fix: update js-cookie to resolve CVE-2026-46625

[dannyneira]

Summary

Updates the transitive js-cookie dependency in package-lock.json from 3.0.5 to 3.0.7 to resolve CVE-2026-46625.

Vulnerability details

• Advisory: GHSA-qjx8-664m-686j
• Dependabot alert: https://github.com/warpdotdev/docs/security/dependabot/14
• Package: js-cookie
• Ecosystem: npm
• Severity: high
• Vulnerable range: <= 3.0.5
• Patched version: 3.0.7
• Relationship: transitive runtime dependency through @kapaai/react-sdk
• Summary: JavaScript Cookie per-instance prototype hijack in assign() enables cookie-attribute injection.

Changes

• Updated the node_modules/js-cookie lockfile entry to 3.0.7.
• Did not add js-cookie as a direct dependency or apply overrides.

Verification

• npx --yes npm@10.9.4 --prefix /workspace/docs audit --json no longer reports js-cookie.
• npx --yes npm@10.9.4 --prefix /workspace/docs run build completed successfully.

Co-Authored-By: Oz oz-agent@warp.dev

Conversation: https://staging.warp.dev/conversation/b4dcb29c-d5e9-4f9f-8c05-f0501e719963
Run: https://oz.staging.warp.dev/runs/019e506a-428f-793e-96c9-dfee0dcad0f9
This PR was generated with Oz.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	May 22, 2026 4:08pm

[oz-for-oss]

@dannyneira

I'm starting a first review of this pull request.

You can view the conversation on Warp.

I completed the review and no human review was requested for this pull request.

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

[oz-for-oss]

Overview

Updates the transitive js-cookie lockfile entry from 3.0.5 to 3.0.7 to address the reported high-severity advisory through @kapaai/react-sdk. The patched version remains within the existing ^3.0.5 dependency range, and its Node >=20 engine is compatible with this repo's declared Node 20/22/24 support and CI Node 22 setup.

Concerns

• No blocking concerns found. No approved spec context was available for this PR.

Verdict

Found: 0 critical, 0 important, 0 suggestions

Approve

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz