Dependency on cookie version 0.6.0 triggers an npm audit failure #996
Description
According to Github GHSA-pxg6-pf52-xh8x
accepts cookie name, path, and domain with out of bounds characters
The solution to resolve the npm audit failure is to upgrade the cookie dependency from version 0.6.0 to version 0.7.0. This update addresses the security vulnerabilities identified in the audit.
Activity
UlisesGascon commentedon Oct 7, 2024
@hello-alf if you are using Express... we are going to release a new version soon with the updated version included. See: expressjs/express#6017
knolleary commentedon Oct 8, 2024
@UlisesGascon can you clarify if doing the express release will also cause this repo to have its dependency updated and released?
We depend on both
expressandexpress-session- which both currently depend on cookie 0.6.0. Having a new release ofexpresswill be great, but we needexpress-sessionupdating as well.UlisesGascon commentedon Oct 8, 2024
My fault, you are right @knolleary. We need to update cookie version in this repo too. Are willing to create the PR, @knolleary ? 👍
knolleary commentedon Oct 8, 2024
@UlisesGascon #997 - hope I've follow the right conventions for the HISTORY file update.
UlisesGascon commentedon Oct 8, 2024
This will be solve once 1.1.18 is released #998