search

expressjs / session

Simple session middleware for Express
MIT License
6.27k stars 979 forks source link

Dependency on cookie version 0.6.0 triggers an npm audit failure #996

Open hello-alf opened 1 month ago

hello-alf commented 1 month ago

According to Github https://github.com/advisories/GHSA-pxg6-pf52-xh8x accepts cookie name, path, and domain with out of bounds characters

The solution to resolve the npm audit failure is to upgrade the cookie dependency from version 0.6.0 to version 0.7.0. This update addresses the security vulnerabilities identified in the audit.

UlisesGascon commented 1 month ago

@hello-alf if you are using Express... we are going to release a new version soon with the updated version included. See: https://github.com/expressjs/express/pull/6017

knolleary commented 1 month ago

@UlisesGascon can you clarify if doing the express release will also cause this repo to have its dependency updated and released?

We depend on both express and express-session - which both currently depend on cookie 0.6.0. Having a new release of express will be great, but we need express-session updating as well.

UlisesGascon commented 1 month ago

My fault, you are right @knolleary. We need to update cookie version in this repo too. Are willing to create the PR, @knolleary ? :+1:

knolleary commented 1 month ago

@UlisesGascon https://github.com/expressjs/session/pull/997 - hope I've follow the right conventions for the HISTORY file update.

UlisesGascon commented 1 month ago

This will be solve once 1.1.18 is released https://github.com/expressjs/session/pull/998