Auth.js (NextAuth.js) is a set of open-source packages for authentication in modern web applications, designed to work with standard Web APIs and integrate with many OAuth 2.0 and OIDC providers. It helps you add sign-in flows like email/passwordless, passkeys (WebAuthn), and JWT-based sessions with configurable security defaults and options for using a database or running stateless authentication.
Project status
- nextauthjs/next-auth appears actively maintained, with an upstream push on 2026-07-22 and a security-focused update for the 4.x line on 2026-07-20.
- The apparent update cadence is very recent, with multiple @auth/* adapter/framework updates landing together on 2026-07-20 (mostly dependency bumps), suggesting ongoing development rather than a long quiet period.
AI summary generated
Recent updates
next-auth@4.24.15
next-auth@4.24.15 is a security patch release for the 4.x line, primarily hardening token parsing, OAuth callback cookie binding, and email validation. It also adjusts URL handling for trusted-host mode and addresses CommonJS compatibility by pinning uuid.
BreakingSecurity@auth/sequelize-adapter@2.11.3
This release primarily updates the underlying @auth/core dependency to a newer revision (commit 8a933f95). No other functional changes, bug fixes, or breaking changes are described in the provided release notes.
@auth/supabase-adapter@1.11.3
This release is primarily a dependency bump, updating @auth/core to commit 8a933f95. No additional features, bug fixes, or behavioral changes are documented in the provided release notes.
@auth/surrealdb-adapter@2.2.3
Release @auth/surrealdb-adapter@2.2.3 updates its dependency on @auth/core. The release notes do not describe any direct adapter behavior changes, so the main upgrade consideration is whatever changes are included in the referenced @auth/core update.
@auth/typeorm-adapter@2.11.3
This release is primarily a dependency update for the Auth TypeORM adapter. It updates @auth/core to a newer revision (commit 8a933f95), which may include upstream changes in authentication behavior and bug fixes.
@auth/unstorage-adapter@2.11.3
This release updates the @auth/unstorage-adapter package to version 2.11.3. The only noted change in the release notes is a dependency bump of @auth/core to a new commit, with no additional behavior changes described.
@auth/upstash-redis-adapter@2.11.3
This release is primarily a dependency update, upgrading @auth/core as part of @auth/upstash-redis-adapter v2.11.3. No direct adapter feature changes, API changes, or behavioral notes are mentioned in the release notes.
@auth/xata-adapter@1.11.3
This release updates the @auth/xata-adapter package and includes a dependency bump for @auth/core. Release notes do not describe any functional changes, new features, or fixes beyond this dependency update.
@auth/solid-start@0.19.3
This release updates the underlying @auth/core dependency for @auth/solid-start. Release notes do not describe any direct API or behavior changes in solid-start itself, so you should review the corresponding @auth/core changes for potential functional impacts.
@auth/sveltekit@1.11.3
This release of @auth/sveltekit is a small maintenance update that bumps the @auth/core dependency. The release notes do not mention any direct API or behavior changes in @auth/sveltekit itself.
next-auth@4.24.14
next-auth@4.24.14 includes a focused fix for GitHub OAuth where GitHub now returns an `iss` claim, and openid-client was validating it in a way that could break sign-in for apps that did not set a GitHub `issuer`. The change documents setting the default GitHub provider issuer to `https://github.com/login/oauth` for RFC 9207 compliance.
@auth/sequelize-adapter@2.11.2
This release is a maintenance update for @auth/sequelize-adapter@2.11.2. The only change mentioned in the release notes is an update to its @auth/core dependency.
@auth/supabase-adapter@1.11.2
Release @auth/supabase-adapter@1.11.2 includes a single change, updating the @auth/core dependency. No API, behavior, or other functional changes are described in the release notes.
@auth/surrealdb-adapter@2.2.2
This release updates the adapter's dependency on @auth/core. No other user-facing changes, fixes, or breaking changes are described in the release notes.
@auth/typeorm-adapter@2.11.2
@auth/typeorm-adapter 2.11.2 primarily updates its dependency on @auth/core. No other functional changes, bug fixes, or breaking changes are described in the provided release notes.
@auth/unstorage-adapter@2.11.2
This release updates the internal dependency on @auth/core. No other user-facing changes, fixes, or breaking changes are described in the provided release notes.
@auth/upstash-redis-adapter@2.11.2
This release of @auth/upstash-redis-adapter is primarily a dependency update. No user-facing features, fixes, or breaking changes are described in the release notes.
@auth/xata-adapter@1.11.2
This is a patch release of @auth/xata-adapter that updates its dependency on @auth/core. No other user-facing changes are described in the release notes.
@auth/solid-start@0.19.2
This release of @auth/solid-start mainly updates its underlying dependency on @auth/core. No functional or API changes are described in the release notes for this version.
@auth/sveltekit@1.11.2
Release @auth/sveltekit 1.11.2 primarily updates its dependency on @auth/core. No functional or breaking changes are described in the release notes.