From 9c6fcb086e5b67695847c3cab36a92d08dcc1ee1 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 10 Aug 2026 10:02:55 +0000 Subject: [PATCH 1/2] deps: bump cookie from 1.1.1 to 2.0.1 Bumps [cookie](https://github.com/jshttp/cookie) from 1.1.1 to 2.0.1. - [Release notes](https://github.com/jshttp/cookie/releases) - [Commits](https://github.com/jshttp/cookie/compare/v1.1.1...v2.0.1) --- updated-dependencies: - dependency-name: cookie dependency-version: 2.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- package-lock.json | 10 +++++----- package.json | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/package-lock.json b/package-lock.json index 50297c207..3a26acefb 100644 --- a/package-lock.json +++ b/package-lock.json @@ -27,7 +27,7 @@ "bcryptjs": "^2.4.3", "busboy": "^1.6.0", "clsx": "^2.1.1", - "cookie": "^1.0.2", + "cookie": "^2.0.1", "cron-parser": "^5.5.0", "csv-parse": "^7.0.2", "drizzle-orm": "^0.45.1", @@ -8736,12 +8736,12 @@ "license": "MIT" }, "node_modules/cookie": { - "version": "1.1.1", - "resolved": "https://registry.npmjs.org/cookie/-/cookie-1.1.1.tgz", - "integrity": "sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==", + "version": "2.0.1", + "resolved": "https://registry.npmjs.org/cookie/-/cookie-2.0.1.tgz", + "integrity": "sha512-yuToqVvRrj6pfDXREyQAAv8SkAEk/8GS3jQRTiUMm66TVtBYmqQeoEjL2Lmq8Rpo6271vH76InTChTitEAm65w==", "license": "MIT", "engines": { - "node": ">=18" + "node": ">=22" }, "funding": { "type": "opencollective", diff --git a/package.json b/package.json index b26fb3504..15171626d 100644 --- a/package.json +++ b/package.json @@ -107,7 +107,7 @@ "bcryptjs": "^2.4.3", "busboy": "^1.6.0", "clsx": "^2.1.1", - "cookie": "^1.0.2", + "cookie": "^2.0.1", "cron-parser": "^5.5.0", "csv-parse": "^7.0.2", "drizzle-orm": "^0.45.1", From 7a80d3edc27e72563e079aede75de0c5dc286dad Mon Sep 17 00:00:00 2001 From: Mao Nakamoto <41178744+maonakamoto@users.noreply.github.com> Date: Tue, 11 Aug 2026 13:44:20 +0200 Subject: [PATCH 2/2] fix(auth): migrate csrf.ts to the cookie v2 API MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit cookie 2.0 renamed its exports: serialize → stringifySetCookie (taking one {name, value, ...options} object) and parse → parseCookie. Output verified byte-identical for our call shape, including that httpOnly:false still OMITS the flag — the CSRF cookie must stay JS-readable for the Double Submit pattern. cookie v2 is also pure ESM, which jest could not parse. The allowlist entry in customJestConfig alone is dead config: next/jest PREPENDS its own transformIgnorePatterns and patterns are OR'd, so the package must be injected into the generated pattern after createJestConfig resolves. With that, the 21 csrf tests actually run again (they were failing to even load). Co-Authored-By: Claude Fable 5 --- jest.config.js | 17 +++++++++++++++-- src/lib/auth/csrf.ts | 10 +++++++--- 2 files changed, 22 insertions(+), 5 deletions(-) diff --git a/jest.config.js b/jest.config.js index 7918ae192..b5ce151d5 100644 --- a/jest.config.js +++ b/jest.config.js @@ -21,7 +21,7 @@ const customJestConfig = { ], moduleDirectories: ['node_modules', '/'], transformIgnorePatterns: [ - '/node_modules/(?!(@auth|next-auth|next-intl|use-intl)/)', + '/node_modules/(?!(@auth|next-auth|next-intl|use-intl|cookie)/)', ], moduleNameMapper: { '^@/(.*)$': '/src/$1', @@ -40,4 +40,17 @@ const customJestConfig = { } // createJestConfig is exported this way to ensure that next/jest can load the Next.js config which is async -module.exports = createJestConfig(customJestConfig) +const buildConfig = createJestConfig(customJestConfig) + +// next/jest PREPENDS its own transformIgnorePatterns, and patterns are OR'd — +// if any one matches, the file is never transformed. So an allowlist entry in +// customJestConfig above cannot rescue an ESM-only package on its own; the +// package must also be injected into next/jest's generated allowlist here. +// cookie v2 is pure ESM ("type": "module") and is imported by src/lib/auth. +module.exports = async () => { + const config = await buildConfig() + config.transformIgnorePatterns = config.transformIgnorePatterns.map((pattern) => + pattern.includes('(?!(next-auth|') ? pattern.replace('(?!(next-auth|', '(?!(cookie|next-auth|') : pattern + ) + return config +} diff --git a/src/lib/auth/csrf.ts b/src/lib/auth/csrf.ts index 5d412ed72..2b8f50c4c 100644 --- a/src/lib/auth/csrf.ts +++ b/src/lib/auth/csrf.ts @@ -12,7 +12,9 @@ */ import { NextRequest, NextResponse } from 'next/server' -import { serialize, parse } from 'cookie' +// cookie v2 renamed the exports: serialize → stringifySetCookie (now taking +// {name, value, ...options} as one object), parse → parseCookie. +import { stringifySetCookie, parseCookie } from 'cookie' // ============================================================================= // Edge-compatible crypto utilities (Web Crypto API) @@ -103,7 +105,9 @@ export async function validateCsrfToken(token: string, hash: string): Promise