The auth ecosystem in July 2026
Three changes reshaped the TypeScript authentication landscape in July 2026. Vercel acquired Better Auth and hired its core team. Pilcrow deprecated Arctic and most Oslo packages, narrowed Lucia to the code needed to replace its former npm package, archived Lucia's examples, and announced that the Lucia project Discord will close by the end of the year. None of these events makes existing applications stop working. Together, they make project ownership and maintenance status impossible to treat as background details.
Better Auth changed ownership
Vercel announced the Better Auth acquisition on 7 July. Founder Bereket Engida and the core team joined Vercel to continue work on Better Auth and agent identity. Better Auth's own announcement says Vercel provides more resources for the open-source framework and for authentication primitives used by agents acting on behalf of users.
The published commitments are explicit. Better Auth remains free and open source under MIT, keeps its name, and continues with the same team, open contribution model, community governance, and framework support. Better Auth also says Vercel shares its commitment to framework and platform agnosticism. Claims that the project has already become Next.js-only or abandoned application authentication are not supported by either announcement.
The change is governance. Product direction is now set inside Vercel, and agent identity is a stated investment area. Developers can watch how the public commitments appear in releases, adapter maintenance, accepted contributions, security fixes, and migration documentation. That is a structural review, not a judgment about the library's current technical quality.
Lucia and Arctic became replacement resources
Lucia's npm package had already been deprecated in March 2025. Its July update reduces the site and repository to the documentation and single-file session code needed to replace Lucia v3. The maintained deliverable is no longer an installable authentication package. Teams using Lucia can keep the replacement code in their application and take responsibility for its future changes.
Arctic's July deprecation affects a different layer. Arctic provided OAuth 2.0 clients for many providers. Its site now publishes commented replacement examples for authorization requests, code exchange, refresh, and revocation. Applications that used Lucia for sessions and Arctic for provider authentication therefore have two separate transitions to evaluate: copied session code and copied or replacement OAuth integration.
The community boundary is also narrower. Pilcrow says Lucia's project Discord will close by the end of 2026, while the Lucia and Arctic sites point broader authentication questions to the separate Auth Book community. Documentation remains available, but the package-specific support channel has a defined end date.
Maintenance status belongs in architecture review
An auth dependency holds a long-lived place in an application. Its schema becomes the source of user and session identifiers. Its cookies and callback routes shape browser behavior. Password hashes, provider accounts, organisation memberships, and active sessions determine the cost of moving later. A project can remain legally usable after deprecation while becoming operationally expensive to keep current.
License, maintenance, and completeness answer different questions. A permissive license protects the right to run and modify existing code. Active maintenance supplies releases and security fixes. Feature scope determines how many adjacent packages or custom implementations the application must coordinate. No one property substitutes for the other two.
Framework independence must be demonstrated
Framework-agnostic should describe an integration boundary, not a tagline. The server API should work wherever the application can receive an HTTP request, return a response, and access its database. Framework adapters can improve ergonomics, but the authentication model should not require one router, rendering system, or deployment provider.
This matters beyond Next.js. Express, Fastify, Hono, Astro, SolidStart, SvelteKit, Nuxt, Remix, and AdonisJS expose different request lifecycles and deployment targets. A credible auth package documents where its handler mounts, how sessions reach protected routes, and which code remains framework-specific for each one.
Where Own Auth fits
Own Auth is an MIT-licensed TypeScript package that runs in the application backend. Version 0.3.6 includes passwords, magic links, phone login, database sessions, Google, GitHub, and Apple OAuth, organisations, roles, invitations, application API keys, rate limits, and audit events. Applications can call its server methods or mount its Web Request and Response handler in supported frameworks.
That scope is one option in the current landscape, not proof against future project risk. Teams should apply the same review: confirm the installed version and license, inspect the source, map the schema and identifiers, test migrations, record every integration point, and verify that the frameworks and features they use appear in current documentation. July 2026 made those checks timely; they were always part of choosing authentication infrastructure.