Passport deserializeUser and stale session data: is there a supported way to refresh the cached user object?

Goal

I want a Passport.js (0.5.x-era session API) application to serve up-to-date user data on every request, even when the underlying database record changes after login. Passport stores whatever serializeUser writes into the session and calls deserializeUser once per request, but as far as the documented API goes there is no built-in mechanism to invalidate or refresh that cached object when the record is updated.

Constraints and uncertainty

The concern is practical: role or permission changes, account suspension, or profile edits should take effect without forcing the user to log out and back in. Re-querying the database inside deserializeUser on every request works conceptually, but adds a query per request and it is unclear whether this is the intended pattern or merely a workaround for a missing feature. With a shared session store such as Redis, stale serialized data could also persist indefinitely without a TTL.

Community discussions mention this gap, but I have not found a documented strategy option, middleware hook, or configuration flag in Passport itself that addresses automatic refresh.

Questions

• Does Passport expose any supported option or extension point for refreshing the deserialized user when the database record changes, or is a custom deserializeUser re-query the only sanctioned approach?
• If re-querying per request is the accepted pattern, are there documented performance or consistency guidelines for high-traffic applications?
• Is there any roadmap or open proposal for built-in stale-session handling worth tracking?