chore: update tough cookie #27515
chore: update tough cookie #27515
Conversation
There was a problem hiding this comment.
The version of jsdom we were using was using tough-cookie 2.5 but after further investigation this was the only file using jsdom and that it wasn't anywhere in the monorepo. I don't think we need this anymore
| @@ -198,7 +198,6 @@ | |||
| "shelljs": "0.8.5", | |||
| "sinon": "7.3.2", | |||
| "snap-shot-it": "7.9.3", | |||
| "start-server-and-test": "1.10.8", | |||
There was a problem hiding this comment.
start-server-and-test version 1 depends upon tough-cookie 2.5 but I don't see any use of start-server-and-test in the repo. I think we can remove this
4 flaky tests on run #49801 ↗︎
Details:
|
|||||||||||||||||||||||||||||||||
| Test | Artifacts | |
|---|---|---|
| network stubbing > intercepting request > can delay and throttle a StaticResponse |
Output
Video
|
|
cypress/cypress.cy.js • 3 flaky tests • 5x-driver-chrome:beta
| Test | Artifacts | |
|---|---|---|
| ... > correctly returns currentRetry |
Output
Video
|
|
| ... > correctly returns currentRetry |
Output
Video
|
|
| ... > correctly returns currentRetry |
Output
Video
|
|
This comment has been generated by cypress-bot as a result of this project's GitHub integration settings.
patches/whatwg-url+7.1.0.dev.patch
Outdated
There was a problem hiding this comment.
We were getting this error in CI saying that we don't need this patch anymore. Removing it appears to be the fix.
There was a problem hiding this comment.
Guess we figured out what was updating the hoisted dep. Thank you for removing this patch! We needed it for the webpack v5 update and glad it was shortlived.
jordanpowell88
force-pushed
the
chore/update_tough_cookie
branch
from
fa7100f
to
65a131f
Compare
jordanpowell88
force-pushed
the
chore/update_tough_cookie
branch
from
6c4ebfb
to
025c0a1
Compare
…e any longer. However, we want to set sameSite === undefined to lax as the default as this is the case in every standard browser, except firefox. We did this previously and this is behavior we want to continue to preserve, even for security reasons
…e to 4.2.7 [run ci]
jordanpowell88
force-pushed
the
chore/update_tough_cookie
branch
from
aad0894
to
5ef6752
Compare
jordanpowell88
force-pushed
the
chore/update_tough_cookie
branch
from
6aac3b1
to
8ad0a19
Compare
|
Released in This comment thread has been locked. If you are still experiencing this issue after upgrading to |
Additional details
@cypress/request,@cypress/request-promiseandstart-server-and-testwhich have dependencies on a vulnerable version oftough-cookie. It DOES leave ONE instance oftough-cookieleft at2.5inpackages/icons. This one will be difficult to patch since it is a peer dep of@packages#icons#to-ico#resize-img#jimp#requestandto-icohasn't been updated in over 5 yearsSteps to test
How has the user experience changed?
PR Tasks
cypress-documentation?type definitions?