Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix dependency on vulnerable cookie<0.7.0 #1803

Open
6 tasks done
spolu opened this issue Nov 13, 2024 · 4 comments
Open
6 tasks done

Fix dependency on vulnerable cookie<0.7.0 #1803

spolu opened this issue Nov 13, 2024 · 4 comments

Comments

@spolu
Copy link

spolu commented Nov 13, 2024

Checklist

Description

Current version 3.5.0 depends on cookie 0.6.0 which is has a low severity vulnerability.

This is triggers Github Dependabot as well as any node library vulnerability scanning tooling. It should be an easy step

Reproduction

mkdir test && cd test
npm i @auth0/nextjs-auth0
npm audit fix

Additional context

No response

nextjs-auth0 version

3.5.0

Next.js version

N/A

Node.js version

v20.13.0

@dvdokkum
Copy link

dvdokkum commented Dec 3, 2024

We have an SLA coming up on this... any input from the Auth0 team?

@aelithron
Copy link

aelithron commented Dec 3, 2024

This is also appearing for us. Auth0 team, please fix this ASAP.

@zachelrath
Copy link

Looks like this was addressed in this commit last week: 8fe35b4

Could the Auth0 team do a 3.x patch release to get this out ahead of the 4.x releases?

@dvdokkum
Copy link

@tusharpandey13 any update on the minor release referenced in this PR: #1778 (comment)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants