Investigate dependabot security alert #8 - tough cookie

[edhamiltonHO]

No description provided.

[keithkennedyHO]

@edhamiltonHO it appears this is being looked at upstream, there is an open issue for this. My suggestion would to wait until resolved.

[edhamiltonHO]

OK, do we have a view on the risk this presents to us?

I'd presume fairly low as related to cookies, which we aren't using, but would be good to be clear

[robertdeniszczyc2]

This looks to have been resolved in a release of cypress/request last week: https://github.com/cypress-io/request/releases/tag/v2.88.12

[keithkennedyHO]

@robertdeniszczyc2 Unfortunately, this is for the cypress/request package and not the main cypress (https://github.com/cypress-io/cypress/releases), which has not yet been updated with the fix.

[keithkennedyHO]

@robertdeniszczyc2 I misread that, apologies. Yes, hopefully the fix above suggests a fix for the cypress package will come soon to resolve this.

[robertdeniszczyc2]

Looks like there are two open PRs on Cypress for this:

cypress-io/cypress#27439

cypress-io/cypress#27493

[robertdeniszczyc2]

A fix has been merged under cypress-io/cypress#27515, hopefully will be included in the next release

[robertdeniszczyc2]

According to the thread the change was merged to Cypress in 12.17.4, from https://github.com/HO-CTO/engineering-guidance-and-standards/pull/248 we are now on 13.x so I think this can be closed