npm / dexie
dexie
What changed in dexie 4, from its official release notes, upgrade guides and advisories. Also covers dexie-cloud-addon, dexie-export-import. Sources checked 2026-10-21.
1 breaking15 new APIs and options2 performance4 behavior and defaults23 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initdexie 445 changes
Breaking changes 1
Deleting a dotted key whose intermediate path is missing now does nothing instead of creating empty intermediate objects.
New APIs and options 15
Adds Facebook, LinkedIn, and Discord provider types.
The string offloading option is renamed from maxStringLength; the old name remains a backward-compatible alias.
Configure
blobMode: 'lazy'to download blobs on-demand instead of eagerly after sync; the default is 'eager'.An observable reports blob download progress.
Sets the string offloading threshold; the default is 32768 characters.
Adds a type for the /auth-providers endpoint response.
Configure whether social/OAuth authentication is enabled; it defaults to true, and setting it to false always uses the OTP flow.
Fetches available authentication providers from the server.
Login can specify an OAuth provider; without one, users see a provider selection dialog when providers are configured.
LoginHints accepts the Dexie Cloud authorization code from an OAuth callback.
Adds a type for OAuth provider metadata.
Set a custom OAuth callback redirect URI; it defaults to window.location.href for web SPAs.
LoginHints accepts an optional redirect path for the OAuth redirect URI.
Adds an experimental React hook for Suspense integration that suspends until data is available.
Adds an experimental React hook for Suspense integration.
Performance 2
Uses IndexedDB 3.0 getAll(options) for key range queries, reducing overhead for collection operations.
Dexie Cloud offloads long strings to blob storage during sync while retaining full strings in local IndexedDB and resolving them as regular strings on read.
Behavior and default changes 4
Anonymous users can download offloaded blobs; previously, they could not.
Blob and File objects are always offloaded regardless of size.
Dexie Cloud automatically offloads large binary data to cloud blob storage during sync; BlobRefs resolve to original types on first read.
The default login GUI adds provider selection and branded provider buttons when OAuth providers are available, with fallback to OTP when none are configured.
Fixes and other changes 23
Filtered chunked exports no longer produce invalid JSON when a later chunk contains no rows matching the active filter.
Tables new to a client are detected by comparing declared and persisted cloud schemas, marked for initial synchronization, and retain pending sync state until the server acknowledges completion.
Multiple updating-hook subscribers now reliably receive the record modifications object when using the minified production build.
Opening a database no longer fails when a primary key or index is named after an inherited Object property such as constructor, toString, or valueOf.
If the server rejects a locally unexpired refresh token, login falls back to the regular fetchTokens authentication path; OAuth redirect errors still propagate normally.
The TypeScript definition for Dexie.transaction() now includes the missing table4 parameter, aligning it with the other table parameters.
In cloned cache mode, query results are now deeply cloned on read, isolating them from in-place consumer mutations so subsequent live-queries can detect changes.
Blob writebacks now use BlobSavingQueue.saveBlobs() to open a Dexie read-write transaction in a fresh JS task, preventing PSD context loss after async fetch.
In immutable cache mode, sortBy() sorts on a copy rather than mutating a frozen array, avoiding a TypeError.
Applying a server-side $logins update now guards against empty changeSpec objects after key deletion, preventing an inline primary key from being overwritten with undefined.
Pending blobs are downloaded in chunks with a query limit, keeping memory usage bounded.
Blob fetch requests use cache: no-store to avoid browser caching of raw blob responses and double-storing them.
A request for a blob whose download has started but is not yet persisted reuses the existing download promise instead of starting another download.
Hot module replacement no longer breaks the Y.js awareness connection in development environments.
The primary key is stripped from changeSpecs in update mutations, preventing sync failures in certain edge cases.
Queries using anyOf(), each(), or ignore-case queries no longer fail on tables containing blobs, large binary data, or very long strings.
Calling this in a Service Worker context no longer crashes.
Logout preserves syncState, avoiding an unwanted loading spinner on re-login.
Server updates over websocket are no longer intermittently ignored.
Dexie.connections uses FinalizationRegistry, and Dexie enforces maxConnections.
Fixes rare circumstances where liveQuery could fail to emit values.
Avoids direct React.use access for React versions earlier than 19.
Fixes UTF-8 corruption for non-ASCII strings during import.