Better Auth moves to 1.7.16. Its expo() plugin, which the template registers for the native app, exposed an authorization proxy that signed a value taken from the request with the application secret (GHSA-4wq4-2ppv-q3hg, critical): anyone who knew an account's email address could forge a verification link and sign in as that user. The same release stops an organization admin from inviting an owner through a role name with extra whitespace (GHSA-c85h-5mrr-mgx4). The other ten advisories of that release need plugins or options the template does not use. The release was under two days old, so its exact versions sit in minimumReleaseAgeExclude until 2026-11-05 21:24 UTC. A project created from the template that has been deployed should upgrade and then rotate BETTER_AUTH_SECRET; with users and two-factor enabled, pass the new secret in secrets and keep the old one as BETTER_AUTH_SECRET, so stored TOTP secrets still decrypt.
On iPhone Duo, built with the iOS 27.1 SDK, the native tabs become a vertical rail beside the content when the device is folded or open in landscape. Screens read the rail from the side safe-area insets and stop reserving space for a bottom bar, the bar is no longer cleared twice when the safe area already reaches it, and the app imports NativeTabs from the stable expo-router/native-tabs path.
The dependency round moves Expo to the SDK 58.0.22 patches, Effect to 4.1.2 (the ADR-0006 fault gate gives the same result as 4.0.6), Takumi to 2.19.0 with a new OG_VERSION, oRPC to 2.0.0-beta.48, TanStack AI to 1.0.1, wrangler to 4.156.1 and a set of patch releases. The Worker is 78 KiB gzip larger.
Sources: Better Auth 1.7.16, Expo patches, iPhone Duo rail, Effect 4.1.2, Takumi 2.19.