chore(deps): bump iron-session from 8.0.4 to 9.0.1

[dependabot]

Bumps iron-session from 8.0.4 to 9.0.1.

Release notes

Sourced from iron-session's releases.

v9.0.1

No code changes. dist/index.js and dist/index.d.ts are byte-for-byte identical to 9.0.0; only the version number differs.

9.0.0 was published from a laptop because CI could not authenticate with npm, so its tarball carries no provenance attestation and cannot be verified against a commit. npm versions are immutable, so that is not fixable after the fact.

9.0.1 is the same code published from CI with provenance, built from a0bd646 by .github/workflows/release.yaml. You can check it yourself:

npm audit signatures

If you are on 9.0.0 and do not care about provenance, there is no reason to upgrade.

v9.0.0

pnpm add iron-session

Needs Node 22.13+ and is ESM-only (require() works on Node 22.13+). Stuck on older Node, or need CommonJS? Stay on iron-session@8.

How to upgrade

Most apps change two things. Both are things v8 got wrong quietly.

- session.lastSeen = new Date();   // v8 sealed this as a string
+ session.lastSeen = Date.now();

const userId = session.user.id;  // empty on a first visit


const userId = session.user?.id;

Nothing else is required:

• getIronSession(req, res, options) and getIronSession(await cookies(), options) both still work. Delete any as any you had on await cookies().
• v9 reads v8 cookies and v8 reads v9 cookies, so a deploy rolls back without signing everyone out.
• Users on pre-v8 cookies (iron-session 6 and older) sign in once more. That format picked its shape from a marker outside the signature, so an attacker could flip it.

Full guide: MIGRATION.md.

What's new

1. Sessions work in Next.js Proxy (middleware), via nextProxyCookies
2. Sessions can be bigger than 4KB, with chunk: true
3. getIronSession(await cookies(), options) typechecks
4. Four bugs that lost sessions or logouts without an error are fixed
5. onUnsealError tells you why a cookie was rejected
6. TypeScript catches reads of a session that may not exist
7. Tested in Chromium, Firefox and WebKit, plus Node 22/24/26, Bun and Deno

... (truncated)

Changelog

Sourced from iron-session's changelog.

9.0.1

No code changes. dist/index.js and dist/index.d.ts are byte-for-byte identical to 9.0.0; only the version number differs.

9.0.0 was published from a laptop because CI could not authenticate with npm, so its tarball carries no provenance attestation and cannot be verified against a commit. That is not fixable after the fact: npm versions are immutable. 9.0.1 is the same code published from CI with provenance, so you can check it was built from this repository at a known commit:

npm audit signatures

If you are on 9.0.0 and do not care about provenance, there is no reason to upgrade.

9.0.0

Install

pnpm add iron-session
pnpm add iron-session@8   # if you are still on Node 20 or need CommonJS

How to upgrade

Requires Node 22.13+, and the package is ESM-only (require() works on Node 22.13+). Two code changes cover most apps:

- session.lastSeen = new Date();   // v8 sealed it as a string
+ session.lastSeen = Date.now();

const userId = session.user.id;  // empty on a first visit


const userId = session.user?.id;

Nothing else is required. getIronSession(req, res, options) and getIronSession(await cookies(), options) both still work, and v9 reads v8 cookies while v8 reads v9 cookies, so a deploy rolls back without signing everyone out. Delete any as any you had on await cookies().

Full guide, including removed APIs: MIGRATION.md.

⚠ BREAKING CHANGES

... (truncated)

Commits

• a0bd646 chore: 9.0.1 (#955)
• c324c1e ci: publish via npm trusted publishing instead of NPM_TOKEN (#954)
• 301faa8 chore: concurrently 10, which drops the vulnerable shell-quote
• 88145a5 Release 9.0.0 (#953)
• 4640b36 fix: soften four v9 guards that broke working code (#952)
• a7c5c12 docs: call it Proxy (middleware), matching what Next 16 calls it
• b23c4b0 ci: release workflow that publishes with provenance
• 22ac051 chore: 9.0.0-beta.0
• 325ce32 test: Playwright suite on Chromium, Firefox and WebKit (#948)
• a5f2c52 Make IronSession<T> properties optional on read (#947)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for iron-session since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
launchcontrol	Ready	Preview	Sep 14, 2026 7:19am UTC