-auth#7774 (5e83e)
  • Avoid a leading “; ” when constructing the first cookie  -  by @​Laurin-Notemann in better-auth/better-auth#7821 (3f5c1)
  • Support wildcard trusted origins in deep link cookie injection  -  by @​bytaesu in better-auth/better-auth#8013 (7153e)
• generic-oauth:
  • Emit duplicate id warning  -  by @​himself65 in better-auth/better-auth#7779 (c682a)
• microsoft:
  • Add verifyIdToken support for Microsoft Entra ID provider  -  by @​bytaesu in better-auth/better-auth#7795 (80120)
• oauth:
  • Support case-insensitive email matching for social account linking  -  by @​karuppusamy-d in better-auth/better-auth#7812 (987f4)

... (truncated)

Commits

• 1892ca3 chore: release v1.4.19
• 0f035e3 fix(custom-session): use getSetCookie() to preserve individual Set-Cookie hea...
• 3f25497 fix(organization): remove unreachable null check in acceptInvitation (#7825)
• 80120ae fix(microsoft): add verifyIdToken support for Microsoft Entra ID provider (...
• 17407ba fix(admin): optional chain user in hooks (#8026)
• c44a84d fix(db): infer default value for required attr properly (#7996)
• 81f507a fix(cookie): relax cookie retrieval for getSessionCookie (#8008)
• fab61af fix: encode callbackURL in delete-user verification email (#8007)
• c682ac8 fix(generic-oauth): emit duplicate id warning (#7779)
• 327ee71 fix(adapter): use getCurrentAdapter for user lookup to avoid transaction de...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #39.