security: update tough-cookie dependency to 4.1.3

[BreakBB]

PR Checklist:

• [x] I have run npm test locally and all tests are passing.
• [x] I have added/updated tests for any new behavior.
• [x] If this is a significant change, an issue has already been created where the problem / solution was discussed: [N/A, or add link to issue here]

  Fixes #31 and therefore CVE-2023-26136

PR Description

As described in #31, the tough-cookie dependency had a prototype pollution issue before v4.1.3. This PR updates the tough-cookie dependency to fix this.

[LubosK]

Hi @tgriesser , could you or someone from the team take a look at this PR? Thx in andvance

[tim-bezhashvyly]

+1

[LubosK]

We've also just got our pipeline audit job stalled by this ):

You can temporary solved it by adding tough-cookie to resolutions in package.json. e.g. "resolutions": { "tough-cookie": "^4.1.3" },

[tim-bezhashvyly]

For npm

"overrides": {
  "tough-cookie": "^4.1.3"
}

works as a temporary fix.

[GoudekettingRM]

Bump

[herleraja]

any update on this PR approval ?

[jeffsays]

bump - any chance this gets fixed soon @tgriesser?

[anthony-b-dev]

needing this approved and merged in as well please

[MikeMcC399]

I have added related issues which affect the repo without this PR

• 35

• 36

• 37

yarn add tough-cookie

to update to ^4.1.3 causes an additional failure under Node.js 20 - installing and testing with Yarn (although it is already failing without the change).

[MikeMcC399]

npm install
npm audit --omit=dev

shows

found 0 vulnerabilities

with this PR. 👍🏻

[nagash77]

Hi everyone, sorry for the late response. This PR was not seen by our team. I am having someone take a look to get this PR ready for merge if possible. I see some failing checks at the moment. Thank you for your patience.

[cypress-app-bot]

:tada: This PR is included in version 2.88.12 :tada:

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot :package::rocket:

[G-Rath]

@nagash77 in case you've not seen it, there's also GHSA-p8p7-x288-28g6 which needs addressing - there is #30 and #28 open for that