Dependency on cookie 0.6.0 fails npm audit

[joebowbeer]

GitHub Advisory Database says cookie 0.6.0 has issues, resulting in npm audit failure

GHSA-pxg6-pf52-xh8x

npm ls cookie
─┬ express@4.21.0
 └── cookie@0.6.0

Remedy: Upgrade to cookie 0.7.0

[mcandre]

Both Snyk and npm audit report this.

When can we expect fixes to be released, and hopefully later backported to previous major version series as well?

[anishkumar127]

same issue

[UlisesGascon]

Release proposals:

• Release: 4.21.1 #6031
• Release: 5.0.1 #6032

[UlisesGascon]

I will keep this issue open until the releases are published.

[UlisesGascon]

express 4.21.1 and 5.0.1 are available in npm with the patch 🥳