fix(KNO-13317): Remove js-cookie

[andy-knock]

Description

https://linear.app/knock/issue/KNO-13317/control-marketing-site-docs-small-upgrade-for-js-cookie

@kylemcd pointed out our usage is pretty trivial.

I rewrote the code to remove the dependency entirely instead of maintaining it

Test steps:

Open http://localhost:3002?utm_source=test&utm_medium=manual

Verify that cookies are set correctly

Refresh page without utm headers, verify cookies persist

[linear-code]

KNO-13317

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	May 26, 2026 5:01pm

[andy-knock]

• feat: Remove minimal js-cookie dependency entirely #1451
• fix(KNO-13317): Remove js-cookie  #1450 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[cursor]

Stale comment

Risk HIGH: Upgrades js-cookie from 3.0.5 to 3.0.7 to address a security vulnerability.

Reasons

• package.json is modified, which is an automatic HIGH risk trigger per classification rules
• yarn.lock is modified with updated dependency resolution
• The change itself is a minimal semver patch bump (3.0.5 → 3.0.7) for a single dependency
• The diff is very small (5 additions, 5 deletions across 2 files) with no functional code changes
• No application code, components, or content files are affected

Notes

• Despite the HIGH classification (triggered by package.json/yarn.lock modification), the actual risk profile of this change is low — it is a straightforward minor version bump of a single dependency for a security fix
• Reviewer should verify the js-cookie 3.0.7 changelog to confirm there are no breaking changes
• Confirm the Vercel preview deployment builds and functions correctly with the updated dependency
• Consider running a quick smoke test on any cookie-dependent functionality (e.g., analytics or consent tracking)

  

_{Sent by Cursor Automation: Docs PR classifier}

[kylemcd]

this honestly feels like a complete unnecessary dependency. only used in one place too. might just be better to remove it and refactor the one place it's used.

[andy-knock]

this honestly feels like a complete unnecessary dependency. only used in one place too. might just be better to remove it and refactor the one place it's used.

Won't merge this quite yet, Let me audit the usages across our codebase

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1ddbb79. Configure here.}

[cursor]

Risk HIGH: Removes the js-cookie dependency entirely and replaces it with native document.cookie helpers in lib/attribution.ts.

Reasons

• lib/attribution.ts is modified — a .ts file in lib/ triggers HIGH risk per classification rules
• package.json is modified (removes js-cookie from dependencies and @types/js-cookie from devDependencies), which is an automatic HIGH risk trigger
• yarn.lock is modified with dependency removals, and contains unresolved merge conflict markers (<<<<<<< HEAD, =======, >>>>>>>) that will break installs
• The refactor replaces a well-tested library with custom cookie read/write functions (38 new lines of utility code), which introduces functional risk around cookie encoding, expiry handling, and edge cases
• Total diff is small (46+/21- across 3 files), limiting blast radius despite the HIGH classification

Notes

• Critical: The yarn.lock file contains unresolved git merge conflict markers (lines with <<<<<<< HEAD, =======, and >>>>>>>) — this must be resolved before merging or yarn install will fail
• Reviewer should verify the custom getCookie regex handles all cookie name characters correctly (the regex escapes special chars, but edge cases with encoded values should be considered)
• The setCookie function accepts expires as either a number (days) or a Date — verify the 864e5 constant (86,400,000 ms = 1 day) produces correct expiry behavior
• The CookieOptions.sameSite is typed as string rather than a union type ("Strict" | "Lax" | "None") — consider tightening this for type safety
• Confirm the Vercel preview deployment builds and the UTM cookie attribution flow works end-to-end per the author's test steps

  

_{Sent by Cursor Automation: Docs PR classifier}

[cursor]

Merge conflict markers detected. This file contains unresolved git conflict markers (<<<<<<< HEAD, =======, >>>>>>>) which will cause yarn install to fail. This needs to be resolved before merging.

[kylemcd]

just need to remove the merge conflict markers and good to go 👍