Findings No. 42
A Better Auth minor release turned on a feature our schema could not support, and the Drizzle adapter stayed quiet
Better Auth 1.6 enabled account lockout by default. Its columns were missing, the Drizzle adapter dropped the unknown keys, and 2FA ran UPDATE with an empty SET clause.
A minor-version upgrade can change what a library does by default, and when that new default needs database columns you do not have, an adapter may hide the problem instead of reporting it.
Better Auth 1.6.x enabled account lockout by default. Lockout reads and writes three two_factor columns (verified, failed_verification_count, lockedUntil) that Replicator's schema never declared. The Drizzle adapter did not raise an error about the missing columns. It dropped the unknown keys from the statement it generated, leaving an update ... set where ... with an empty SET clause, and production logs filled with SQL_PARSE_ERROR on every two-factor verification. Nothing in our own code had changed.
The fix added the three columns to the two_factor schema, migrated the database, and backfilled existing rows with verified=1, failed_verification_count=0 and lockedUntil=null so current users were not locked out by the new feature.
The general rule: semver-minor does not guarantee additive-only behaviour. For any library that owns tables in your database, treat a minor bump as a possible schema change and diff its expected schema before shipping.
Receipt: Replicator v3.107.1 (two_factor table; FINDINGS.md, "Auth and sessions").