# What changed in cookie-es

> 23 changes in cookie-es 1 to 3 from its official release notes, upgrade guides and advisories: 13 breaking, 1 security, 5 new APIs and options. Each one cited. Sources checked 2026-10-25. HTML: https://unstale.sh/npm/cookie-es/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## cookie-es 3

### Breaking changes

- Invalid input now returns undefined instead of an object with empty name and value. (3.0.0) — [release notes](https://github.com/unjs/cookie-es/releases/tag/v3.0.0)
- Parsed Domain values have a leading dot stripped and are lowercased. (3.0.0) — [release notes](https://github.com/unjs/cookie-es/releases/tag/v3.0.0)
- Parsed Max-Age values are capped to the 400-day limit. (3.0.0) — [release notes](https://github.com/unjs/cookie-es/releases/tag/v3.0.0)
- Unknown SameSite values now default to lax. (3.0.0) — [release notes](https://github.com/unjs/cookie-es/releases/tag/v3.0.0)
- Returns undefined when the combined name and value exceed 4096 octets. (3.0.0) — [release notes](https://github.com/unjs/cookie-es/releases/tag/v3.0.0)
- Attribute values exceeding 1024 octets are ignored. (3.0.0) — [release notes](https://github.com/unjs/cookie-es/releases/tag/v3.0.0)
- Names that could pollute prototypes, including __proto__ and constructor, are rejected. (3.0.0) — [release notes](https://github.com/unjs/cookie-es/releases/tag/v3.0.0)
- maxAge must be an integer and is clamped to the range from 0 to 400 days. (3.0.0) — [release notes](https://github.com/unjs/cookie-es/releases/tag/v3.0.0)
- Serialization throws when Partitioned is used without Secure. (3.0.0) — [release notes](https://github.com/unjs/cookie-es/releases/tag/v3.0.0)
- Serialization throws when SameSite=None is used without Secure. (3.0.0) — [release notes](https://github.com/unjs/cookie-es/releases/tag/v3.0.0)
- Cookie names, values, domains, and paths are validated against stricter regular expressions. (3.0.0) — [release notes](https://github.com/unjs/cookie-es/releases/tag/v3.0.0)

### Security

- Prefix cookies require Secure; __Host- cookies additionally require Path=/ and no Domain. (3.0.0) — [release notes](https://github.com/unjs/cookie-es/releases/tag/v3.0.0)

### New APIs and options

- Supports a custom stringify option for value coercion. (3.1.0) — [release notes](https://github.com/unjs/cookie-es/releases/tag/v3.1.0)
- When enabled, duplicate cookie names return an array of values instead of only the first. (3.0.0) — [release notes](https://github.com/unjs/cookie-es/releases/tag/v3.0.0)
- A filter option skips specified keys during parsing. (3.0.0) — [release notes](https://github.com/unjs/cookie-es/releases/tag/v3.0.0)
- serialize() now accepts a single SetCookie object as well as the existing name, value, and options arguments. (3.0.0) — [release notes](https://github.com/unjs/cookie-es/releases/tag/v3.0.0)
- Converts a Cookies object back into a Cookie header string, complementing parse(). (3.0.0) — [release notes](https://github.com/unjs/cookie-es/releases/tag/v3.0.0)

### Behavior and default changes

- Accepts non-string values. (3.1.0) — [release notes](https://github.com/unjs/cookie-es/releases/tag/v3.1.0)
- CookieSerializeOptions is now a compatibility alias for CookieStringifyOptions intersected with SetCookie fields other than name and value. (3.0.0) — [release notes](https://github.com/unjs/cookie-es/releases/tag/v3.0.0)
- A custom decode function can return undefined to exclude a cookie from the result. (3.0.0) — [release notes](https://github.com/unjs/cookie-es/releases/tag/v3.0.0)

## cookie-es 2

### Breaking changes

- The package distribution is ESM-only, which affects how developers can consume it. (2.0.0) — [release notes](https://github.com/unjs/cookie-es/releases/tag/v2.0.0)

### Behavior and default changes

- parse now uses a null-prototype object. (2.0.1) — [release notes](https://github.com/unjs/cookie-es/releases/tag/v2.0.1)

## cookie-es 1

### Breaking changes

- parse now uses a null-prototype object for its result. (1.2.3) — [release notes](https://github.com/unjs/cookie-es/releases/tag/v1.2.3)