Fixed session cleanup on user deletion to also remove sessions from secondary storage (#10520)
Fixed findSessions to skip invalid secondary-storage session entries without discarding other valid sessions (#10580)
Fixed email OTP sign-up to pass the verification type to custom OTP generators (#10608)
Fixed email OTP password reset to allow retrying after entering an invalid password (#10552)
Fixed email OTP verification to no longer reveal whether an email is registered before the OTP is verified (#10605)
Fixed jwtClient() collapsing createAuthClient type inference when combined with other client plugins (#10513)
Fixed JWT key minting inside database transactions to use the transaction-scoped adapter, preventing deadlocks on SQLite and ensuring keys commit with their surrounding transaction on Postgres and MySQL (#10623)
Fixed oAuthProxy to preserve Apple user data from form_post callbacks (#10599)
Fixed oneTapClient() collapsing createAuthClient type inference when combined with other client plugins (#10635)
Fixed database rate-limit cleanup to complete when no background task handler is configured (#10619)
Improved nextCookies performance in instrumented Next.js applications by reusing the next/headers import promise (#10467)
#7961697ebb6 - Prevent a blank frame before zero-delay initial pending UI by using a
component-scoped React transition for match publication. Pending timing,
boundary selection, and rendered matches continue to come from the router
core.
#79702435885 - createFileRoute does not rely on FileRoute class
#797186bf510 - clean intersection observer options in link component
#79676aefb33 - Preserve path params in their raw string form while matching routes so structured values returned by params.parse produce stable match IDs and do not reuse stale loader data.
RouterCore.getMatchedRoutes() now returns [matchedRoutes, rawParams, foundRoute] instead of an object.
#780545c4ad8 - Rewrite match loading around a lane-based scheduler that tracks each navigation, preload, and background reload as an ordered unit of work. This fixes pending/redirect/retry state leaking between overlapping navigations, restores correct SSR status codes for redirects, errors, and not-found responses, and closes hydration gaps where the client re-ran work the server had already completed.
Invalidation now retires matching active preloads so older speculative loader results cannot become fresh cache data after invalidation.
Route headers() now only runs on the server, matching the documented behavior — it is no longer invoked during client-side asset projection.
The documented default gcTime and preloadGcTime now match the existing runtime default of 5 minutes (300_000).
Removed / changed exported internals
RouterState no longer includes loadedAt, isTransitioning, statusCode, or redirect. Use match.updatedAt in place of loadedAt; subscribe to router.state.status / router.state.isLoading in place of isTransitioning; server response status and redirect handling are now internal to the server loader and are no longer exposed on router.state.
RouteMatch.fetchCount has been removed, with no replacement — it was purely informational.
RouteMatch.status no longer includes 'redirected' (it remains 'pending' | 'success' | 'error' | 'notFound') — redirected matches are dropped from the match list instead of being rendered.
RouteMatch.globalNotFound has been renamed and privatized to the internal _notFound field. Use match.status === 'notFound' instead.
The exported React, Solid, and Vue Match components now accept routeId instead of matchId.
The exported RouterStores adapter contract now uses route-keyed presentation stores: matchesId is replaced by ids, matchStores by byRoute, and getRouteMatchStore() by getMatchStore(). The separate loadedAt, isLoading, isTransitioning, statusCode, and redirect stores have been removed, along with the pending/cache stores and their setters. StoreConfig.init has also been removed. Read application-facing state from router.state; preload and cache coordination are now internal.
Removed RouterCore members getMatch(), updateMatch(), cancelMatch(), and cancelMatches() — read matches from router.state.matches (e.g. router.state.matches.find((m) => m.id === id)); there is no replacement for mutating or cancelling an individual in-flight match from outside the router.
Removed RouterCore.hasNotFoundMatch() — use router.state.matches.some((m) => m.status === 'notFound').
Removed RouterCore.looseRoutesById — use routesById.
Removed RouterCore.isPrerendering(), RouterCore.isViewTransitionTypesSupported, and RouterCore.viewTransitionPromise, with no replacement.
Removed RouterCore.getParsedLocationHref() and RouterCore.clearExpiredCache(), with no replacement — expired cache entries are now reconciled automatically as part of match commit.
Removed RouterCore.latestLoadPromise and RouterCore.beforeLoad(), with no replacement.
Fixed session cleanup on user deletion to also remove sessions from secondary storage (#10520)
Fixed findSessions to skip invalid secondary-storage session entries without discarding other valid sessions (#10580)
Fixed email OTP sign-up to pass the verification type to custom OTP generators (#10608)
Fixed email OTP password reset to allow retrying after entering an invalid password (#10552)
Fixed email OTP verification to no longer reveal whether an email is registered before the OTP is verified (#10605)
Fixed jwtClient() collapsing createAuthClient type inference when combined with other client plugins (#10513)
Fixed JWT key minting inside database transactions to use the transaction-scoped adapter, preventing deadlocks on SQLite and ensuring keys commit with their surrounding transaction on Postgres and MySQL (#10623)
Fixed oAuthProxy to preserve Apple user data from form_post callbacks (#10599)
Fixed oneTapClient() collapsing createAuthClient type inference when combined with other client plugins (#10635)
Fixed database rate-limit cleanup to complete when no background task handler is configured (#10619)
Improved nextCookies performance in instrumented Next.js applications by reusing the next/headers import promise (#10467)
Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.
Summary by cubic
Upgrade dependencies across the repo to pick up bug fixes, TypeScript 7, and routing/tooling improvements. These are minor/patch updates; no app-level behavior changes expected.
![View with [code]smith](https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v2.svg)
![Autofix with [code]smith](https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg)