tough-cookie 6.1.0 on Node.js NPM

Notable changes

`Secure` cookies are rejected when set from an insecure origin (#656, #663)

CookieJar now refuses to store a Secure cookie set from a URL that isn't potentially trustworthy, such as plain http://example.com, per RFC 6265bis §5.7 step 13. https: and wss: URLs are still accepted, and so are localhost and loopback addresses while allowSecureOnLocal is enabled (the default). setCookie() now rejects with Cookie is Secure but this is not a secure connection, or drops the cookie silently when ignoreError: true is passed.

This changes behavior that existing v6 code may rely on. To keep storing Secure cookies no matter which origin set them, opt out with:

new CookieJar(store, { enforceSecureOriginOnStorage: false })

The opt-out applies only to storage. On retrieval, Secure cookies are still returned only for secure origins, the same as in v6.0.x. The setting survives serialize()/deserialize() and clone().

Other behavior changes

__Host- cookies now need an explicit Path=/ attribute. Having the default path come out as / is no longer enough (#608).
Cookie.validate() now returns false for names that aren't valid HTTP tokens, such as empty names, names with separators or control characters, and non-ASCII names. Parsing and storage are unchanged (#650).
An explicit SameSite=None is now kept when serializing with Cookie.toString() and getSetCookieStrings(); it used to be dropped (#639).
An IPv4 address in the Domain attribute is now accepted instead of being treated as a public suffix (#630).

Additions

New exported PrefixSecurityMode type for the prefixSecurity option (#659, #667).
The getCookiesSync, getCookieString*, getSetCookieStrings* and setCookieSync methods now accept a URL as well as a string, matching their async counterparts (#655).

What's Changed

Fix documentation typos by @Martonveghcode in #613
chore: update CODEOWNERS by @wjhsf in #616
chore(deps): bump fast-uri from 3.1.2 to 3.1.5 by @dependabot[bot] in #623
chore(deps): bump postcss from 8.5.16 to 8.5.25 by @dependabot[bot] in #622
chore(deps): bump tldts from 7.4.5 to 7.4.10 in the production-dependencies group across 1 directory by @dependabot[bot] in #619
chore(deps-dev): bump brace-expansion from 2.1.0 to 2.1.4 by @dependabot[bot] in #629
chore(deps-dev): bump the dev-dependencies group across 1 directory with 9 updates by @dependabot[bot] in #628
fix: decode request path for URL object inputs, matching string inputs by @spokodev in #636
chore(deps): bump @vitest/mocker and vitest by @dependabot[bot] in #638
fix: require explicit Path attribute for __Host- prefixed cookies by @spokodev in #608
chore(deps-dev): bump the dev-dependencies group across 1 directory with 6 updates by @dependabot[bot] in #645
chore(deps): bump js-yaml and @microsoft/api-documenter by @dependabot[bot] in #648
chore(deps-dev): bump brace-expansion from 2.1.4 to 2.1.7 by @dependabot[bot] in #649
fix: treat an infinite max-age as never expiring in expiryTime() by @kwy404 in #644
chore(deps): bump tldts from 7.4.10 to 7.4.16 in the production-dependencies group across 1 directory by @dependabot[bot] in #632
chore(deps): bump fast-uri from 3.1.5 to 3.1.7 by @dependabot[bot] in #635
chore(deps): bump source-map-js from 1.2.1 to 1.2.2 by @dependabot[bot] in #652
Preserve explicit SameSite=None in cookie headers by @Shubham-Padkonde in #639
docs: fix README examples and references by @colincasey in #653
ci: type check test files by @colincasey in #655
fix: validate cookie names against the HTTP token grammar by @codesbysaravana in #650
fix: accept IPv4 Domain attributes instead of treating them as public suffixes by @tzh476 in #630
chore(deps): bump vite from 8.2.2 to 8.3.4 by @dependabot[bot] in #662
chore(deps): bump @vitest/mocker and vitest by @dependabot[bot] in #666
feat: introduce PrefixSecurityMode string literal union type by @reginaldalfret in #659
fix(CookieJar): revert prefixSecurity refinement by @wjhsf in #667
fix: reject Secure cookies set over untrustworthy origins by @awaterma in #656
feat: add enforceSecureOriginOnStorage option to opt out of Secure-cookie origin rejection by @colincasey in #663
ci: stop patching jsdom WPT expectations in integration tests by @colincasey in #664
chore(deps-dev): bump vitest from 4.1.12 to 5.0.5 by @dependabot[bot] in #672
chore(deps): bump fast-uri from 3.1.7 to 3.1.9 by @dependabot[bot] in #668
chore(deps): bump tldts from 7.4.16 to 7.4.19 in the production-dependencies group across 1 directory by @dependabot[bot] in #669
chore(deps): bump esbuild and tsup by @dependabot[bot] in #674
chore(deps-dev): bump the dev-dependencies group across 1 directory with 9 updates by @dependabot[bot] in #675

New Contributors

@Martonveghcode made their first contribution in #613
@spokodev made their first contribution in #636
@kwy404 made their first contribution in #644
@Shubham-Padkonde made their first contribution in #639
@codesbysaravana made their first contribution in #650
@tzh476 made their first contribution in #630
@reginaldalfret made their first contribution in #659

Full Changelog: v6.0.2...v6.1.0

tough-cookie 6.1.0 v6.1.0 on Node.js NPM