`npm audit` complains about a low severity vulnerability in a transitive dependency

**Describe the bug** With the latest version of authkit-nextjs installed, `npm audit` reports a low severity vulnerability in a transitive dependency. **To Reproduce** Steps to reproduce the behavior: 1. Run `npm audit`. 2. Observe: ``` # npm audit report cookie <0.7.0 cookie accepts cookie name, path, and domain with out of bounds characters - https://github.com/advisories/GHSA-pxg6-pf52-xh8x fix available via `npm audit fix --force` Will install @workos-inc/authkit-nextjs@0.8.2, which is a breaking change node_modules/@workos-inc/node/node_modules/cookie iron-session <=8.0.3 Depends on vulnerable versions of cookie node_modules/@workos-inc/node/node_modules/iron-session @workos-inc/node 7.15.0 - 7.82.0 Depends on vulnerable versions of iron-session node_modules/@workos-inc/node @workos-inc/authkit-nextjs 0.9.0 - 2.13.0 Depends on vulnerable versions of @workos-inc/node node_modules/@workos-inc/authkit-nextjs 4 low severity vulnerabilities To address all issues (including breaking changes), run: npm audit fix --force ``` `npm audit fix --force`'s suggested resolution of downgrading authkit-nextjs to 0.8.2 is nonsense. **Expected behavior** `npm audit` should not emit vulnerability warnings. **Screenshots** None. **Desktop (please complete the following information):** - OS: Win11 25H2 - Browser: Chrome 144 - authkit-nextjs version: 2.13.0 - Next.js version: 16.1.6 **Additional context** The problem appears to be that authkit-nextjs depends on workos-node v7, which depended on vulnerable versions of iron-session but didn't accept the latest fixed version. (authkit-nextjs has a direct dependency on iron-session `^8.0.1` but that should be fine.) https://github.com/workos/authkit-nextjs/blob/9af5faf7b5fb06b8d73406ffbef3b1d8ef5f3aa7/package.json#L39-L40 It appears that workos-node v8 fixed this by removing its dependency on iron-session in https://github.com/workos/workos-node/pull/1370, so upgrading authkit-nextjs to depend on workos-node v8 would fix this.