chore(deps): bump js-cookie and aws-amplify

[dependabot]

Bumps js-cookie to 3.0.8 and updates ancestor dependency aws-amplify. These dependencies need to be updated together.

Updates js-cookie from 2.2.1 to 3.0.8

Release notes

Sourced from js-cookie's releases.

v3.0.8

• Restore ES5 compatibility, inadvertently broken in 3.0.7 - #959
• Lift Node version restriction, inadvertently restricted to >= 20 in 3.0.7 - #956

v3.0.7

• Prevent cookie attribute injection: CVE-2026-46625 (eb3c40e)
• Add Partitioned attribute to readme (b994768)
• Publish to npm registry via trusted publisher exclusively (4dc71be)
• Ensure consistent behaviour for get('name') + get() (1953d30)

v3.0.5

• Remove npm version restriction in package.json - #818

v3.0.4

• Publish to npmjs.com with package provenance

v3.0.1

• Make package.json accessible in export - #727

v3.0.0

• Removed defaults in favor of a builder: now to supply an api instance with particular predefined (cookie) attributes there's Cookies.withAttributes(), e.g.:

const api = Cookies.withAttributes({
  path: '/',
  secure: true
})
api.set('key', 'value') // writes cookie with path: '/' and secure: true...

• The attributes that an api instance is configured with are exposed as attributes property; it's an immutable object and unlike defaults cannot be changed to configure the api.
• The mechanism to fall back to the standard, internal converter by returning a falsy value in a custom read converter has been removed. Instead the default converters are now exposed as Cookies.converter, which allows for implementing self-contained custom converters providing the same behavior:

const customReadConverter = (value, name) => {
  if (name === 'special') {
    return unescape(value)
  }
  return Cookies.converter.read(value)
}

• withConverter() no longer accepts a function as argument to be turned into a read converter. It is now required to always pass an object with the explicit type(s) of converter(s):

const api = Cookies.withConverter({
  read: (value, name) => unescape(value)
})

• The converter(s) that an api instance is configured with are exposed as converter property; it's an immutable object and cannot be changed to configure the api.
• Started providing library as ES module, in addition to UMD module. The module field in package.json points to an ES module variant of the library.
• Started using browser field instead of main in package.json (for the UMD variant of the library).
• Dropped support for IE < 10.
• Removed built-in JSON support, i.e. getJSON() and automatic stringifying in set(): use Cookies.set('foo', JSON.stringify({ ... })) and JSON.parse(Cookies.get('foo')) instead.
• Removed support for Bower.

... (truncated)

Commits

• d7a1096 Craft v3.0.8 release
• 248e685 Use existing Chrome with puppeteer
• fc04269 Remove QUnit related workaround in Grunt config
• 265a685 Tidy up package lock file
• 478e591 Disable Node deprecation DEP0044 for release workflow
• 331d524 Fix node version config for E2E test job
• 11d773d Ensure ECMAScript compatibility
• d788646 Remove engines property from package
• e7d9a4d Fix typo in test assertion message
• b5fca24 Make credentials use explicit in release workflow
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for js-cookie since your current version.

Updates aws-amplify from 5.3.15 to 5.3.39

Release notes

Sourced from aws-amplify's releases.

2024-12-10 Amplify JS release - aws-amplify@5.3.27

What's Changed

• fix(rtn-push-notification): wrong namespace is being used by @​HuiSF in aws-amplify/amplify-js#14060
• chore: use macos-latest in workflows by @​HuiSF in aws-amplify/amplify-js#14061
• chore: downgrade to macos-13 runner to let test passing with older detox version by @​HuiSF in aws-amplify/amplify-js#14065

Full Changelog: https://github.com/aws-amplify/amplify-js/compare/aws-amplify@5.3.26...aws-amplify@5.3.27

2024-10-15 Amplify JS release - aws-amplify@5.3.25

What's Changed

• fix(auth): request initiateAuth with retry by @​HuiSF in aws-amplify/amplify-js#13854

Full Changelog: https://github.com/aws-amplify/amplify-js/compare/aws-amplify@5.3.24...aws-amplify@5.3.25

2024-10-03 Amplify JS release - aws-amplify@5.3.24

What's Changed

• fix(storage): browser module resolution is not picked up by metro web by @​HuiSF in aws-amplify/amplify-js#13881

Full Changelog: https://github.com/aws-amplify/amplify-js/compare/aws-amplify@5.3.23...aws-amplify@5.3.24

Changelog

Sourced from aws-amplify's changelog.

5.3.39 (2026-07-22)

Note: Version bump only for package aws-amplify

5.3.38 (2026-07-09)

Note: Version bump only for package aws-amplify

5.3.37 (2026-07-04)

Note: Version bump only for package aws-amplify

5.3.36 (2026-07-04)

Note: Version bump only for package aws-amplify

5.3.35 (2026-06-15)

Bug Fixes

• complete partial v5-stable LTS release (publish remaining packages) (#14843) (b17999d), closes #14842

5.3.34 (2026-06-12)

Note: Version bump only for package aws-amplify

5.3.33 (2026-03-13)

Note: Version bump only for package aws-amplify

5.3.32 (2026-03-09)

Note: Version bump only for package aws-amplify

5.3.31 (2026-02-25)

Note: Version bump only for package aws-amplify

5.3.30 (2026-02-17)

Note: Version bump only for package aws-amplify

5.3.29 (2025-11-10)

Note: Version bump only for package aws-amplify

5.3.28 (2025-02-05)

Note: Version bump only for package aws-amplify

... (truncated)

Commits

• 86c7045 chore(release): Publish [ci skip]
• 0a8b2c5 chore(release): Publish [ci skip]
• 68a0df1 chore(release): Publish [ci skip]
• 757d67d chore(release): Publish [ci skip]
• da7f0e4 chore: upgrade TypeScript to 5.8.3 in v5 (#14852)
• 69166f4 chore(release): Publish [ci skip]
• b17999d fix: complete partial v5-stable LTS release (publish remaining packages) (#14...
• 1214d61 chore(release): Publish [ci skip]
• 3883ed4 chore(release): Publish [ci skip]
• 9e0742f chore(deps): upgrade aws-sdk in v5 to fix fast-xml-parser (#14749)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.