[dependabot]

Bumps @adonisjs/session from 7.7.1 to 8.3.0.

Release notes

Sourced from @​adonisjs/session's releases.

Support for @​adonisjs/redis v11 and store selection in configure

8.3.0 (2026-10-18)

This release adds support for @adonisjs/redis v11 and lets node ace configure set up the store of your choice.

@adonisjs/redis v11

The peer dependency now accepts @adonisjs/redis v11 (ioredis 6). v10 remains supported, so you can upgrade Redis on your own schedule.

Store selection in configure

node ace add @adonisjs/session used to always configure the cookie store. It now asks which store to use, or reads it from the --store flag.

node ace add @adonisjs/session --store=redis

• Supported stores: cookie, file, redis and database. DynamoDB must still be configured by hand.
• config/session.ts contains the selected store, and SESSION_DRIVER is set and validated as that store or memory.
• With database, the hook also creates the sessions table migration.
• Without --store, the command prompts for the store. Scripts that run it non-interactively must pass the flag.

Features

• prompt for the session store (ed57154)

Chores

• allow @​adonisjs/redis v11 as peer dependency (c62388d)

Safer sessions with overlapping requests and encrypted redis/database stores

8.2.0 (2026-10-17)

This release makes sessions more robust when requests from the same browser overlap: a logout, a regenerate() or a SessionCollection.destroy() that occurs while another request runs. Before, the late request could bring an ended session back.

With the default config, no behavior that apps rely on changes. The new protections that change visible behavior are opt-in.

What changes for everyone

• The redis, database, file and dynamodb stores do not write back a session that another request destroyed during the request.
• On redis and database, the write of a newly tagged session adds it to the user's sessions in the same operation (MULTI on standalone Redis, one query in SQL). A concurrent tagged() call can no longer drop it. On Redis Cluster, the store writes the data and then the tag, outside a transaction.
• The database store tag() no longer creates an empty row for a session that has no data.
• The japa api and browser client plugins write test sessions to the configured store, instead of always using the memory store. The cookie store still uses memory.

New options

• refreshCookie (default true): with false, the session cookie is sent only when the session id changes. A late response can then not put back an id the browser left. The cookie Max-Age is no longer refreshed, so use it with clearWithBrowser.
• renewMissingSessionId (default false): when the cookie names a session that the store does not have, the session gets a new id. The id of an ended session is never used again. A session without data then gets a new id on each request.
• encrypt on stores.redis() and stores.database() (default false): encrypts the session data with the encryption service, instead of only signing it. Existing sessions cannot be read after you enable it.

... (truncated)

Commits

• 0548a16 chore(release): 8.3.0
• ed57154 feat(configure): prompt for the session store
• c62388d chore: allow @​adonisjs/redis v11 as peer dependency
• e842848 chore(release): 8.2.0
• 088965c feat(session): make the new id for a missing session opt-in
• fc0a5ae fix(plugins): destroy the browser test session before close resolves
• 0ceb6cd fix(stores): report partial writes of a read session in the file store
• 8acfa72 fix(stores): do not replay the tag of a session read by the store
• 60d3e81 fix(plugins): give each test client call its own store
• e8fedf5 fix(plugins): read the response session when refreshCookie is false
• Additional commits viewable in compare view

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.