# What changed in cookie

> 23 changes in cookie 1 to 2 from its official release notes, upgrade guides and advisories: 9 breaking, 5 new APIs and options. Each one cited. Sources checked 2026-10-25. HTML: https://unstale.sh/npm/cookie/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## cookie 2

### Breaking changes

- The package is ESM-only; Node versions older than 22 are not supported. (2.0.0) — [release notes](https://github.com/jshttp/cookie/releases/tag/v2.0.0)
- The old `parse` method is renamed to `parseCookie`. (2.0.0) — [release notes](https://github.com/jshttp/cookie/releases/tag/v2.0.0)
- The old `stringify` method is renamed to `stringifySetCookie`, which only supports object mode. (2.0.0) — [release notes](https://github.com/jshttp/cookie/releases/tag/v2.0.0)

### Performance

- Parsing set-cookie is slightly faster because the parser increments the = index. (2.0.1) — [release notes](https://github.com/jshttp/cookie/releases/tag/v2.0.1)
- Encoding performance is optimized. (2.0.0) — [release notes](https://github.com/jshttp/cookie/releases/tag/v2.0.0)
- Stringifying cookies is faster. (2.0.0) — [release notes](https://github.com/jshttp/cookie/releases/tag/v2.0.0)

### Fixes and other changes

- The `encode` function is now applied to empty cookie values. (2.0.0) — [release notes](https://github.com/jshttp/cookie/releases/tag/v2.0.0)
- Fixes an unwanted leading semicolon when stringifying cookies with skipped values. (2.0.0) — [release notes](https://github.com/jshttp/cookie/releases/tag/v2.0.0)

## cookie 1

### Breaking changes

- The package adds an __esModule marker, so imports must use named imports or namespace imports. (1.0.0) — [release notes](https://github.com/jshttp/cookie/releases/tag/v1.0.0)
- The minimum supported Node.js version is now v18. (1.0.0) — [release notes](https://github.com/jshttp/cookie/releases/tag/v1.0.0)
- The object returned by parse now has a null prototype. (1.0.0) — [release notes](https://github.com/jshttp/cookie/releases/tag/v1.0.0)
- Priority values must use lowercase spelling. (1.0.0) — [release notes](https://github.com/jshttp/cookie/releases/tag/v1.0.0)
- The strict value must use lowercase spelling. (1.0.0) — [release notes](https://github.com/jshttp/cookie/releases/tag/v1.0.0)
- maxAge must be an integer; non-integer values are checked with Number.isInteger. (1.0.0) — [release notes](https://github.com/jshttp/cookie/releases/tag/v1.0.0)

### New APIs and options

- Renames parse to parseCookie for clarity; the old method name remains for backward compatibility. (1.1.0) — [release notes](https://github.com/jshttp/cookie/releases/tag/v1.1.0)
- Adds parseSetCookie for parsing Set-Cookie values. (1.1.0) — [release notes](https://github.com/jshttp/cookie/releases/tag/v1.1.0)
- Adds a side effects field. (1.1.0) — [release notes](https://github.com/jshttp/cookie/releases/tag/v1.1.0)
- Adds stringifyCookie for stringifying cookies. (1.1.0) — [release notes](https://github.com/jshttp/cookie/releases/tag/v1.1.0)
- Renames serialize to stringifySetCookie for clarity; the old method name remains for backward compatibility. (1.1.0) — [release notes](https://github.com/jshttp/cookie/releases/tag/v1.1.0)

### Behavior and default changes

- The decode option now defines error handling and quote parsing. (1.0.0) — [release notes](https://github.com/jshttp/cookie/releases/tag/v1.0.0)

### Tooling

- The package now ships TypeScript definitions. (1.0.0) — [release notes](https://github.com/jshttp/cookie/releases/tag/v1.0.0)

### Fixes and other changes

- When `value` is provided in the options object, `serialize` now uses the value passed as an argument instead. (1.1.1) — [release notes](https://github.com/jshttp/cookie/releases/tag/v1.1.1)
- Argument and option error messages have been improved. (1.0.0) — [release notes](https://github.com/jshttp/cookie/releases/tag/v1.0.0)