fix(dependabot): fix tough-cookie security vulnerability #4212
Conversation
|
| version "4.1.2" | ||
| resolved "https://registry.npmjs.org/tough-cookie/-/tough-cookie-4.1.2.tgz#e53e84b85f24e0b65dd526f46628db6c85f6b874" | ||
| integrity sha512-G9fqXWoYFZgTc2z8Q5zaHy/vJMjm+WV0AkAeHxVCQiEB1b+dGvWzFW6QV07cY5jQ5gRkeid2qIkzkxUnmoQZUQ== | ||
| [email protected], tough-cookie@^4.0.0, tough-cookie@^4.1.2, tough-cookie@~2.5.0: |
There was a problem hiding this comment.
Looks like one of the dependencies uses a v2. A little bit concerned about there will be a runtime problem since the fix needs to bump 2 majors.
There was a problem hiding this comment.
I guess that could depend on whether we use cookies in Cypress?
There was a problem hiding this comment.
It looks like the v2 dependency comes from this dependency - cypress-io/request#31
Other people reporting the same issue, but yeah it seems to not be directly related to our library at least
|
Can you include the full |
=> Found "[email protected]"
|
Description of changes
tough-cookie@cypress/requesthas a~dependency on[email protected]which will spit out a warning, they have an issue to fix this - Vulnerable version of tough-cookie in use (2.5.0) CVE-2023-26136 cypress-io/request#31Issue #, if available
Description of how you validated changes
Checklist
yarn testpasses and tests are updated/addedsideEffectsfield updatedBy submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.