[dowski]

When a user resets their password, by default their other sessions will be revoked. This is optional and an app can choose to present a UI to give the user the choice or set its own value.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
auth-v2	Ready	Preview	Oct 27, 2026 3:32pm UTC

1 Skipped Deployment

Project	Deployment	Actions	Updated
convex-auth-docs	Ignored		Oct 27, 2026 3:32pm UTC

[dowski]

• Session revocation support for password reset #775 👈 (View in Graphite)
• Session revocation support #759 : 3 other dependent PRs (#760 , #779 , #783 )
• Move to stateful session auth #757
• Remove the sessions.lastRefreshedAt field #758
• reboot

This stack of pull requests is managed by Graphite. Learn more about stacking.

[pkg-pr-new]

npm i https://pkg.pr.new/@convex-dev/auth@775

commit: da882d6

[cubic-dev-ai]

1 issue found across 8 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/core/src/methods/email-password/server.ts">

<violation number="1" location="packages/core/src/methods/email-password/server.ts:602">
P1: This revokes sessions only for `changePassword`; `completePasswordRecovery` still changes the password and mints a session without revoking existing sessions. Revoke all pre-existing sessions in the recovery path before minting the replacement session, so a stolen refresh token cannot survive an email password reset.</violation>
</file>

<sub>Tip: Get a Slack DM when cubic finishes reviewing your PRs. Connect Slack

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: This revokes sessions only for changePassword; completePasswordRecovery still changes the password and mints a session without revoking existing sessions. Revoke all pre-existing sessions in the recovery path before minting the replacement session, so a stolen refresh token cannot survive an email password reset.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At packages/core/src/methods/email-password/server.ts, line 602:

<comment>This revokes sessions only for `changePassword`; `completePasswordRecovery` still changes the password and mints a session without revoking existing sessions. Revoke all pre-existing sessions in the recovery path before minting the replacement session, so a stolen refresh token cannot survive an email password reset.</comment>

<file context>
@@ -592,6 +596,13 @@ export function setupEmailPassword<UsersTable extends string>(
+            // The current password was just verified, so the caller owns this
+            // session: sign out the user's other sessions, which may belong to
+            // whoever knew the old password.
+            if (signOutOtherSessions) {
+              await ctx.convexAuth.revokeOtherSessions();
+            }
</file context>

[dowski]

That's in another PR.