v2.0.0

v2.0.0 is the next major release, mostly because @teamhanko/hanko-elements moves from v1 to v3. It also adds Nuxt 5 support and an opt-in global middleware.

👀 Highlights

🎉 Nuxt 5 support

The module now works on both Nuxt 4 and Nuxt 5 (#511). Server code is resolved per major version: on Nuxt 5 it imports from nuxt/server and registers the context middleware with an explicit /** route, as Nitro v3 requires. On Nuxt 4 the existing h3 based path is unchanged.

🔒 Global middleware

globalMiddleware makes every page require a logged in user by default (#163, thanks to @felixdolderer!):

export default defineNuxtConfig({
  hanko: {
    globalMiddleware: true,
  },
})

Pages opt out through page meta, with either allow or deny:

definePageMeta({
  hanko: {
    allow: 'all', // or 'logged-in' | 'logged-out'
    // deny: 'logged-in' | 'logged-out'
  },
})

Middleware is assigned at build time, so a page that already sets hanko-logged-in or hanko-logged-out in middleware keeps it and its hanko page meta is ignored. It applies to pages only; it adds no checks to your API routes.

It is off by default, so existing apps are unaffected.

🚨 Breaking changes

@teamhanko/hanko-elements v3

The module dependency is now ^3.0.0 (#355, thanks to @Harm-Nullix). hanko-elements v3 uses the newer flow-based Hanko API, so make sure to upgrade any self-hosted deployment before updating the module. (You do not need to do this if you are on Hanko Cloud.)

useHanko() returns a different Hanko shape

The instance is still a Hanko from @teamhanko/hanko-elements, but its methods have moved from sub-clients onto the top-level class:

  const hanko = useHanko()
- await hanko!.user.getCurrent()
+ await hanko!.getCurrentUser()

- await hanko!.user.logout()
+ await hanko!.logout()

Session helpers moved too: hanko.validateSession() and hanko.getSessionToken() replace the hanko.session.* calls. The user, session, webauthn, email, thirdParty, config, token and enterprise sub-clients are no longer public API.

The built-in hanko-logged-in and hanko-logged-out middleware are already updated, so if you only use those there is nothing to do.

onSessionCreated payload changed

The event detail is now { claims, expirationSeconds } rather than { jwt, userID, expirationSeconds }:

- hanko.onSessionCreated(({ userID }) => { /* ... */ })
+ hanko.onSessionCreated(({ claims }) => { /* claims.subject */ })

useHanko() is memoised per Nuxt app

useHanko() used to construct a new Hanko on every call, so each call site started its own session-validation polling. It now creates the instance once per Nuxt app and reuses it. On the server it still returns null, and nothing is cached across requests.

👉 Changelog

compare changes

🚀 Enhancements

• add globalMiddleware option to guard all pages by default (#163)
• support nuxt v5 + add tests (#511)
• ⚠️ deps: update @teamhanko/hanko-elements to v3 (#355)

🩹 Fixes

• type <hanko-login>, <hanko-registration> + <hank-auth> props (4676f64)

🏡 Chore

• remove prettier config (fa402cc)

🤖 CI

• run on merge groups (a6afe17)
• use pnpm/setup and devEngines (#503)
• add explicit permissions (445734e)
• migrate agentscan-action to v2 (2a4632c)
• add agent-scan workflow to flag bot-authored PRs (5e16eb1)

🎉 New Contributors

• Harm Zeinstra (@Harm-Nullix)

❤️ Contributors

• Daniel Roe (@danielroe)
• Felix Dolderer (@felix-dolderer)
• Harm Zeinstra (@Harm-Nullix)