v3.0.0

Breaking changes

• OidcProviderStorageAdapter.getSessionByToken requires expiresAt (#334) — presence-based enforcement meant a lazy adapter returning { userId } silently skipped session expiry. Custom storage adapters must return expiresAt (ms).
• Deprecated provider args removed — nativeEmailAndPassword no longer accepts top-level sendVerificationEmailOnSignUp/sendVerificationEmailOnSignIn; use email.sendOnSignUp/email.sendOnSignIn.
• resolvePermissionOverride adapter removed — express permission variance as roles; expandPermissions is unchanged.
• Session fallback removals — revokePasskeySessions drops pre-credentialId compat (#337); session refresh no longer reads identityId from JWT claims (#373); revokeSessionFamily no longer matches familyId-less sessions (#374). Deploy the latest 2.x first if upgrading from < 2.5.x so live sessions backfill.
• path-to-regexp v8 — advertised wildcard forms (X/(.*), glued X(.*)) keep matching identically via internal translation to {*splat}; unnamed groups like /(a|b)/ now throw a descriptive error at createRouteMatcher construction.
• Stricter redirect validation — the OAuth signIn action validates callbackURL/errorURL/newUserURL against the trusted-origins allowlist; protocol-relative URLs and Sec-Fetch-Site bypasses closed.
• Landing verifier binding — session-triple landings require the __convexAuthLandingVerifier cookie from the initiating browser; cross-browser landings get ?error=landing_verifier_mismatch unless requireLandingVerifier: false.

Migration guide: docs/(clients-and-migration)/v3-migration.md

Added

• TanStack Start SSR adapter — @vortex-api/convex-auth/tanstack-start (+ /server): app-origin HttpOnly cookie sessions, server-confidential refresh token, intent-based /api/auth proxy.
• @vortex-api/convex-auth/test — register, convexAuthTest, modules, schema for consumer convex-test harnesses; wired into the component conformance suite.
• API keys — allowedIpRanges on issueApiKey/issueServiceOwnedApiKey in the feature-gated component (parity with the monolith).

Fixed

• revokeOtherSessions spares the caller’s whole session family (excludeFamilyId on revokeSessionsForUser).
• Family revocation scoped to rotated-token replay — administrative revocation replays no longer nuke the family.
• SSR/auth hardening sweep — redirect allowlists, CSRF, CORS landings, response forwarding (7 issues).
• Index cleanup — 8 covered prefix indexes dropped (apply on next convex dev/push); creation-ordered list endpoints keep dedicated indexes.

Published with npm provenance (sigstore).