Update cookie semver lock to address CVE-2024-47764

[joshbuker]

Per CVE-2024-47764 (GHSA-pxg6-pf52-xh8x), versions < 0.7.0 of cookie have a low severity vulnerability.

Because express uses a strict semver lock of 0.6.0 this will cause downstream projects to pull a vulnerable version of cookie unless they explicitly overwrite the resolution in their package.json with:

"resolutions": {
  "cookie": ">= 0.7.0"
},

Updating the semver to ^0.7.1 to both resolve the vulnerability and allow backwards compatible updates in the future.

Fixes #6019

[kurt-apple]

This PR fixes #6019

[RobinTail]

Should be no breaking changes https://github.com/jshttp/cookie/releases

@wesleytodd , please review

[bjohansebas]

Please update the history file

[joshbuker]

@bjohansebas Updated the history file. If it doesn't look quite right, or you'd like to make other changes, maintainer edits on the PR are enabled. Thanks!

[G-Rath]

I'm conscious that this is against the v5 branch which isn't actually released and even if it was express v4 underpins half of the big players in the ecosystem so would like to get the ball rolling as much as possible on backporting: is that something people are open to, and if so would it be helpful to open a PR against the v4 branch or is the preferred process to wait until this is landed on v5 then cherry-pick or...?

I have the bandwidth for doing a PR to the v4 branch if that is the process

[RobinTail]

This PR targets master branch having v5 merged and released

[G-Rath]

sorry I meant released as the latest version - I thought it was still in the final beta period which is why it's not tagged as latest on NPM:

Either way I think it's going to be a long time until the rest of the ecosystem has caught up given that v5 requires a min. of Node v18 and how widespread its usage is, so it'd still be very useful to have it backported to v4.

[RobinTail]

it'd still be very useful to have it backported to v4

I agree. No doubt.
It should be backported/cherry-picked into 4.x branch after it's fixed in master.

[UlisesGascon]

I will prepare a release today/tomorrow that includes this PR and other things.

@joshbuker are you willing to create another PR targeting branch 4.x as suggested by @RobinTail ? That way we cover 4.x too 👍 Otherwise I can do the cherry pick once this is landed in master.

[jasonhocker]

Will this also update express-session's version of cookie that is used?

[med-Haithem]

I will prepare a release today/tomorrow that includes this PR and other things.

@joshbuker are you willing to create another PR targeting branch 4.x as suggested by @RobinTail ? That way we cover 4.x too 👍 Otherwise I can do the cherry pick once this is landed in master.

Please when a new patch will be realeased in v4.21 ?

[pumano]

Would love to see it landed to 4.x branch too (and released).

[joshbuker]

Sure, I can create a PR for the 4.x branch as well. Thanks for the ping @UlisesGascon, @kurt-apple.

Edit: Created #6029

[shivam-sharma7]

@UlisesGascon @blakeembrey I think we should use v1.0.0 instead 0.7.1 see changelog-> https://github.com/jshttp/cookie/releases/tag/v1.0.0

I can provide a PR! if you agree?

[UlisesGascon]

@shivam-sharma7 thanks for the proposition, feel free to create a PR for this 👍

[blakeembrey]

Upgrading to 1.0.0 would have breaking changes and would be better for an Express 6 release, since 5 is already released.

[shivam-sharma7]

@blakeembrey and @UlisesGascon Thanks for suggetion. Let's keep track in issue or ... ?

[NewEraCracker]

My take:

• 0.7.2 for express 4
• 1.0.0 for express 5

The breaking change of 1.0.0 is because it only supports node.js 18+ like express 5 only supports node.js 18+.

My two cents.

[RobinTail]

Upgrading to 1.0.0 would have breaking changes

I also did't understand this.
If the only breaking change is Node.js version, then it's fully compatible with Express 5 conditions.

[blakeembrey]

It's definitely not just the node version, the release notes are here: https://github.com/jshttp/cookie/releases/tag/v1.0.0

Please don't just bump things without checking release notes for breaking changes.

[blakeembrey]

Let's keep track in issue or ... ?

Probably an issue or PR that we should tag with "express 6", I don't think there's a dev branch for it yet to target.

[RobinTail]

without checking release notes for breaking changes

It would be easier if you could mark some of those changes as breaking, @blakeembrey
Since currently it's not so obvious, right?

[blakeembrey]

Understandable, the entire section called "Changed" is breaking changes, is there a preferred title you use? Usually a major version implies breaking changes, so I haven't had this be an issue before.

[shivam-sharma7]

Let's keep track in issue or ... ?

Probably an issue or PR that we should tag with "express 6", I don't think there's a dev branch for it yet to target.

Yeah, I think we should have a branch for express 6