Bump cookie, express-mysql-session, express-session and socket.io by dependabot[bot] · Pull Request #80 · shall-we/final_server

dependabot · 2026-07-28T04:54:24Z

Bumps cookie to 0.7.2 and updates ancestor dependencies cookie, express-mysql-session, express-session and socket.io. These dependencies need to be updated together.

Updates cookie from 0.3.1 to 0.7.2

Release notes

Sourced from cookie's releases.

v0.7.2

Fixed

Fix object assignment of hasOwnProperty (#177) bc38ffd

jshttp/cookie@v0.7.1...v0.7.2

0.7.1

Fixed

Allow leading dot for domain (#174)

Although not permitted in the spec, some users expect this to work and user agents ignore the leading dot according to spec

Add fast path for serialize without options, use obj.hasOwnProperty when parsing (#172)

jshttp/cookie@v0.7.0...v0.7.1

0.7.0

perf: parse cookies ~10% faster (#144 by @kurtextrem and #170)

fix: narrow the validation of cookies to match RFC6265 (#167 by @bewinsnw)

fix: add main to package.json for rspack (#166 by @proudparrot2)

jshttp/cookie@v0.6.0...v0.7.0

0.6.0

Add partitioned option

0.5.0

Add priority option

Fix expires option to reject invalid dates

pref: improve default decode speed

pref: remove slow string split in parse

0.4.2

pref: read value only when assigning in parse

pref: remove unnecessary regexp in parse

0.4.1

Fix maxAge option to reject invalid values

0.4.0

Add SameSite=None support

Commits

d19eaa1 0.7.2
bc38ffd Fix object assignment of hasOwnProperty (#177)
cf4658f 0.7.1
6a8b8f5 Allow leading dot for domain (#174)
58015c0 Remove more code and perf wins (#172)
ab057d6 0.7.0
5f02ca8 Migrate history to GitHub releases
a5d591c Migrate history to GitHub releases
51968f9 Skip isNaN
9e7ca51 perf(parse): cache length, return early (#144)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by blakeembrey, a new releaser for cookie since your current version.

Updates express-mysql-session from 2.1.8 to 3.0.3

Release notes

Sourced from express-mysql-session's releases.

v3.0.3

Updated dependencies

v3.0.2

Updated dependencies

v3.0.1

Updated dependencies

v3.0.0

Added "disableTouch" option.

Switched MySQL client dependency from mysql to mysql2 module.

General clean-up, including removal of several dependencies.

express-session module no longer included as a direct dependency.

Upgraded remaining dependencies to latest versions.

Breaking API changes:

Old constructor usage from "0.x" version no longer supported - e.g. must now pass session module - require('express-mysql-session')(session)

Constructor no longer takes a callback. Use sessionStore.onReady() to get a promise which will resolve when the store is ready or reject on error.

See readme for latest usage details.

Changelog

Sourced from express-mysql-session's changelog.

Changelog

v3.0.3:

Updated dependencies

v3.0.2:

Updated dependencies

v3.0.1:

Updated dependencies

v3.0.0:

Added "disableTouch" option.

Switched MySQL client dependency from mysql to mysql2 module.

General clean-up, including removal of several dependencies.

express-session module no longer included as a direct dependency.

Upgraded remaining dependencies to latest versions.

Breaking API changes:

Old constructor usage from "0.x" version no longer supported - e.g. must now pass session module - require('express-mysql-session')(session)

Constructor no longer takes a callback. Use sessionStore.onReady() to get a promise which will resolve when the store is ready or reject on error.

See readme for latest usage details.

v2.1.8:

Updated dependencies

v2.1.7:

Updated dependencies

v2.1.6:

Updated dependencies

v2.1.5:

Updated dependencies

v2.1.4:

Updated dependencies

v2.1.3:

Update mysql module to "fix Amazon RDS profile for yaSSL MySQL servers with 2019 CA"; see here for more information.

v2.1.2:

Fix for [issue #97](chill117/express-mysql-session#97). The new default type for the session data field is now mediumtext. This will allow up to 16MB of data to be stored per session. Existing session database tables will keep the old behavior which was limited to 64KB of data per session.

v2.1.0:

get, all, and length will now exclude expired sessions. See #89 for more details.

Removed grunt; now using npm run tasks.

Updated dependencies

v2.0.1:

Updated dependencies

v2.0.0:

Added new flag clearExpired which when set to false will prevent expired sessions from being deleted automatically. The default value is true so the default behavior remains unchanged.

Fix for MySQL warning regarding unnecessary LIMIT 1 clauses. See #82 for more details.

Throw error when defining an unknown column in the schema option. See #83 for more details.

Removed deprecated methods (clone, closeStore, defaults, isObject, setDefaultOptions, sync)

v1.3.0:

Updated dependencies

Fix for [issue #78](chill117/express-mysql-session#78)

Added support for promises in mysql query function; now works with node-mysql2's promise-only connections

v1.2.3:

Updated dependencies

MySQLStore.close() will no longer end the database connection (if provided via constructor). See [issue #70](chill117/express-mysql-session#70) for more information. A new option has been added (endConnectionOnClose) to control this behavior.

... (truncated)

Commits

77d7a1e Version
b6867ed Upgrade mysql2
6fd2304 Use latest, supported versions of nodejs in github actions
a9fefdf Version
3adb18a Update dependencies
7c7ceaf Version
b3a9c3f Updated dependencies
85e61e7 Added note re: mariadb compatibility
78f5d2f Fixup readme, package-lock, and CI naming
98a6958 Major refactor
See full diff in compare view

Updates express-session from 1.16.1 to 1.19.0

Release notes

Sourced from express-session's releases.

v1.19.0

What's Changed

Main Changes
Add dynamic cookie options support Cookie options can now be dynamic, allowing for more flexible and context-aware configuration based on each request. This feature enables programmatic modification of cookie attributes like secure, httpOnly, sameSite, maxAge, domain, and path based on session or request conditions.
var app = express()
app.use(session({
  secret: 'keyboard cat',
  resave: false,
  saveUninitialized: true,
  cookie: function (req) {
    var match = req.url.match(/^\/([^/]+)/);
    return {
      path: match ? '/' + match[1] : '/',
      httpOnly: true,
      secure: req.secure || false,
      maxAge: 60000
    }
  }
}))
Add sameSite 'auto' support for automatic SameSite attribute configuration Added sameSite: 'auto' option for cookie configuration that automatically sets SameSite=None for HTTPS and SameSite=Lax for HTTP connections, simplifying cookie handling across different environments.

deps: use tilde notation for dependencies
PRs

chore: add funding to package.json by @bjohansebas in expressjs/session#1071

build(deps): bump actions/download-artifact from 4.3.0 to 6.0.0 by @dependabot[bot] in expressjs/session#1086

build(deps): bump github/codeql-action from 3.28.18 to 4.31.2 by @dependabot[bot] in expressjs/session#1085

build(deps): bump coverallsapp/github-action from 2.3.6 to 2.3.7 by @dependabot[bot] in expressjs/session#1091

build(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 by @dependabot[bot] in expressjs/session#1090

build(deps): bump github/codeql-action from 4.31.2 to 4.31.6 by @dependabot[bot] in expressjs/session#1089

build(deps): bump actions/checkout from 4.2.2 to 6.0.0 by @dependabot[bot] in expressjs/session#1088

build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.3 by @dependabot[bot] in expressjs/session#1082

refactor: remove unused sess parameter from generateSessionId fun… by @Ayoub-Mabrouk in expressjs/session#1001

chore: remove history.md from being packaged on publish by @bjohansebas in expressjs/session#1097

deps: use tilde notation for dependencies by @bjohansebas in expressjs/session#1096

Add sameSite 'auto' support to match secure 'auto' pattern by @djunehor in expressjs/session#1087

feat: add support to dynamic cookie options by @lincond in expressjs/session#1027

Release: 1.19.0 by @UlisesGascon in expressjs/session#1107

New Contributors

@Ayoub-Mabrouk made their first contribution in expressjs/session#1001

@djunehor made their first contribution in expressjs/session#1087

@lincond made their first contribution in expressjs/session#1027

... (truncated)

Changelog

Sourced from express-session's changelog.

1.19.0 / 2026-01-22

Add dynamic cookie options support

Add sameSite 'auto' support for automatic SameSite attribute configuration

deps: use tilde notation for dependencies

1.18.2 / 2025-07-17

deps: mocha@10.8.2

deps: on-headers@~1.1.0

Fix CVE-2025-7339 (GHSA-76c9-3jph-rj3q)

1.18.1 / 2024-10-08

deps: cookie@0.7.2

Fix object assignment of hasOwnProperty

deps: cookie@0.7.1

Allow leading dot for domain

Although not permitted in the spec, some users expect this to work and user agents ignore the leading dot according to spec

Add fast path for serialize without options, use obj.hasOwnProperty when parsing

deps: cookie@0.7.0

perf: parse cookies ~10% faster

fix: narrow the validation of cookies to match RFC6265

fix: add main to package.json for rspack

1.18.0 / 2024-01-28

Add debug log for pathname mismatch

Add partitioned to cookie options

Add priority to cookie options

Fix handling errors from setting cookie

Support any type in secret that crypto.createHmac supports

deps: cookie@0.6.0

Fix expires option to reject invalid dates

perf: improve default decode speed

perf: remove slow string split in parse

deps: cookie-signature@1.0.7

1.17.3 / 2022-05-11

Fix resaving already-saved new session at end of request

deps: cookie@0.4.2

1.17.2 / 2021-05-19

... (truncated)

Commits

c10b2a3 1.19.0 (#1107)
2673736 feat: add support to dynamic cookie options (#1027)
73e0193 Add sameSite 'auto' support to match secure 'auto' pattern (#1087)
264b6a0 deps: use tilde notation for dependencies (#1096)
6d69f09 chore: remove history.md from being packaged on publish (#1097)
00b8a5f refactor: remove unused sess parameter from generateSessionId function (#...
2cd6561 build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.3 (#1082)
1307f30 build(deps): bump actions/checkout from 4.2.2 to 6.0.0 (#1088)
0e7a438 build(deps): bump github/codeql-action from 4.31.2 to 4.31.6 (#1089)
a095a9a build(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 (#1090)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for express-session since your current version.

Updates socket.io from 2.5.0 to 4.8.3

Release notes

Sourced from socket.io's releases.

socket.io@4.8.3

Bug Fixes

do not throw when calling io.close() on a stopped server (9581f9b)

Dependencies

engine.io@~6.6.0 (no change)

ws@~8.18.3 (no change)

socket.io-client@4.8.3

There were some minor bug fixes on the server side, which mandate a client bump.

Dependencies

engine.io-client@~6.6.1 (no change)

ws@~8.18.3 (diff)

socket.io-parser@3.4.4

This release includes a fix for CVE-2026-33151. Please upgrade as soon as possible.

Bug Fixes

add a limit to the number of binary attachments (719f9eb)

socket.io-parser@3.3.5

This release includes a fix for CVE-2026-33151. Please upgrade as soon as possible.

Bug Fixes

add a limit to the number of binary attachments (9d39f1f)

socket.io-parser@4.2.6

This release includes a fix for CVE-2026-33151. Please upgrade as soon as possible.

Bug Fixes

add a limit to the number of binary attachments (b25738c)

socket.io-adapter@2.5.6

This release contains a bump of:

ws from ~8.17.1 to ~8.18.3

debug from ~4.3.1 to ~4.4.1

socket.io-parser@4.2.5

This release contains a bump of debug from ~4.3.1 to ~4.4.1.

socket.io@4.8.2

... (truncated)

Commits

9978574 chore(release): socket.io@4.8.3
e9e5bed chore(release): socket.io-client@4.8.3
9581f9b fix(sio): do not throw when calling io.close() on a stopped server
579d43f refactor: remove unused files
ee9aac3 chore(release): socket.io-parser@4.2.5
968277c chore(release): socket.io-adapter@2.5.6
2bf16bd chore(release): engine.io-client@6.6.4
ad61607 docs(eio): fix link in the release notes
dd71792 chore(release): socket.io@4.8.2
bb0b480 fix(sio): improve io.close() function (#5344)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for socket.io since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [cookie](https://github.com/jshttp/cookie) to 0.7.2 and updates ancestor dependencies [cookie](https://github.com/jshttp/cookie), [express-mysql-session](https://github.com/chill117/express-mysql-session), [express-session](https://github.com/expressjs/session) and [socket.io](https://github.com/socketio/socket.io). These dependencies need to be updated together. Updates `cookie` from 0.3.1 to 0.7.2 - [Release notes](https://github.com/jshttp/cookie/releases) - [Commits](jshttp/cookie@v0.3.1...v0.7.2) Updates `express-mysql-session` from 2.1.8 to 3.0.3 - [Release notes](https://github.com/chill117/express-mysql-session/releases) - [Changelog](https://github.com/chill117/express-mysql-session/blob/master/changelog.md) - [Commits](chill117/express-mysql-session@v2.1.8...v3.0.3) Updates `express-session` from 1.16.1 to 1.19.0 - [Release notes](https://github.com/expressjs/session/releases) - [Changelog](https://github.com/expressjs/session/blob/master/HISTORY.md) - [Commits](expressjs/session@v1.16.1...v1.19.0) Updates `socket.io` from 2.5.0 to 4.8.3 - [Release notes](https://github.com/socketio/socket.io/releases) - [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md) - [Commits](https://github.com/socketio/socket.io/compare/2.5.0...socket.io@4.8.3) --- updated-dependencies: - dependency-name: cookie dependency-version: 0.7.2 dependency-type: indirect - dependency-name: express-mysql-session dependency-version: 3.0.3 dependency-type: direct:production - dependency-name: express-session dependency-version: 1.19.0 dependency-type: direct:production - dependency-name: socket.io dependency-version: 4.8.3 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 28, 2026

Navigation Menu

Uh oh!

Bump cookie, express-mysql-session, express-session and socket.io - #80

Bump cookie, express-mysql-session, express-session and socket.io#80
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-2b30107b67

dependabot Bot commented on behalf of github Jul 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 28, 2026

v0.7.2

0.7.1

0.7.0

0.6.0

0.5.0

0.4.2

0.4.1

0.4.0

v3.0.3

v3.0.2

v3.0.1

v3.0.0

Changelog

v1.19.0

What's Changed

Main Changes

PRs

New Contributors

1.19.0 / 2026-01-22

1.18.2 / 2025-07-17

1.18.1 / 2024-10-08

1.18.0 / 2024-01-28

1.17.3 / 2022-05-11

1.17.2 / 2021-05-19

socket.io@4.8.3

Bug Fixes

Dependencies

socket.io-client@4.8.3

Dependencies

socket.io-parser@3.4.4

Bug Fixes

socket.io-parser@3.3.5

Bug Fixes

socket.io-parser@4.2.6

Bug Fixes

socket.io-adapter@2.5.6

socket.io-parser@4.2.5

socket.io@4.8.2

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants