chore(deps): update dependency cookie to v0.7.0 [security]

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
cookie	dependencies	minor	0.6.0 -> 0.7.0

GitHub Vulnerability Alerts

CVE-2024-47764

Impact

The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. For example, serialize("userName=<script>alert('XSS3')</script>; Max-Age=2592000; a", value) would result in "userName=<script>alert('XSS3')</script>; Max-Age=2592000; a=test", setting userName cookie to <script> and ignoring value.

A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie.

Patches

Upgrade to 0.7.0, which updates the validation for name, path, and domain.

Workarounds

Avoid passing untrusted or arbitrary values for these fields, ensure they are set by the application instead of user input.

References

• https://github.com/jshttp/cookie/pull/167

---

Release Notes

jshttp/cookie (cookie)

v0.7.0: 0.7.0

Compare Source

• perf: parse cookies ~10% faster (#​144 by @​kurtextrem and #​170)
  • fix: narrow the validation of cookies to match RFC6265 (#​167 by @​bewinsnw)
  • fix: add main to package.json for rspack (#​166 by @​proudparrot2)

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - "before 4am" (UTC).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Updated (UTC)
screamer	✅ Ready (Inspect)	Visit Preview	Oct 8, 2024 7:05pm

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 23.44%. Comparing base (e8c35a3) to head (5d55c84).
Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #290   +/-   ##
=======================================
  Coverage   23.44%   23.44%           
=======================================
  Files          53       53           
  Lines         499      499           
  Branches       69       69           
=======================================
  Hits          117      117           
+ Misses        382      362   -20     
- Partials        0       20   +20     

Flag	Coverage Δ
jest	16.83% <ø> (ø)
storybook	93.02% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.