I have one questions before I approve, since, at first glance, it seems like a pretty impactful change. Do you think that this change can have negative side effects for consumers of the SimpleRequestsClient. Where a concatenated string would be expected instead of a list for other headers? I am sure that upstream tests would reveal but I am still curious if it could impact users code beyond the Set-Cookie header. 🤔

I think if end users of the product had this kind of response, it was wrong and would have been different in AWS, so I'd class this in the "parity" kind of fix.

But for the consumers of the SimpleRequestsClient, they should be able to handle proper Werkzeug Headers, and usually will return the response directly as is and would not manipulate the response of the SimpleRequestsClient as it most often used as a Proxy.

I'd say this is a pretty major flaw we have now that needs to be fixed, even if breaking some consumers. I would also argue that this is the advertised behavior of the Werkzeug headers, and we are breaking its API currently, and should properly use the data structure. I probably wouldn't limit the fix to Set-Cookie.

In itself and with the libraires we have been using, we didn't see the difference in behavior until now (which was kinda bad) but also shows that we shouldn't have an issue the other way around.