22.1.0 (2026-11-14)

Bug Fixes

• cookie-service: force Secure for SameSite=None when secure is omitted (00b7ad7), closes #437
• cookie-service: preserve "=" in values returned by getAll() (aaba4ff), closes #391 #433
• cookie-service: stop mutating the options object passed to set() (b082604), closes #438
• force Secure for Partitioned cookies and keep positional partitioned (26c0285), closes #439
• handle cookies named "hasOwnProperty" and "proto" (f29e3c7), closes #443
• make getAll() keep the first cookie when several share a name (f7c516f), closes #440
• skip cookies whose path or domain could inject attributes (1b8ecd6), closes #441
• ssr: don't write HttpOnly cookies from the browser (599bc0b), closes #444
• ssr: make reads during server rendering reflect earlier writes (e195861), closes #445

Features

• accept an options object in delete() and deleteAll() (c19c83c), closes #442
• SameSite/Partitioned Secure handling, attribute validation, delete options and SSR read-after-write (0c6a93a)