---
changelog:
  category: Release
  version: 3.0.0
date: '2026-09-24T23:58:41Z'
seo:
  description: >-
    OidcProviderStorageAdapter.getSessionByToken requires expiresAt (#334) —
    presence-based enforcement meant a lazy adapter returning { userId }
    silently skipped…
title: v3.0.0
type: changelog
---
## Breaking changes

- **`OidcProviderStorageAdapter.getSessionByToken` requires `expiresAt`** (#334) — presence-based enforcement meant a lazy adapter returning `{ userId }` silently skipped session expiry. Custom storage adapters must return `expiresAt` (ms).
- **Deprecated provider args removed** — `nativeEmailAndPassword` no longer accepts top-level `sendVerificationEmailOnSignUp`/`sendVerificationEmailOnSignIn`; use `email.sendOnSignUp`/`email.sendOnSignIn`.
- **`resolvePermissionOverride` adapter removed** — express permission variance as roles; `expandPermissions` is unchanged.
- **Session fallback removals** — `revokePasskeySessions` drops pre-`credentialId` compat (#337); session refresh no longer reads `identityId` from JWT claims (#373); `revokeSessionFamily` no longer matches `familyId`-less sessions (#374). Deploy the latest 2.x first if upgrading from < 2.5.x so live sessions backfill.
- **`path-to-regexp` v8** — advertised wildcard forms (`X/(.*)`, glued `X(.*)`) keep matching identically via internal translation to `{*splat}`; unnamed groups like `/(a|b)/` now throw a descriptive error at `createRouteMatcher` construction.
- **Stricter redirect validation** — the OAuth `signIn` action validates `callbackURL`/`errorURL`/`newUserURL` against the trusted-origins allowlist; protocol-relative URLs and `Sec-Fetch-Site` bypasses closed.
- **Landing verifier binding** — session-triple landings require the `__convexAuthLandingVerifier` cookie from the initiating browser; cross-browser landings get `?error=landing_verifier_mismatch` unless `requireLandingVerifier: false`.

Migration guide: `docs/(clients-and-migration)/v3-migration.md`

## Added

- **TanStack Start SSR adapter** — `@vortex-api/convex-auth/tanstack-start` (+ `/server`): app-origin HttpOnly cookie sessions, server-confidential refresh token, intent-based `/api/auth` proxy.
- **`@vortex-api/convex-auth/test`** — `register`, `convexAuthTest`, `modules`, `schema` for consumer `convex-test` harnesses; wired into the component conformance suite.
- **API keys** — `allowedIpRanges` on `issueApiKey`/`issueServiceOwnedApiKey` in the feature-gated component (parity with the monolith).

## Fixed

- `revokeOtherSessions` spares the caller's whole session family (`excludeFamilyId` on `revokeSessionsForUser`).
- Family revocation scoped to rotated-token replay — administrative revocation replays no longer nuke the family.
- SSR/auth hardening sweep — redirect allowlists, CSRF, CORS landings, response forwarding (7 issues).
- Index cleanup — 8 covered prefix indexes dropped (apply on next `convex dev`/`push`); creation-ordered list endpoints keep dedicated indexes.

Published with npm provenance (sigstore).