hapi v12 removes the request.session placeholder. It will not break this module but you should officially decorate the request with the key to make sure other plugins can't if both are loaded. It might be best to call it something more unique like request.yar so that other plugins like (hapi-auth-cookie) won't have a conflict (as they should stop using the request.auth.session key).