refactor(deps): migrate express-session from v1.18.1 to v1.19.0

[digital-wizard48]

Changes

Dependency Update

• Bumps express-session from ^1.18.1 to ^1.19.0 in package.json

New Features Adopted

Dynamic Cookie Options (cookie as a function)

All session middleware usages have been updated to use the new dynamic cookie options API introduced in v1.19.0. Instead of a static cookie configuration object, the cookie option now accepts a function (req) => cookieOptions, enabling per-request configuration of cookie attributes.

This allows the session middleware to:

• Set secure: req.secure || false — automatically enabling secure cookies on HTTPS connections without manual environment checks
• Apply other context-aware cookie attributes per request

Files updated:

• examples/session/index.js
• examples/session/redis.js
• examples/mvc/index.js
• examples/auth/index.js

sameSite: 'auto' Support

All updated cookie configurations now use sameSite: 'auto', a new option added in v1.19.0 that automatically sets:

• SameSite=None for HTTPS connections
• SameSite=Lax for HTTP connections

This simplifies cross-environment cookie handling and replaces the need to manually branch on environment variables or request properties to set the sameSite attribute.

Why These Changes

The previous static cookie configuration could not adapt to request context (e.g., HTTP vs HTTPS), requiring workarounds like environment variable checks. The new dynamic cookie API and sameSite: 'auto' make this automatic and more robust, improving security posture without manual configuration branching.

---

This PR was auto-generated by Gittensor upgrade bot using Claude AI