Skip to content

Update dependency cookie-parser to ~1.4.7#34

Open
dev-mend-for-github-com[bot] wants to merge 1 commit intomasterfrom
whitesource-remediate/cookie-parser-1.x
Open

Update dependency cookie-parser to ~1.4.7#34
dev-mend-for-github-com[bot] wants to merge 1 commit intomasterfrom
whitesource-remediate/cookie-parser-1.x

Conversation

@dev-mend-for-github-com
Copy link

This PR contains the following updates:

Package Type Update Change
cookie-parser dependencies minor ~1.3.5~1.4.7

By merging this PR, the below vulnerabilities will be automatically resolved:

Severity CVSS Score Vulnerability Reachability
Medium Medium 5.3 CVE-2024-47764

Release Notes

expressjs/cookie-parser (cookie-parser)

v1.4.7

Compare Source

==========

  • deps: cookie@​0.7.2
    • Fix object assignment of hasOwnProperty
  • deps: cookie@​0.7.1
    • Allow leading dot for domain
      • Although not permitted in the spec, some users expect this to work and user agents ignore the leading dot according to spec
    • Add fast path for serialize without options, use obj.hasOwnProperty when parsing
  • deps: cookie@​0.7.0
    • perf: parse cookies ~10% faster
    • fix: narrow the validation of cookies to match RFC6265
    • fix: add main to package.json for rspack
  • deps: cookie@​0.6.0
    • Add partitioned option
  • deps: cookie@​0.5.0
    • Add priority option
    • Fix expires option to reject invalid dates
    • pref: improve default decode speed
    • pref: remove slow string split in parse
  • deps: cookie@​0.4.2
    • pref: read value only when assigning in parse
    • pref: remove unnecessary regexp in parse

v1.4.6

Compare Source

==================

  • deps: cookie@​0.4.1

v1.4.5

Compare Source

==================

  • deps: cookie@​0.4.0

v1.4.4

Compare Source

==================

  • perf: normalize secret argument only once

v1.4.3

Compare Source

==================

  • deps: cookie@​0.3.1
    • perf: use for loop in parse

v1.4.2

Compare Source

==================

  • deps: cookie@​0.2.4
    • perf: enable strict mode
    • perf: use for loop in parse
    • perf: use string concatenation for serialization

v1.4.1

Compare Source

==================

  • deps: cookie@​0.2.3
  • perf: enable strict mode

v1.4.0

Compare Source

==================

  • Accept array of secrets in addition to a single secret
  • Fix JSONCookie to return undefined for non-string arguments
  • Fix signedCookie to return undefined for non-string arguments
  • deps: cookie@​0.2.2

  • If you want to rebase/retry this PR, check this box

@dev-mend-for-github-com dev-mend-for-github-com bot added the security fix Security fix generated by Mend label Feb 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

security fix Security fix generated by Mend

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants