fix(core) merge function does not handle all cases correctly

[magom001]

☕️ Reasoning

🧢 Checklist

• Documentation
• Tests
• Ready to be merged

🎫 Affected issues

const target = {
      sessionToken: {
        name: "authjs.session-token",
        options: {
          httpOnly: true,
          sameSite: "lax",
          path: "/",
          secure: false,
        },
      }
}

const source = {
      sessionToken: {
        options: {
          expires: new Date("2024-01-01T00:00:00Z"),
        },
      }
}

// Call
merge(target, source)

const expected = {
      sessionToken: {
        name: "authjs.session-token",
        options: {
          httpOnly: true,
          sameSite: "lax",
          path: "/",
          secure: false,
          expires: source.sessionToken.options.expires,
        },
      }
}

// Actual result
 Object {
    "sessionToken": Object {
      "name": "authjs.session-token",
      "options": Object {
-       "expires": 2024-01-01T00:00:00.000Z,
+       "expires": Object {},
        "httpOnly": true,
        "path": "/",
        "sameSite": "lax",
        "secure": false,
      },
    },
  }

This bug leads to crash when setting

cookies: {
    sessionToken: {
        options: {
            expires: new Date('...')
        }
    }
}

See the first added unit test for a repro.

📌 Resources

• Security guidelines
• Contributing guidelines
• Code of conduct
• Contributing to Open Source

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
auth-docs	Ready	Preview	Comment	Sep 28, 2025 8:43am

1 Skipped Deployment

Project	Deployment	Preview	Comments	Updated (UTC)
next-auth-docs	Ignored	Preview		Sep 28, 2025 8:43am

[vercel]

@magom001 is attempting to deploy a commit to the authjs Team on Vercel.

A member of the Team first needs to authorize it.

[magom001]

I believe the faulty merge implementation is causing this bug when I set the expires property on the cookies options

[magom001]

@ThangHuuVu maybe using an external dependency (like https://github.com/fastify/deepmerge) is more appropriate for this case.

[github-actions]

Broken Link Checker

1 broken links found. Links organised below by source page, or page where they were found.

1) /getting-started/migrate-to-better-auth

Target Link	Link Text
/docs	"documentation"