# Better Auth 1.7.16 security fix and dependency round

Better Auth 1.7.16 closes a critical account takeover through the Expo authorization proxy, the iPhone Duo tab bar becomes a rail, and the dependency round brings Effect 4.1, Takumi 2.19, oRPC beta.48 and Expo SDK 58.0.23 patches.

Better Auth moves to 1.7.16. Its `expo()` plugin, which the template registers for the native app, exposed an authorization proxy that signed a value taken from the request with the application secret (GHSA-4wq4-2ppv-q3hg, critical): anyone who knew an account's email address could forge a verification link and sign in as that user. The same release stops an organization admin from inviting an owner through a role name with extra whitespace (GHSA-c85h-5mrr-mgx4). The other ten advisories of that release need plugins or options the template does not use. The release was under two days old, so its exact versions sit in `minimumReleaseAgeExclude` until 2026-11-05 21:24 UTC. A project created from the template that has been deployed should upgrade and then rotate `BETTER_AUTH_SECRET`; with users and two-factor enabled, pass the new secret in `secrets` and keep the old one as `BETTER_AUTH_SECRET`, so stored TOTP secrets still decrypt.

On iPhone Duo, built with the iOS 27.1 SDK, the native tabs become a vertical rail beside the content when the device is folded or open in landscape. Screens read the rail from the side safe-area insets and stop reserving space for a bottom bar, the bar is no longer cleared twice when the safe area already reaches it, and the app imports `NativeTabs` from the stable `expo-router/native-tabs` path.

The dependency round moves Expo to the SDK 58.0.23 patches, Effect to 4.1.2 (the ADR-0006 fault gate gives the same result as 4.0.6), Takumi to 2.19.0 with a new `OG_VERSION`, oRPC to 2.0.0-beta.48, TanStack AI to 1.0.1, TanStack Query to 5.105.3, wrangler to 4.156.1 and a set of patch releases. The Worker is 78 KiB gzip larger.

- [Libraries](/docs/libraries)
- [Mobile app](/docs/features/mobile)

Sources: [Better Auth 1.7.16](https://github.com/CarlosZiegler/template-cloudflare/commit/26675533), [Expo patches](https://github.com/CarlosZiegler/template-cloudflare/commit/18dafe6c), [iPhone Duo rail](https://github.com/CarlosZiegler/template-cloudflare/commit/d16fe38d), [Effect 4.1.2](https://github.com/CarlosZiegler/template-cloudflare/commit/e0bb5fb8), [Takumi 2.19](https://github.com/CarlosZiegler/template-cloudflare/commit/21f5903f).