---
changelog:
  category: Release
  version: 2.5.1
date: '2026-09-22T18:23:54Z'
seo:
  description: >-
    Add a Next.js SSR adapter with HttpOnly cookie sessions. New:
    packages/auth/src/nextjs exports the App Router surface — a route-handler
    proxy (/api/auth)…
title: convex-auth v2.5.1
type: changelog
---
## Minor Changes

### Next.js SSR adapter — #343

Add a Next.js SSR adapter with HttpOnly cookie sessions.

- **New:** `packages/auth/src/nextjs` exports the App Router surface — a route-handler proxy (`/api/auth`), middleware for protected routes and proactive refresh, server-side session reads, and server-action support. Sessions live in HttpOnly cookies; tokens never reach client JS.
- **Demo:** `examples/nextjs` is a working App Router app verified end-to-end against a local Convex deployment.
- SSR renders verify the session server-side and fail closed: expired or revoked sessions redirect to sign-in instead of flashing authenticated UI.

## Patch Changes

### Session-rotation convergence — #343

- Two parallel requests presenting the same refresh token (the normal SSR pattern) no longer destroy the session. `rotateSession` marks `rotatedAt` and reports `"converge"` inside a 15s grace window; `convergeSession` mints a bounded sibling session+refresh pair in the same family. Bounds: ≤8 grace redemptions per predecessor, ≤10 live sessions per family, convergence requires a live member.
- `updateSession` now resolves the session's identity — OAuth/passkey sessions refresh correctly. `authSessions` gains `identityId`; `authRefreshTokens` gains `rotatedAt`/`graceRedemptions`.

### Family-aware revocation — #349, #344

- `signOut`, `stopImpersonation`, user-facing `revokeSession`, and admin `revokeSession` all revoke the whole session family. `revokeSessionsForUser` now marks revoked sessions' refresh tokens too.
- Audit: `session.sign_out` (voluntary), `session.revoke` (sessions-list), `refresh_token_reuse` (replay detection) — admin actions stay on `auth_admin_audits`.

### Published package fix — #345 (thanks [@david-potgieter](https://github.com/david-potgieter))

- The `files` allowlist shipped only a handful of `convex-runtime` modules — installs failed with `Could not resolve "./convexAuth.js"` and friends. The tarball now ships the full `src/convex-runtime/**` tree; `convex`/`types` export conditions point at `src/convex-runtime/index.ts`.