Nested dependency 'cookie' is flagged as a vulnerability

[troy-surepath]

node_modules/iron-session/node_modules/cookie iron-session <=8.0.3 Depends on vulnerable versions of cookie node_modules/iron-session @workos-inc/node >=7.15.0 Depends on vulnerable versions of iron-session

[josh-respectx]

As a follow-up on this, I understand that this issue arises because the package is still using iron-session v7, as v8 no longer supports Node v16. Are there any plans to drop support for Node v16, considering that other platforms (e.g., Vercel, AWS) are starting to phase it out?

[anuhyabs]

Any updates on this?

[wmurphyrd]

Adding the vulnerability tracker ids to make this more searchable

CVE-2024-47764

GHSA-pxg6-pf52-xh8x

[zkrzyzanowski]

Anyone who comes across this, we ended up using overrides to use a new version of cookie. This seems to work without issue in the v7.46.0 of this package

// package.json
 "overrides": {
        "cookie": "0.7.2"
    }