13 current findings across 33 models, verified against better-auth release notes. Latest better-auth at last verification: 1.7.3.
| Model | Stated cutoff | Attribution stops at | Lag |
|---|---|---|---|
| Claude Fable 5 | 2026-01 | 1.3.0 · 2025-07-19 | ~6 months |
| Claude Fable 5 | 2026-01 | 1.3.0 · 2025-07-19 | ~6 months |
| Claude Fable 5 | 2026-01 | 1.3.0 · 2025-07-19 | ~6 months |
| Claude Fable 5 | 2026-01 | 1.3.0 · 2025-07-19 | ~18 months |
| Claude Fable 5 | 2026-01 | 1.3.0 · 2025-07-19 | ~18 months |
| Claude Fable 5 | 2026-01 | 1.3.0 · 2025-07-19 | ~18 months |
| Claude Fable 5 | 2026-01 | 1.3.0 · 2025-07-19 | ~6 months |
| Claude Fable 5.1 | 2026-06 | 1.3.0 · 2025-07-19 | ~11 months |
| Claude Fable 5.1 | 2026-06 | 1.4.0 · 2025-11-22 | ~7 months |
| Claude Fable 5.1 | 2026-06 | 1.3.0 · 2025-07-19 | ~11 months |
| Claude Opus 5 | 2026-05 | 1.3.0 · 2025-07-19 | ~10 months |
| Claude Opus 5 | 2026-05 | 1.3.0 · 2025-07-19 | ~10 months |
| Claude Opus 5 | 2026-05 | 1.3.0 · 2025-07-19 | ~10 months |
| Claude Opus 5 | 2026-05 | 1.3.0 · 2025-07-19 | ~10 months |
| Claude Opus 5 | 2026-05 | 1.3.0 · 2025-07-19 | ~10 months |
| Claude Opus 5 | 2026-05 | 1.2.0 · 2025-03-01 | ~22 months |
| Claude Opus 5 | 2026-05 | 1.2.0 · 2025-03-01 | ~22 months |
| Claude Opus 5 | 2026-05 | 1.2.0 · 2025-03-01 | ~22 months |
| Claude Opus 5 | 2026-05 | 1.2.0 · 2025-03-01 | ~22 months |
| Claude Opus 5 | 2026-05 | 1.2.0 · 2025-03-01 | ~22 months |
| Claude Opus 5 | 2026-05 | 1.2.0 · 2025-03-01 | ~22 months |
| Claude Opus 5 | 2026-05 | 1.2.0 · 2025-03-01 | ~26 months |
| Claude Opus 5 | 2026-05 | 1.2.0 · 2025-03-01 | ~26 months |
| Claude Sonnet 5 | 2026-01 | 1.0.0 · 2024-11-23 | ~13 months |
| Claude Sonnet 5 | 2026-01 | 1.0.0 · 2024-11-23 | ~13 months |
| Claude Sonnet 5 | 2026-01 | 1.2.0 · 2025-03-01 | ~18 months |
| Claude Sonnet 5 | 2026-01 | 1.0.0 · 2024-11-23 | ~13 months |
| Claude Sonnet 5 | 2026-01 | 1.1.0 · 2024-12-01 | ~13 months |
| Claude Sonnet 5 | 2026-01 | 1.0.0 · 2024-11-23 | ~14 months |
Measured by asking each model what shipped in a given better-auth release, then checking the answer against the release timeline. Not inferred from the vendor’s cutoff date. This is the newest release the model can correctly place, not the newest better-auth feature it knows — a model past this point often uses a newer API correctly while naming the wrong release for it. Why that distinction matters.
Sorted by severity. “Chargeable” means the change was published before that model’s own stated cutoff, so the model had the opportunity to know it.
| Severity | Belief | Model | Changed in | Chargeable | Proof |
|---|---|---|---|---|---|
| S1breaks-build | Invents an at-rest storage option on the phone-number plugin, and ships phoneNumber({ storeOTP: 'hashed' }) as the fix for the threat-model rowphoneNumber({ storeOTP }) |
Claude Opus 5 | 1.3.0 2025-07-19 |
yes | source |
| S2silently-wrong | Asked to flag anything to know before shipping bearer-token auth, says nothing about the plugin accepting unsigned tokens by defaultbearer plugin |
Claude Sonnet 5 | 1.1.0 2024-12-20 |
yes | source |
| S2silently-wrong | States that better-auth offers no stateless, store-free session mode, and names cookieCache, Redis and the jwt plugin as the only optionsstateless / database-less sessions |
Claude Fable 5 | 1.4.0 2025-11-22 |
yes | source |
| S2silently-wrong | States that operating with no server-side session state is not what the library supports, which stopped being true in 1.4.0stateless session management |
Claude Fable 5 | 1.4.0 2025-11-22 |
yes | source |
| S2silently-wrong | Denies that better-auth can run with no session store at all, and sends the reader to Redis or the jwt plugin insteadstateless / database-less sessions |
Claude Opus 5 | 1.4.0 2025-11-22 |
yes | source |
| S2silently-wrong | Denies that better-auth can run with zero database, offering cookieCache and Redis insteadstateless / database-less sessions |
Claude Sonnet 5 | 1.4.0 2025-11-22 |
yes | source |
| S2silently-wrong | States that better-auth cannot run without a database-backed session store, which stopped being true in 1.4.0stateless session management |
Claude Sonnet 5 | 1.4.0 2025-11-22 |
yes | source |
| S2silently-wrong | Denies that baseURL can be anything but a static string, and routes a multi-domain deployment through a canonical auth host insteadbaseURL as a dynamic multi-host config |
Claude Opus 5 | 1.5.0 2026-03-01 |
yes | source |
| S2silently-wrong | Predicts the freshness check passes for a 30-hour-old session that was used two minutes ago, and names updatedAt as the anchor — the pre-1.6.0 semantics, held consistently across two taskssession.freshAge (measured from session.createdAt) |
Claude Fable 5.1 | 1.6.0 2026-04-06 |
yes | source |
| S2silently-wrong | Denies the email-OTP plugin has a resend-reuse option and rebuilds it out of generateOTP plus a Redis cache — under storeOTP: 'hashed', which is the one configuration in which the real option refuses to reuseemailOTP({ resendStrategy }) |
Claude Fable 5.1 | 1.6.0 2026-04-06 |
yes | source |
| S2silently-wrong | Denies the email-OTP plugin has a resend-reuse option and ships a Redis cache in front of generateOTP instead of resendStrategy: 'reuse'emailOTP({ resendStrategy }) |
Claude Opus 5 | 1.6.0 2026-04-06 |
yes | source |
| S3deprecated | Denies the two-factor client plugin takes a page option, names twoFactorPage correctly, and dates it to the pre-1.0 releases as something since removedtwoFactorClient({ twoFactorPage }) |
Claude Fable 5.1 | 1.6.0 2026-04-06 |
yes | source |
| S3deprecated | Denies the two-factor client plugin takes a page option — while naming twoFactorPage correctly and asserting it was removed rather than addedtwoFactorClient({ twoFactorPage }) |
Claude Opus 5 | 1.6.0 2026-04-06 |
yes | source |