Forced cookie path change breaks re-use of CookieSerializeOptions

[hmnd]

Describe the bug

The event.cookies.[get/set/delete] options type is no longer compatible with the CookieSerializeOptions type from cookie, with no alternative type provided by @sveltejs/kit.

Reproduction

const cookieOptions: CookieSerializeOptions = { path: base || '/', secure: true };
event.cookies.delete('session_id', cookieOptions);
event.cookies.delete('access_token', cookieOptions);
event.cookies.delete('refresh_token', cookieOptions);

results in this error:

Argument of type 'CookieSerializeOptions' is not assignable to parameter of type 'CookieSerializeOptions & { path: string; }'.
  Type 'CookieSerializeOptions' is not assignable to type '{ path: string; }'.
    Types of property 'path' are incompatible.
      Type 'string | undefined' is not assignable to type 'string'.
        Type 'undefined' is not assignable to type 'string'.

Logs

No response

System Info

System:
    OS: Linux 6.6 Manjaro Linux
    CPU: (12) x64 Intel(R) Core(TM) i7-9750H CPU @ 2.60GHz
    Memory: 8.15 GB / 15.54 GB
    Container: Yes
    Shell: 5.9 - /usr/bin/zsh
  Binaries:
    Node: 20.10.0 - ~/.asdf/installs/nodejs/20.10.0/bin/node
    npm: 10.2.3 - ~/.asdf/plugins/nodejs/shims/npm
    pnpm: 8.14.0 - ~/.local/share/pnpm/pnpm
  Browsers:
    Brave Browser: 121.1.62.153
    Chromium: 120.0.6099.129

Severity

annoyance

Additional Information

Change happened in Ideally, SvelteKit should export its own CookieSerializeOptions, to make such reuse of options more ergonomic.

[eltigerchino]

A good workaround for now is to use the satisfies keyword for a more accurate type https://www.typescriptlang.org/docs/handbook/release-notes/typescript-4-9.html wondering if this should just be the definitive solution

[msikma]

Related, it seems that the cookie package is now on version 1.0.1 (Kit uses 0.6.0) and it now has a type named SerializeOptions. The @types/cookie package is still 0.6.0. It's a bit confusing for the end user, since the docs say to just import('cookie').CookieSerializeOptions.

[dummdidumm]

@eltigerchino could you give details on why you marked this as a breaking change for 3.0?

[eltigerchino]

I think it's because we want to use the exported type from the cookie package but upgrading the package will break the existing cookie name parsing behaviour #12768 (comment)

[BCsabaEngine]

You should update cookie from 0.6.0 (Nov 21, 2023) to a recent version. And of course correct the interface breaking change.

Now:

# npm audit report

cookie  <0.7.0
cookie accepts cookie name, path, and domain with out of bounds characters - https://github.com/advisories/GHSA-pxg6-pf52-xh8x
fix available via `npm audit fix --force`
Will install @sveltejs/kit@0.0.30, which is a breaking change
node_modules/@sveltejs/kit/node_modules/cookie
  @sveltejs/kit  >=1.0.0-next.0
  Depends on vulnerable versions of cookie
  node_modules/@sveltejs/kit
    @sveltejs/adapter-node  >=1.0.0-next.0
    Depends on vulnerable versions of @sveltejs/kit
    node_modules/@sveltejs/adapter-node

All versions are up2date:

	"devDependencies": {
        ...
		"@sveltejs/adapter-node": "^5.2.11",
		"@sveltejs/kit": "^2.15.2",
        ...

[huangsam]

This also poses a low security risk to downstream consumers of SvelteKit as well:

https://github.com/huangsam/huangsam.github.io/security/dependabot/78