[m0tzy]

Summary

Bumps @workos/authkit-session from ^0.8.0 to ^0.9.1. This pulls in the optional issuer check (0.9.0) and the change that rejects non-user access tokens in session cookies (0.9.1). See the authkit-session changelog.

No adapter code changes. Locally, typecheck, lint, test (308 tests) and build pass.

Link to Devin session: https://app.devin.ai/sessions/7e123fc2545a49c282b043a4abd58f70
Open in Devin Desktop: https://app.devin.ai/desktop/session/7e123fc2545a49c282b043a4abd58f70?variant=devin
Requested by: @m0tzy

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

---

Original prompt from madison.packer

What's the fix here? https://linear.app/workos/issue/VULN-4839/lt-app26-10-user-vs-agent-jwt-type-confusion

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[devin-ai-integration]

Devin Review

🟢 Devin Review found nothing to fix · View findings

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no actionable issues were found.

Summary

Updates @workos/authkit-session from ^0.8.0 to ^0.9.1.

• AuthKit session checks now use version 0.9.1.

_{Reviews (1) · Last reviewed commit: "fix(deps): Bump @workos/authkit-session ..." · Reviewed by Greptile}