@supabase/auth-js 2.112.4-canary.2 → 2.112.4

package/migrations/lockless-coordination.md

@@ -1,6 +1,6 @@
 # Lockless auth coordination
 
-**Since:** v2.X.Y (update at release time)
+**Since:** v2.107.0
 **Action required by:** v3.0.0
 
 `@supabase/auth-js` now coordinates session refreshes without a shared mutex by default. The legacy `lock` option is still honored when supplied, but it is deprecated and will be removed in v3.
@@ -19,7 +19,7 @@
 
 **Callers passing a custom `lock`** (typically React Native `processLock`, Node multi-process setups with shared AsyncStorage, or a custom lock implementation):
 
-- v2.x (this release): your custom `lock` is still invoked exactly as before. The legacy `_acquireLock` machinery is preserved on an opt-in path gated by `settings.lock != null`. No code change required.
+- v2.x (since v2.107.0): your custom `lock` is still invoked exactly as before. The legacy `_acquireLock` machinery is preserved on an opt-in path gated by `settings.lock != null`. No code change required. Since v2.112.4 the client logs a one-time deprecation warning when a `lock` is supplied.
 - v3.0.0 (planned): the `lock` and `lockAcquireTimeout` options will be removed entirely. Drop them from your client options before upgrading to v3.
 
 ## New APIs worth knowing

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supabase/auth-js",
-  "version": "2.112.4-canary.2",
+  "version": "2.112.4",
   "private": false,
   "description": "Official SDK for Supabase Auth",
   "keywords": [

package/src/GoTrueClient.ts

@@ -230,6 +230,10 @@ async function lockNoOp<R>(name: string, acquireTimeout: number, fn: () => Promi
  */
 const GLOBAL_JWKS: { [storageKey: string]: { cachedAt: number; jwks: { keys: JWK[] } } } = {}
 
+// Warn once per JS realm, not per client instance — server-side apps can
+// construct many clients per process and must not be spammed.
+let deprecatedLockWarned = false
+
 export default class GoTrueClient {
   private static nextInstanceID: Record<string, number> = {}
 
@@ -457,6 +461,13 @@ export default class GoTrueClient {
     // by default, no implicit `processLock`.
     if (settings.lock != null) {
       this.lock = settings.lock
+
+      if (!deprecatedLockWarned) {
+        deprecatedLockWarned = true
+        console.warn(
+          `${this._logPrefix()} The "lock" option is deprecated and will be removed in v3. The client now coordinates session refreshes without a lock, so most apps can drop the option. See https://github.com/supabase/supabase-js/blob/master/packages/core/auth-js/migrations/lockless-coordination.md`
+        )
+      }
     }
 
     if (!this.jwks) {
@@ -4993,6 +5004,14 @@ export default class GoTrueClient {
     try {
       this.refreshingDeferred = new Deferred<CallRefreshTokenResult>()
 
+      // Only callers that arrive while this refresh is in flight await the
+      // deferred; the original caller is served by the `throw` in the catch
+      // below. Pre-attach a no-op rejection handler so a failing refresh with
+      // no concurrent callers cannot surface as an unhandled rejection —
+      // concurrent callers attach their own handlers via `.promise` and still
+      // observe the rejection.
+      this.refreshingDeferred.promise.then(undefined, () => {})
+
       // Snapshot storage before the fetch. The commit guard discards the
       // rotated tokens only when a non-null pre-fetch snapshot changed under
       // us — typical case: a concurrent `signOut` ran `_removeSession`, or

package/src/lib/version.ts

@@ -4,4 +4,4 @@
 // - Debugging and support (identifying which version is running)
 // - Telemetry and logging (version reporting in errors/analytics)
 // - Ensuring build artifacts match the published package version
-export const version = '2.112.4-canary.2'
+export const version = '2.112.4'