Parse HTTP Set-Cookie headers in JavaScript, converting one or more set-cookie values into JavaScript cookie objects. It’s useful for turning cookie header data from strings, Node.js response objects, or fetch Response objects into structured data (array by default, or a name to cookie map with the `map` option).
Project status
- Actively maintained, with the most recent upstream push on 2026-08-11 and recent version updates through mid 2026 (v3.1.2 on 2026-07-09, v3.1.1 on 2026-06-24).
- Apparent update cadence is fairly steady, roughly every 3 to 6 weeks across March through July 2026 (v3.1.0 on 2026-03-20, then follow-ups in late June and early July).
AI summary generated
Recent updates
v3.1.2
No publisher release notes were provided for v3.1.2. The code change is a small robustness fix in set-cookie parsing, plus minor documentation and a dev dependency bump.
v3.1.1
v3.1.1 primarily adjusts Set-Cookie parsing so whitespace around attribute names and values is handled correctly. The diff also updates the GitHub Actions workflow to newer Node setup and checkout actions, and bumps a couple of dev-only dependency entries in the lockfile.
v3.1.0
Release v3.1.0 was published on 2026-03-20, but the publisher did not provide release notes. No documented features, fixes, breaking changes, or dependency/security updates are described in the provided information.
v3.0.1
No release notes were provided for v3.0.1. The code changes are limited to packaging and release automation, with the workflow now building a CJS version before publishing to npm.
v3.0.0
v3.0.0 includes a major packaging and API shift, adding ESM support, generating a CJS build, and changing how combined Set-Cookie header strings are handled. The provided release notes contain no content, so the actual behavioral changes must be inferred from the code diff.
Featuresv2.7.2
v2.7.2 hardens set-cookie parsing to mitigate prototype pollution and avoid logging potentially sensitive cookie values during decode errors. The code change also includes a few parsing robustness tweaks (for example, handling invalid max-age values) and updates test coverage for prototype pollution cases.
Securityv2.7.1
The v2.7.1 release contains minimal functional change in the library code, but it does include a likely behavioral change in how `parse()` handles the `options` argument. The remaining changes appear to be documentation and repo metadata updates.
v2.7.0
v2.7.0 mainly extends set-cookie-parser to recognize the Set-Cookie Partitioned attribute and map it to a structured cookie field. Alongside this, the repo adds/updates documentation (README, CHANGELOG) and modernizes the GitHub Actions workflow and development tooling versions.
Featuresv2.6.0
v2.6.0 updates the set-cookie parsing logic to better follow the RFC6265bis name-value parsing rules, and adds support for parsing fetch Response objects via headers.getSetCookie(). The release also includes test coverage for the updated edge-case behavior and some minor project/tooling changes.
BreakingFeaturesv2.5.0
Release v2.5.0 was published on 2022-06-04, but the publisher provided no release notes content. As a result, this report cannot confirm new features, breaking changes, bug fixes, or security updates from the release notes.