fix changelog

Author: unandyala

packages/commerce-sdk-react/CHANGELOG.md

@@ -1,6 +1,8 @@
+## [Unreleased]
+- Add HttpOnly session cookies for SLAS private client proxy [#3680](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/3680)
+
 ## v5.1.0-dev
 - Add Node 24 support. Drop Node 16 support. [#3652](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/3652)
-- Add HttpOnly session cookies for SLAS private client proxy [#3680](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/3680)
 
 ## v5.0.0 (Feb 12, 2026)
 - Upgrade to commerce-sdk-isomorphic v5.0.0 and introduce Payment Instrument SCAPI integration [#3552](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/3552)

packages/commerce-sdk-react/src/auth/index.ts

@@ -54,7 +54,7 @@ interface AuthConfig extends ApiClientConfigParams {
     refreshTokenRegisteredCookieTTL?: number
     refreshTokenGuestCookieTTL?: number
     hybridAuthEnabled?: boolean
-    /** When true, token response may be sanitized (tokens in HttpOnly cookies); only set non-token fields and use access_token_expires_at for expiry. */
+    /** When true, session tokens are set as HttpOnly cookies */
     useHttpOnlySessionCookies?: boolean
 }
 

packages/commerce-sdk-react/src/provider.tsx

@@ -155,7 +155,6 @@ const CommerceApiProvider = (props: CommerceApiProviderProps): ReactElement => {
     const configLogger = logger || console
 
     // When HttpOnly cookies are enabled, ensure fetch credentials allow cookies to be sent.
-    // Override 'omit' or unset to 'same-origin'; keep 'same-origin' or 'include' as-is.
     const effectiveFetchOptions =
         useHttpOnlySessionCookies &&
         (!fetchOptions?.credentials || fetchOptions.credentials === 'omit')

packages/pwa-kit-create-app/CHANGELOG.md

@@ -1,4 +1,5 @@
 ## [Unreleased]
+- Add configuration flag `disableHttpOnlySessionCookies` to `ssrParameters` [#3635](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/3635)
 
 ## v3.17.0-dev
 - Clear verdaccio npm cache during project generation [#3652](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/3652)