deps: bump cookie from 1.1.1 to 2.0.1

jest.config.js

@@ -21,7 +21,7 @@ const customJestConfig = {
   ],
   moduleDirectories: ['node_modules', '<rootDir>/'],
   transformIgnorePatterns: [
-    '/node_modules/(?!(@auth|next-auth|next-intl|use-intl)/)',
+    '/node_modules/(?!(@auth|next-auth|next-intl|use-intl|cookie)/)',
   ],
   moduleNameMapper: {
     '^@/(.*)$': '<rootDir>/src/$1',
@@ -40,4 +40,17 @@ const customJestConfig = {
 }
 
 // createJestConfig is exported this way to ensure that next/jest can load the Next.js config which is async
-module.exports = createJestConfig(customJestConfig)
+const buildConfig = createJestConfig(customJestConfig)
+
+// next/jest PREPENDS its own transformIgnorePatterns, and patterns are OR'd —
+// if any one matches, the file is never transformed. So an allowlist entry in
+// customJestConfig above cannot rescue an ESM-only package on its own; the
+// package must also be injected into next/jest's generated allowlist here.
+// cookie v2 is pure ESM ("type": "module") and is imported by src/lib/auth.
+module.exports = async () => {
+  const config = await buildConfig()
+  config.transformIgnorePatterns = config.transformIgnorePatterns.map((pattern) =>
+    pattern.includes('(?!(next-auth|') ? pattern.replace('(?!(next-auth|', '(?!(cookie|next-auth|') : pattern
+  )
+  return config
+}

package.json

@@ -107,7 +107,7 @@
     "bcryptjs": "^2.4.3",
     "busboy": "^1.6.0",
     "clsx": "^2.1.1",
-    "cookie": "^1.0.2",
+    "cookie": "^2.0.1",
     "cron-parser": "^5.5.0",
     "csv-parse": "^7.0.2",
     "drizzle-orm": "^0.45.1",

src/lib/auth/csrf.ts

@@ -12,7 +12,9 @@
  */
 
 import { NextRequest, NextResponse } from 'next/server'
-import { serialize, parse } from 'cookie'
+// cookie v2 renamed the exports: serialize → stringifySetCookie (now taking
+// {name, value, ...options} as one object), parse → parseCookie.
+import { stringifySetCookie, parseCookie } from 'cookie'
 
 // =============================================================================
 // Edge-compatible crypto utilities (Web Crypto API)
@@ -103,7 +105,9 @@ export async function validateCsrfToken(token: string, hash: string): Promise<bo
  * Create a CSRF cookie
  */
 export function createCsrfCookie(token: string): string {
-  return serialize(CSRF_CONFIG.cookieName, token, {
+  return stringifySetCookie({
+    name: CSRF_CONFIG.cookieName,
+    value: token,
     httpOnly: false, // Must be false: Double Submit Cookie pattern requires JS to read the token
     secure: process.env.NODE_ENV === 'production',
     sameSite: 'strict',
@@ -117,7 +121,7 @@ export function createCsrfCookie(token: string): string {
  */
 export function getCsrfFromCookies(cookieHeader: string | null): string | null {
   if (!cookieHeader) return null
-  const cookies = parse(cookieHeader)
+  const cookies = parseCookie(cookieHeader)
   return cookies[CSRF_CONFIG.cookieName] || null
 }