fix: Report the package version in the SDK user agent

[devin-ai-integration]

Summary

The VERSION constant that feeds the WorkOS appInfo user-agent tag was hardcoded and never updated with releases:

// src/workos.ts
export const VERSION = '2.14.0';
const options = { appInfo: { name: 'authkit/nextjs', version: VERSION } };

That literal is still '2.14.0' in the published 4.0.0, 4.1.0, 4.2.0, and 4.3.0 tarballs, so every install reports authkit/nextjs: 2.14.0 in outbound requests regardless of the actual version. This makes SDK-version telemetry unusable for support/debugging — you can't tell v2 from v4 by the tag (only by the peer @workos-inc/node major, and even that tag is dropped entirely by workos-node 10.x's user agent).

Fix:

• Set VERSION to the real version and annotate it so release-please bumps it on every release:

  export const VERSION = '4.3.0'; // x-release-please-version

• Register the file with release-please's generic updater so it stays in lockstep with package.json:

  // release-please-config.json → packages["."]
  "extra-files": ["src/workos.ts"]

• Add a regression test asserting VERSION === package.json.version so the constant can't silently drift again.

No runtime behavior changes beyond the reported version string.

Test plan

• pnpm test — 401 tests pass, including the new reports the package version in the user agent assertion.
• pnpm run typecheck, pnpm run lint, pnpm run format:check — clean.
• pnpm run build — compiled dist/esm/workos.js now emits export const VERSION = '4.3.0';.
• Future releases: the release-please PR will bump both package.json and the annotated line in src/workos.ts in the same commit.

Link to Devin session: https://app.devin.ai/sessions/5afb843db1f54e38ae15250a1563b83a

[devin-ai-integration]

Original prompt from heather

SYSTEM:
=== BEGIN THREAD HISTORY (in #dse-pre-triage) ===
<most_recent_message>
Heather Faerber (U08CUNLUBT9): @Devin Look into what is causing these errors. Did something change on the workos side that caused this?

&gt; bur [6:00 AM]
&gt; Are there any issues with AuthKit currently? We are seeing a few users in the UK reporting 500s.
&gt; <https://gecko-lightning.workshop.cloud/auth/callback?code=XXXXXXXXX>
&gt;
&gt; and receive;
&gt; {"error":{"message":"Something went wrong","description":"Couldn't sign in. If you are not sure what happened, please contact your organization admin."}}
&gt;
&gt; The status code returned is 500 Internal Server Error
&gt; 3 replies
&gt;
&gt;
&gt;
&gt;
&gt;
&gt;
&gt; bur [6:18 AM]
&gt; On server logs show the request is coming back to us with missing parms.
&gt; 2026-07-23T08:30:08.491Z > [AuthKit callback error] Error: Missing required auth parameter > 2026-07-23T08:30:08.491Z > at k.baseURL (.next/server/chunks/[root-of-the-server]__1wbo6oa._.js:1:2332) > 2026-07-23T08:30:23.510Z > [AuthKit callback error] Error: Missing required auth parameter > 2026-07-23T08:30:23.510Z > at k.baseURL (.next/server/chunks/[root-of-the-server]__1wbo6oa._.js:1:2332) > 2026-07-23T08:30:26.942Z > [AuthKit callback error] Error: Missing required auth parameter > 2026-07-23T08:30:26.942Z > at k.baseURL (.next/server/chunks/[root-of-the-server]__1wbo6oa._.js:1:2332)
&gt;
&gt;
&gt;
&gt;
&gt; bur [7:20 AM]
&gt; I can also reproduce this locally consistently. Has something changed on your end?
&gt;
&gt;
&gt;
&gt;
&gt; bur [7:47 AM]
&gt; It seems to have something to do with the org picker.

[Slack unfurl — this is an automatic link preview, not a user message]
Quote of conversation (https://work-os.slack.com/archives/C08HJDUM82Z/p1784808036681769?thread_ts=1784808036.681769&amp;cid=C08HJDUM82Z):
> From bur
> Are there any issues with AuthKit currently? We are seeing a few users in... (775 chars truncated...)

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[greptile-apps]

Greptile Summary

This PR fixes a long-standing bug where the VERSION constant used in the WorkOS SDK's appInfo user-agent tag was hardcoded to '2.14.0' and never updated, causing every v3/v4 install to misreport itself in outbound requests. The fix corrects the value to '4.3.0', wires up release-please to keep it in sync automatically, and adds a regression test to catch future drift.

• src/workos.ts: Updates VERSION to '4.3.0' and adds the // x-release-please-version annotation so the generic updater bumps it alongside package.json on every release.
• release-please-config.json: Registers src/workos.ts as an extra-files target, enabling the automated version bump.
• src/workos.spec.ts: New test reads package.json at runtime via import.meta.url and asserts VERSION matches the declared package version, guarding against silent drift.

Confidence Score: 5/5

Safe to merge — the only runtime change is the version string reported in outbound user-agent headers, and the automation wired in here ensures that string stays correct on every future release.

All three files touch only version-reporting infrastructure: a corrected constant value, a release-please config entry, and a new regression test. The test's path resolution via import.meta.url is appropriate for this ESM project. No business logic, auth flows, or data paths are affected.

No files require special attention.

Important Files Changed

Filename	Overview
src/workos.ts	Updates VERSION constant from stale '2.14.0' to current '4.3.0' and adds the release-please annotation so the value stays in lockstep with package.json on every future release.
src/workos.spec.ts	Adds a regression test that reads package.json at test-time and asserts VERSION equals the declared package version; path resolution via import.meta.url is correct for this ESM project.
release-please-config.json	Registers src/workos.ts as an extra-files target so the release-please generic updater bumps the annotated version constant alongside package.json on every release.

Sequence Diagram

sequenceDiagram
    participant RP as release-please
    participant PKG as package.json
    participant WOS as src/workos.ts
    participant SDK as WorkOS SDK
    participant API as WorkOS API

    RP->>PKG: bump version
    RP->>WOS: bump VERSION annotation
    WOS->>SDK: appInfo with VERSION
    SDK->>API: HTTP request with User-Agent
    Note over API: authkit/nextjs version now accurate

Loading

_{Reviews (1): Last reviewed commit: "Report the package version in the SDK us..." | Re-trigger Greptile}