Skip to content

Upgrading js-cookie 2 to 3

Breaking2.2.1 → 3.0.8Breaking10Security1Platform2New3Changed6Fixed12Other5

Full comparisonBack to js-cookie
BreakingUpgrade verdict

9 breaking changes and 2 platform requirement changes and a security fix.

In plain terms
  • You can no longer change global default cookie settings. Instead, create a separate cookie API with your own defaults.
  • You must now convert objects to and from JSON yourself when storing them in cookies.
  • You must now pass an object naming which converters you want, such as a read converter, instead of a bare function.
  • The package can no longer be installed through Bower.
Must act Top 5 of 12 that need code or config changes

What you must change

Breaking9
Removes defaults in favor of Cookies.withAttributes() for creating an API instance with predefined cookie attributes.
defaultsCookies.withAttributes()api.set()
3.0.0GitHub ReleaseSummarizedView source
Removes built-in JSON support, including getJSON() and automatic stringifying in set().
getJSON()set()Cookies.set()Cookies.get()JSON.stringify()JSON.parse()
3.0.0GitHub ReleaseSummarizedView source
withConverter() no longer accepts a function argument and requires an object with explicit converter types.
withConverter()
3.0.0GitHub ReleaseSummarizedView source
Removes support for Bower.
3.0.0GitHub ReleaseSummarizedView source
Exposes configured attributes as an immutable attributes property that cannot be changed to configure the API.
attributesdefaults
3.0.0GitHub ReleaseSummarizedView source
Removes the falsy-return fallback to the internal converter in custom read converters; default converters are now exposed as Cookies.converter.
Cookies.converterCookies.converter.read()
3.0.0GitHub ReleaseSummarizedView source
Exposes configured converters as an immutable converter property that cannot be changed to configure the API.
converter
3.0.0GitHub ReleaseSummarizedView source
Cookie name and value encoding now percent-encodes only ";" and "=" in names and ";" in values, instead of the stricter RFC 6265 section 4 rules.
3.0.0-beta.4GitHub ReleaseSummarizedView source
Makes the entire api instance immutable.
3.0.0-beta.1GitHub ReleaseSummarizedView source
Security1
Prevents cookie attribute injection (CVE-2026-46625).
High · CVSS 7.5
3.0.7GitHub ReleaseSummarizedView source
Platform2
No longer supports Node below 12 when building, targeting LTS versions only.
3.0.0GitHub ReleaseSummarizedView source
No longer supports Node 6 when building; only LTS versions are supported.
3.0.0-beta.0GitHub ReleaseSummarizedView source