Vulnerability in cookie dependency https://github.com/advisories/GHSA-pxg6-pf52-xh8x

[rgglez]

Describe the bug

npm audit reports a vulnerability in the cookie dependency.

Reproduction

npm audit

Logs

# npm audit report

cookie  <0.7.0
cookie accepts cookie name, path, and domain with out of bounds characters - https://github.com/advisories/GHSA-pxg6-pf52-xh8x
fix available via `npm audit fix --force`
Will install @sveltejs/kit@0.0.30, which is a breaking change
node_modules/@sveltejs/kit/node_modules/cookie
  @sveltejs/kit  >=1.0.0-next.0
  Depends on vulnerable versions of cookie
  node_modules/@sveltejs/kit

2 low severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force

System Info

System:
    OS: Linux 6.12 Debian GNU/Linux 13 (trixie) 13 (trixie)
    CPU: (16) x64 AMD Ryzen 7 1700X Eight-Core Processor
    Memory: 41.63 GB / 62.71 GB
    Container: Yes
    Shell: 5.2.37 - /bin/bash
  Binaries:
    Node: 22.11.0 - ~/.nvm/versions/node/v22.11.0/bin/node
    npm: 11.2.0 - ~/.nvm/versions/node/v22.11.0/bin/npm
    pnpm: 10.12.3 - ~/.local/share/pnpm/pnpm
  Browsers:
    Brave Browser: 137.1.79.126
    Chrome: 137.0.7151.119
  npmPackages:
    @sveltejs/adapter-static: ^0.0.17 => 0.0.17 
    @sveltejs/kit: ^2.22.0 => 2.22.0 
    @sveltejs/vite-plugin-svelte: ^5.0.3 => 5.1.0 
    svelte: ^5.34.7 => 5.34.7 
    vite: ^6.0.11 => 6.3.5

Severity

annoyance

Additional Information

#13511 suggests to switch to cookie-es

[Conduitry]

Duplicate of several other issues - https://github.com/sveltejs/kit/issues?q=is%3Aissue%20cookie%20vulnerability - There's a pending PR for this: #13386

Also: #13512 (comment)