Update dependency @workos-inc/authkit-nextjs to v4

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@workos-inc/authkit-nextjs	^2.17.0 → ^4.3.1

---

Release Notes

workos/authkit-nextjs (@​workos-inc/authkit-nextjs)

v4.3.1

Compare Source

Bug Fixes

• Preserve session on transient refresh failures (#​461) (07b8dfa)

v4.3.0

Compare Source

Features

• add CallbackError with request attribution (#​455) (0dd39fe)

Bug Fixes

• prevent session helpers from being exposed as Server Actions (#​454) (0ae2672)
• proactively refresh near-expiry access tokens in the proxy middleware (#​453) (55da9cb)

v4.2.0

Compare Source

Features

• add recent-auth checking (checkRecentAuth + useRecentAuth) and maxAge step-up (#​446) (34f92ac)

v4.1.4

Compare Source

Bug Fixes

• deps: move @​workos-inc/node to peerDependencies (#​423) (18163d7)

v4.1.3

Compare Source

Bug Fixes

• prevent cross-organization disclosure in getOrganizationAction (#​443) (6b2ea66)

v4.1.2

Compare Source

Bug Fixes

• Improve auth cookie missing error message (#​440) (39af2bb)

v4.1.1

Compare Source

Bug Fixes

• defer PKCE cookie write until AuthKit redirect (#​432) (4f63d2f)

v4.1.0

Compare Source

Features

• Add feature flags runtime client helper (#​428) (be6b932)

v4.0.1

Compare Source

Bug Fixes

• persist authenticationMethod in sealed session cookie (#​410) (a8f7def)

v4.0.0

Compare Source

⚠ BREAKING CHANGES

• Upgrade @​workos-inc/node to v9 (#​407)
• set minimum Node.js version to 22.11.0 (#​408)

Miscellaneous Chores

• set minimum Node.js version to 22.11.0 (#​408) (c394669)
• Upgrade @​workos-inc/node to v9 (#​407) (0183951)

v3.0.1

Compare Source

Bug Fixes

• isolate concurrent PKCE flows to prevent cookie clobbering (#​403) (3740a83)
• set PKCE cookie in ensureSignedIn server action flow (#​406) (a55bb64)

v3.0.0

Compare Source

⚠ BREAKING CHANGES

• add OAuth state verification on callback to prevent CSRF attacks (#​388)

Features

• add OAuth state verification on callback to prevent CSRF attacks (#​388) (ebef6e7)
• middleware: add authkitProxy and handleAuthkitProxy aliases for proxy.ts (#​384) (4c3f27b)

Bug Fixes

• actions: catch TokenRefreshError in refreshAccessTokenAction to prevent 500s (#​383) (5c46c39)
• auth: return signInUrl from server actions to avoid CORS errors (#​386) (7d52400)
• harden PKCE/CSRF for v3.0.0 release (#​398) (8054829)

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.