[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
cookie	^1.1.1 → ^2.0.0

---

Release Notes

jshttp/cookie (cookie)

v2.0.2

Compare Source

Fixed

• Perf optimize cookie value validation by @​blakeembrey in #​285
• Small convention cleanups by @​blakeembrey in #​284
• Reject Expires dates outside cookie year bounds by @​offyotto in #​290
• Reject unsafe-integer maxAge by @​spokodev in #​286

Full Changelog: jshttp/cookie@v2.0.1...v2.0.2

v2.0.1

Compare Source

Improved:

• Small performance improvement by incrementing = index while parsing set-cookie (#​280)

v2.0.0

Compare Source

Important: This release moves the package to ESM only. In node 22+ you can require(esm), and older node versions are not supported.

Changed

• Switch to ESM (#​273)
• Remove deprecated code paths (#​272)
  • The old parse and stringify methods have been renamed: parseCookie and stringifySetCookie
  • stringifySetCookie only supports object mode (e.g. { name: "", value: "" })

Improvements

• Faster stringify cookie (#​262)
• Optimize encode performance (#​269)
• Apply encode to empty cookie values (#​277)

Fixed

• Omit leading semicolon when stringifying cookies with skipped values (#​267)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

? Verifying lockfile against supply-chain policies (1146 entries)...
✗ Lockfile failed supply-chain policy check (1146 entries in 4.8s)
[ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION] 10 lockfile entries failed verification:
  @vue/compiler-core@3.5.45 was published at 2026-11-05T09:16:30.572Z, within the minimumReleaseAge cutoff (2026-11-05T05:15:30.689Z)
  @vue/compiler-dom@3.5.45 was published at 2026-11-05T09:15:44.542Z, within the minimumReleaseAge cutoff (2026-11-05T05:15:30.689Z)
  @vue/compiler-sfc@3.5.45 was published at 2026-11-05T09:15:48.630Z, within the minimumReleaseAge cutoff (2026-11-05T05:15:30.689Z)
  @vue/compiler-ssr@3.5.45 was published at 2026-11-05T09:17:14.192Z, within the minimumReleaseAge cutoff (2026-11-05T05:15:30.689Z)
  @vue/reactivity@3.5.45 was published at 2026-11-05T09:16:47.724Z, within the minimumReleaseAge cutoff (2026-11-05T05:15:30.689Z)
  @vue/runtime-core@3.5.45 was published at 2026-11-05T09:15:39.697Z, within the minimumReleaseAge cutoff (2026-11-05T05:15:30.689Z)
  @vue/runtime-dom@3.5.45 was published at 2026-11-05T09:16:06.161Z, within the minimumReleaseAge cutoff (2026-11-05T05:15:30.689Z)
  @vue/server-renderer@3.5.45 was published at 2026-11-05T09:16:08.100Z, within the minimumReleaseAge cutoff (2026-11-05T05:15:30.689Z)
  @vue/shared@3.5.45 was published at 2026-11-05T09:15:52.092Z, within the minimumReleaseAge cutoff (2026-11-05T05:15:30.689Z)
  vue@3.5.45 was published at 2026-11-05T09:16:21.383Z, within the minimumReleaseAge cutoff (2026-11-05T05:15:30.689Z)

The lockfile contains entries that the active policies reject. This can mean the lockfile is stale, or that someone committed a lockfile that bypassed the policy locally — inspect recent changes to pnpm-lock.yaml before trusting it. If the changes look expected, run "pnpm clean --lockfile" and then "pnpm install" to rebuild from a fresh resolution. If the fresh resolution still fails and you trust the affected packages, relax the policy that flagged them.