s3rot0n1n · Nov 13, 2026 · Nov 13, 2026
diff --git a/.changeset/secure-cookie-defaults.md b/.changeset/secure-cookie-defaults.md
diff --git a/packages/billing/CHANGELOG.md b/packages/billing/CHANGELOG.md
@@ -1,5 +1,9 @@
 # @codelitdev/billing
 
+## 0.10.0
+
+No changes in this release.
+
 ## 0.9.0
 
 No changes in this release.

diff --git a/packages/billing/package.json b/packages/billing/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@codelitdev/billing",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Provider-neutral billing engine for CodeLit products",
   "author": "CodeLit",
   "type": "module",

diff --git a/packages/design-system/CHANGELOG.md b/packages/design-system/CHANGELOG.md
@@ -1,5 +1,9 @@
 # @codelitdev/design-system
 
+## 0.10.0
+
+No changes in this release.
+
 ## 0.9.0
 
 No changes in this release.

diff --git a/packages/design-system/package.json b/packages/design-system/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@codelitdev/design-system",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Shared CodeLit design tokens, Tailwind preset, and React primitives for CourseLit, MediaLit, SendLit, and FrontLit.",
   "license": "Apache-2.0",
   "author": "CodeLit",

diff --git a/packages/mcp-server-kit/CHANGELOG.md b/packages/mcp-server-kit/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @codelitdev/mcp-server-kit
 
+## 0.10.0
+
+### Patch Changes
+
+- @codelitdev/platform@0.10.0
+
 ## 0.9.0
 
 ### Patch Changes

diff --git a/packages/mcp-server-kit/package.json b/packages/mcp-server-kit/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@codelitdev/mcp-server-kit",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Stateless MCP 2026-07-28 endpoint, auth hooks, and error mapping for CodeLit products",
   "author": "CodeLit",
   "type": "module",
@@ -38,7 +38,7 @@
     "zod-to-json-schema": "^3.25.2"
   },
   "peerDependencies": {
-    "@codelitdev/platform": ">=0.9.0"
+    "@codelitdev/platform": ">=0.10.0"
   },
   "devDependencies": {
     "@codelitdev/platform": "workspace:*",

diff --git a/packages/oauth-server-kit/CHANGELOG.md b/packages/oauth-server-kit/CHANGELOG.md
@@ -1,5 +1,21 @@
 # @codelitdev/oauth-server-kit
 
+## 0.10.0
+
+### Minor Changes
+
+- 15e6f2c: Add hardened Better Auth defaults. `@codelitdev/oauth-server-kit/better-auth` exports `secureCookieOptions` (`__Host-` session cookies over https, `__Secure-` with cross-subdomain cookies, plain over http, optional client-IP header), `sessionCookieName`, `secureSessionOptions` (no session cookie cache), `secureEmailAndPasswordOptions` (password sign-up off; opting in also requires a verified email before sign-in) and `isRecentlyAuthenticated`. Session identities now carry `authenticatedAt`. `@codelitdev/oauth-server-kit/express` exports `parseTrustProxy`, `DEFAULT_TRUST_PROXY` and `createClientIpMiddleware`.
+
+  Requires Better Auth 1.7.16 or later (`better-auth` and `@better-auth/oauth-provider` peer floor `^1.7.16`; tested on 1.7.22), which carries fixes for GHSA-fvxx-76fc-893x, GHSA-2f9c-7xj7-gh55 and GHSA-9hm7-xhfp-cx58. A product's resource client must be bound to its real Better Auth instance (`options` and a `$context` resolving `baseURL`), as newer `@better-auth/oauth-provider` requires.
+
+  **Product changes for this release**
+
+  - Upgrade `better-auth` and every `@better-auth/*` package together (1.7.22 needs `@better-auth/utils` 0.5.1, `better-call` 1.4.5 and `@better-fetch/fetch` 1.3.3; mismatched copies break plugin types). If your database ran Better Auth 1.7.0–1.7.2, make `account.issuer` nullable and drop `account_issuer_accountId_uidx` (see Better Auth's 1.7 upgrade guide).
+
+  - Spread `secureCookieOptions({ baseURL, cookiePrefix, clientIpHeader })` into `advanced`, `secureSessionOptions()` into `session`, and set `emailAndPassword: secureEmailAndPasswordOptions()`. Switching to `__Host-` renames the session cookie, so users sign in once more; select credentials with `sessionCookieName(advanced)`.
+  - Set `app.set("trust proxy", parseTrustProxy(process.env.TRUST_PROXY))` and mount `createClientIpMiddleware` before Better Auth's handler.
+  - Under `__Host-` the OAuth provider's RP-initiated logout confirmation cookie is rejected by browsers; use cross-subdomain mode if you need that step.
+
 ## 0.9.0
 
 No changes in this release.

diff --git a/packages/oauth-server-kit/package.json b/packages/oauth-server-kit/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@codelitdev/oauth-server-kit",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Lean Better Auth OAuth authentication framework for web, mobile, REST, and MCP surfaces.",
   "author": "CodeLit",
   "license": "MIT",

diff --git a/packages/observability/CHANGELOG.md b/packages/observability/CHANGELOG.md
@@ -1,5 +1,9 @@
 # @codelitdev/observability
 
+## 0.10.0
+
+No changes in this release.
+
 ## 0.9.0
 
 No changes in this release.

diff --git a/packages/observability/package.json b/packages/observability/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@codelitdev/observability",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Provider-neutral logging and optional telemetry for CodeLit products",
   "author": "CodeLit",
   "type": "module",

diff --git a/packages/platform-cli/CHANGELOG.md b/packages/platform-cli/CHANGELOG.md
@@ -1,5 +1,9 @@
 # @codelitdev/platform-cli
 
+## 0.10.0
+
+No changes in this release.
+
 ## 0.9.0
 
 No changes in this release.

diff --git a/packages/platform-cli/package.json b/packages/platform-cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@codelitdev/platform-cli",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Create, check, and sync CodeLit Platform products",
   "author": "CodeLit",
   "type": "module",

diff --git a/packages/platform-cli/src/preset.json b/packages/platform-cli/src/preset.json
@@ -5,42 +5,42 @@
   },
   "packages": {
     "@codelitdev/platform": {
-      "recommended": "0.9.0",
+      "recommended": "0.10.0",
       "supported": ">=0.1.0-alpha.0 <2",
       "minimumSecure": "0.1.0-alpha.0"
     },
     "@codelitdev/observability": {
-      "recommended": "0.9.0",
+      "recommended": "0.10.0",
       "supported": ">=0.1.0-alpha.0 <2",
       "minimumSecure": "0.1.0-alpha.0"
     },
     "@codelitdev/mcp-server-kit": {
-      "recommended": "0.9.0",
+      "recommended": "0.10.0",
       "supported": ">=0.1.0-alpha.0 <2",
       "minimumSecure": "0.1.0-alpha.0"
     },
     "@codelitdev/platform-conformance": {
-      "recommended": "0.9.0",
+      "recommended": "0.10.0",
       "supported": ">=0.1.0-alpha.0 <2",
       "minimumSecure": "0.1.0-alpha.0"
     },
     "@codelitdev/platform-cli": {
-      "recommended": "0.9.0",
+      "recommended": "0.10.0",
       "supported": ">=0.1.0-alpha.0 <2",
       "minimumSecure": "0.1.0-alpha.0"
     },
     "@codelitdev/billing": {
-      "recommended": "0.9.0",
+      "recommended": "0.10.0",
       "supported": ">=0.1.0-alpha.4 <1",
       "minimumSecure": "0.1.0-alpha.4"
     },
     "@codelitdev/oauth-server-kit": {
-      "recommended": "0.9.0",
+      "recommended": "0.10.0",
       "supported": ">=0.1.0-alpha.2 <1",
       "minimumSecure": "0.1.0-alpha.2"
     },
     "@codelitdev/design-system": {
-      "recommended": "0.9.0",
+      "recommended": "0.10.0",
       "supported": ">=0.1.0-alpha.7 <1",
       "minimumSecure": "0.1.0-alpha.7"
     }

diff --git a/packages/platform-conformance/CHANGELOG.md b/packages/platform-conformance/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @codelitdev/platform-conformance
 
+## 0.10.0
+
+### Patch Changes
+
+- @codelitdev/platform@0.10.0
+
 ## 0.9.0
 
 ### Patch Changes

diff --git a/packages/platform-conformance/package.json b/packages/platform-conformance/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@codelitdev/platform-conformance",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Shared HTTP conformance suites for CodeLit Platform products",
   "author": "CodeLit",
   "type": "module",
@@ -37,7 +37,7 @@
     "tag": "latest"
   },
   "peerDependencies": {
-    "@codelitdev/platform": ">=0.9.0"
+    "@codelitdev/platform": ">=0.10.0"
   },
   "devDependencies": {
     "@codelitdev/platform": "workspace:*",

diff --git a/packages/platform/CHANGELOG.md b/packages/platform/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @codelitdev/platform
 
+## 0.10.0
+
+### Patch Changes
+
+- @codelitdev/billing@0.10.0
+
 ## 0.9.0
 
 ### Minor Changes

diff --git a/packages/platform/package.json b/packages/platform/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@codelitdev/platform",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Composition kernel for CodeLit Platform products",
   "author": "CodeLit",
   "type": "module",
@@ -56,7 +56,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@codelitdev/billing": ">=0.9.0",
+    "@codelitdev/billing": ">=0.10.0",
     "drizzle-orm": "^0.45.2"
   },
   "peerDependenciesMeta": {