chore: revert cookie upgrade by teemingc · Pull Request #12767 · sveltejs/kit

teemingc · 2024-10-07T15:28:52Z

reverts #12746 . The major contains a breaking change where : characters are no longer allowed in cookie names

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs
This message body should clearly illustrate what problems it solves.
Ideally, include a test that fails without this PR but passes with it.

Tests

Run the tests with pnpm test and lint the project with pnpm lint and pnpm check

Changesets

If your PR makes a change that should be noted in one or more packages' changelogs, generate a changeset by running pnpm changeset and following the prompts. Changesets that add features should be minor and those that fix bugs should be patch. Please prefix changeset messages with feat:, fix:, or chore:.

Edits

Please ensure that 'Allow edits from maintainers' is checked. PRs without this option may be closed.

changeset-bot · 2024-10-07T15:28:56Z

🦋 Changeset detected

Latest commit: 7fd5434

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@sveltejs/kit	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

hyunbinseo · 2024-10-08T01:10:50Z

For additional context, there is a CVE-2024-47764 regarding cookie@0.6.

To fix this, the cookie validation has been narrowed:

fix: narrow the validation of cookies to match RFC6265 jshttp/cookie#167

It is considered a fix: in the CHANGELOG, but it is probably a BREAKING one.

Hence the version bump from 0.6 to 0.7.

Question is, would we have to wait for SvelteKit v3 for cookie@0.7 bump?

People will be receiving GitHub security alert digest emails regarding this:

Known security vulnerabilities detected

Dependency: cookie

Version: < 0.7.0

Upgrade to ~> 0.7.0

teemingc · 2024-10-08T01:14:35Z

Hi @hyunbinseo we're aware of this and looking into it. It's quite likely users will need to upgrade cookie themselves in the meantime and we can only upgrade cookie in kit v3

notramo · 2024-10-09T14:46:37Z

@eltigerchino, how to update manually? I don't have any cookies with : names in my projects, so the newer version wouldn't break it.

Conduitry · 2024-10-09T14:50:23Z

You can use the override feature of your package manager.

https://docs.npmjs.com/cli/v10/configuring-npm/package-json#overrides
https://pnpm.io/package_json#pnpmoverrides

Svelte kit reverted the upgrade in sveltejs/kit#12767

hyunbinseo · 2024-11-05T05:41:07Z

It's quite likely users will need to upgrade cookie themselves in the meantime and we can only upgrade cookie in kit v3

This seems to be official:

Need to tell anyone who is setting invalid name to stop so that we can upgrade cookie library in Kit 3.0

Warn on invalid cookie name #12799

Update to cookie 0.7.0. Since we were not using cookies, the security risks should have been minimal. The upgrade is accomplished with a manual override in package.json, see sveltejs/kit#12767. Fixes: https://github.com/dmoerner/pytorrent/security/dependabot/1

On doit la forcer (override) car il est impossibilité pour SvelteKit de mettre à jour cookie avant la v3. La version 0.7.0 contient un breaking change mais qui ne nous concerne pas. Voir : sveltejs/kit#12767

- To resolve low severity vulnerability - See sveltejs/kit#12767

- To resolve low severity vulnerability (see sveltejs/kit#12767) - Bump package versions

SvelteKit 2.49.2 has cookie 0.6.0 wich has a security issue. The cookie inside the SvelteKit will probably be updated with version 3, then this workaround is no longer needed. see: sveltejs/kit#12767

* feat: tooltip option 1 option using small icon to display tooltip text * fix: wrong line * chore(ci): update dev ci to new ci pipeline by using default arguments for push-to and target * refactor: tooltip text added longer tooltip text Co-authored-by: Tobias Kussel <TKussel@users.noreply.github.com> * fix: npm audit updated all high and medium severity vulnerabilities. (Svelte had to be updated which needed an aditional <tbody> in ResultTable, and some other things for lint to pass) * fix: fixes for vite * fix: use cookie ^1.1.1 for security issue SvelteKit 2.49.2 has cookie 0.6.0 wich has a security issue. The cookie inside the SvelteKit will probably be updated with version 3, then this workaround is no longer needed. see: sveltejs/kit#12767 * fix: remove unused css Co-authored-by: Tobias Kussel <TKussel@users.noreply.github.com> * chore: remove unused variables (#17) * chore: remove unused variables * fix: npm audit for lens verify new code * fix: reset changes to package-lock.json --------- Co-authored-by: Tobias Kussel <tobias.kussel@dkfz-heidelberg.de> * feat(backend): Make sites optional for spot backend (#12) * chore: update Svelte and related dependencies (#16) * chore: update Svelte and related dependencies Bump Svelte to version 5.46.4 and update @sveltejs/kit and devalue to their latest versions. * fix: for run npm ci * fix: add spot sites to env for dev environment (#20) * fix: use package-lock in dockerfile and copy node_modules (#21) --------- Co-authored-by: Klein <paola.klein@dkfz-heidelberg.de> Co-authored-by: paola klein <56866655+paolaklein@users.noreply.github.com>

revert cookie change

d8b2df7

vercel bot deployed to Preview – kit-default-template October 7, 2024 15:28 View deployment

changeset

7fd5434

vercel bot deployed to Preview – kit-default-template October 7, 2024 15:32 View deployment

vercel bot deployed to Preview – kit-svelte-dev October 7, 2024 15:33 View deployment

dummdidumm approved these changes Oct 7, 2024

View reviewed changes

dummdidumm merged commit 809983f into main Oct 7, 2024

dummdidumm deleted the revert-cookie branch October 7, 2024 16:03

github-actions bot mentioned this pull request Oct 7, 2024

Version Packages #12764

Merged

kyle-leonhard mentioned this pull request Oct 11, 2024

Update cookie to ^0.7.0 kosolabs/koso#335

Merged

kyle-leonhard added a commit to kosolabs/koso that referenced this pull request Oct 11, 2024

Update cookie to ^0.7.0 (#335)

d2f6e91

Svelte kit reverted the upgrade in sveltejs/kit#12767

Lucurious mentioned this pull request Oct 29, 2024

Compatibility with cookie@1.0 pixelmund/svelte-kit-cookie-session#61

Closed

brophdawg11 mentioned this pull request Jan 3, 2025

chore(server-runtime): update cookie to v1 remix-run/remix#10104

Closed

ggounot mentioned this pull request Sep 4, 2025

fix: mise à jour forcée de cookie pour cause de vulnérabilité gip-inclusion/dora#525

Merged

carl-underwood added a commit to carl-underwood/listen-later that referenced this pull request Nov 20, 2025

Add cookie override

42ca1b2

- To resolve low severity vulnerability - See sveltejs/kit#12767

carl-underwood added a commit to carl-underwood/listen-later that referenced this pull request Nov 20, 2025

Add cookie override

9dd7f11

- To resolve low severity vulnerability (see sveltejs/kit#12767) - Bump package versions

carl-underwood added a commit to carl-underwood/listen-later that referenced this pull request Nov 20, 2025

Add cookie override

bb1a674

- To resolve low severity vulnerability (see sveltejs/kit#12767) - Bump package versions

carl-underwood added a commit to carl-underwood/listen-later that referenced this pull request Nov 20, 2025

Add cookie override

13019c7

- To resolve low severity vulnerability (see sveltejs/kit#12767) - Bump package versions

carl-underwood mentioned this pull request Nov 20, 2025

Add cookie override carl-underwood/listen-later#82

Merged

carl-underwood added a commit to carl-underwood/listen-later that referenced this pull request Nov 20, 2025

Add cookie override

d4545d1

- To resolve low severity vulnerability (see sveltejs/kit#12767) - Bump package versions

nmontavon mentioned this pull request Jan 29, 2026

chore(deps): update all dependencies within their ranges techniq/layerstack#99

Open

Scotty42 mentioned this pull request Feb 14, 2026

Fix cookie vulnerability with npm overrides (GHSA-pxg6-pf52-xh8x) Scotty42/correspondence#22

Merged

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore: revert cookie upgrade#12767

chore: revert cookie upgrade#12767
dummdidumm merged 2 commits intomainfrom
revert-cookie

teemingc commented Oct 7, 2024 •

edited by dummdidumm

Loading

Uh oh!

changeset-bot bot commented Oct 7, 2024 •

edited

Loading

Uh oh!

hyunbinseo commented Oct 8, 2024

Uh oh!

teemingc commented Oct 8, 2024

Uh oh!

notramo commented Oct 9, 2024

Uh oh!

Conduitry commented Oct 9, 2024

Uh oh!

hyunbinseo commented Nov 5, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

teemingc commented Oct 7, 2024 • edited by dummdidumm Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

Tests

Changesets

Edits

Uh oh!

changeset-bot bot commented Oct 7, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

hyunbinseo commented Oct 8, 2024

Uh oh!

teemingc commented Oct 8, 2024

Uh oh!

notramo commented Oct 9, 2024

Uh oh!

Conduitry commented Oct 9, 2024

Uh oh!

hyunbinseo commented Nov 5, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

teemingc commented Oct 7, 2024 •

edited by dummdidumm

Loading

changeset-bot bot commented Oct 7, 2024 •

edited

Loading