Remove yiisoft/cookies dependency + Fix NullSession::getCookieParameters()

[vjik]

Q	A
Is bugfix?	✔️
New feature?	❌
Breaks BC?	❌

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (817d8aa) to head (80f144b).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files

@@             Coverage Diff             @@
##              master       #86   +/-   ##
===========================================
  Coverage     100.00%   100.00%           
- Complexity        73        77    +4     
===========================================
  Files              3         3           
  Lines            182       187    +5     
===========================================
+ Hits             182       187    +5     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

🟡 Changes recommended

The replacement serializer omits cookie-field validation, allowing malformed or attribute-injected headers.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Removes yiisoft/cookies by implementing session-cookie serialization internally and fixes NullSession cookie defaults.

Changes:

• Builds Set-Cookie headers directly in session middleware.
• Defines cookie parameter types and valid NullSession defaults.
• Expands middleware tests and simplifies test helpers.

File summaries

File	Description
src/SessionMiddleware.php	Implements cookie header generation.
src/SessionInterface.php	Defines the cookie parameter shape.
src/Session.php	Applies the shared Psalm type.
src/NullSession.php	Returns complete cookie defaults.
tests/SessionMiddlewareTest.php	Tests cookie serialization behavior.
tests/SessionTest.php	Simplifies session initialization.
tests/ConfigTest.php	Simplifies default parameter loading.
composer.json	Removes yiisoft/cookies.
CHANGELOG.md	Records the enhancement and fix.

Review details

• Files reviewed: 9/9 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[vjik]

We assume a SessionInterface implementation returns valid cookie parameters, so validating them here is out of scope.

In the common case (built-in SessionInterface implementation) cookie parameters come from PHP's own session configuration (session_get_cookie_params(), session_name()), and the cookie value is urlencode().