npm / cookie-es
cookie-es
What changed in cookie-es 1 to 3, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-25.
13 breaking1 security5 new APIs and options4 behavior and defaults
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initcookie-es 320 changes
Breaking changes 11
Invalid input now returns undefined instead of an object with empty name and value.
Parsed Domain values have a leading dot stripped and are lowercased.
Parsed Max-Age values are capped to the 400-day limit.
Unknown SameSite values now default to lax.
Returns undefined when the combined name and value exceed 4096 octets.
Attribute values exceeding 1024 octets are ignored.
Names that could pollute prototypes, including __proto__ and constructor, are rejected.
maxAge must be an integer and is clamped to the range from 0 to 400 days.
Serialization throws when Partitioned is used without Secure.
Serialization throws when SameSite=None is used without Secure.
Cookie names, values, domains, and paths are validated against stricter regular expressions.
Security 1
Prefix cookies require Secure; __Host- cookies additionally require Path=/ and no Domain.
New APIs and options 5
Supports a custom stringify option for value coercion.
When enabled, duplicate cookie names return an array of values instead of only the first.
A filter option skips specified keys during parsing.
serialize() now accepts a single SetCookie object as well as the existing name, value, and options arguments.
Converts a Cookies object back into a Cookie header string, complementing parse().
Behavior and default changes 3
Accepts non-string values.
CookieSerializeOptions is now a compatibility alias for CookieStringifyOptions intersected with SetCookie fields other than name and value.
A custom decode function can return undefined to exclude a cookie from the result.
cookie-es 22 changes
Breaking changes 1
The package distribution is ESM-only, which affects how developers can consume it.
Behavior and default changes 1
parse now uses a null-prototype object.
cookie-es 11 changes
Breaking changes 1
parse now uses a null-prototype object for its result.