Skip to content

[Snyk] Upgrade express-session from 1.17.3 to 1.19.0#71

Open
LeoMuchuki wants to merge 1 commit intomainfrom
snyk-upgrade-a6823f1a7424427901e446d00eca1925
Open

[Snyk] Upgrade express-session from 1.17.3 to 1.19.0#71
LeoMuchuki wants to merge 1 commit intomainfrom
snyk-upgrade-a6823f1a7424427901e446d00eca1925

Conversation

@LeoMuchuki
Copy link
Owner

@LeoMuchuki LeoMuchuki commented Feb 14, 2026

snyk-top-banner

Snyk has created this PR to upgrade express-session from 1.17.3 to 1.19.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

  • The recommended version is 4 versions ahead of your current version.

  • The recommended version was released 23 days ago.

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
high severity Asymmetric Resource Consumption (Amplification)
SNYK-JS-BODYPARSER-7926860		 624 No Known Exploit
high severity Allocation of Resources Without Limits or Throttling
SNYK-JS-QS-14724253		 624 Proof of Concept
medium severity Cross-site Scripting (XSS)
SNYK-JS-COOKIE-8163060		 624 No Known Exploit
medium severity Cross-site Scripting (XSS)
SNYK-JS-COOKIE-8163060		 624 No Known Exploit
medium severity Open Redirect
SNYK-JS-EXPRESS-6474509		 624 No Known Exploit
medium severity Cross-site Scripting
SNYK-JS-EXPRESS-7926867		 624 No Known Exploit
medium severity Improper Handling of Unexpected Data Type
SNYK-JS-ONHEADERS-10773729		 624 No Known Exploit
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-PATHTOREGEXP-7925106		 624 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-PATHTOREGEXP-8482416		 624 Proof of Concept
low severity Cross-site Scripting
SNYK-JS-SEND-7926862		 624 No Known Exploit
low severity Cross-site Scripting
SNYK-JS-SERVESTATIC-7926865		 624 No Known Exploit
Release notes
Package name: express-session
  • 1.19.0 - 2026-01-22

    What's Changed

    Main Changes

    • Add dynamic cookie options support
      Cookie options can now be dynamic, allowing for more flexible and context-aware configuration based on each request. This feature enables programmatic modification of cookie attributes like secure, httpOnly, sameSite, maxAge, domain, and path based on session or request conditions.

      var app = express()
app.use(session({
  secret: 'keyboard cat',
  resave: false,
  saveUninitialized: true,
  cookie: function (req) {
    var match = req.url.match(/^\/([^/]+)/);
    return {
      path: match ? '/' + match[1] : '/',
      httpOnly: true,
      secure: req.secure || false,
      maxAge: 60000
    }
  }
}))

    • Add sameSite 'auto' support for automatic SameSite attribute configuration
      Added sameSite: 'auto' option for cookie configuration that automatically sets SameSite=None for HTTPS and SameSite=Lax for HTTP connections, simplifying cookie handling across different environments.

    • deps: use tilde notation for dependencies

    PRs

    New Contributors

    Full Changelog: v1.18.2...v1.19.0

  • 1.18.2 - 2025-07-17

    What's Changed

    New Contributors

    Full Changelog: v1.18.1...v1.18.2

  • 1.18.1 - 2024-10-08

    What's Changed

    New Contributors

    Full Changelog: v1.18.0...v1.18.1

  • 1.18.0 - 2024-01-28
    • Add debug log for pathname mismatch
    • Add partitioned to cookie options
    • Add priority to cookie options
    • Fix handling errors from setting cookie
    • Support any type in secret that crypto.createHmac supports
    • deps: cookie@0.6.0
      • Fix expires option to reject invalid dates
      • perf: improve default decode speed
      • perf: remove slow string split in parse
    • deps: cookie-signature@1.0.7
  • 1.17.3 - 2022-05-11
    • Fix resaving already-saved new session at end of request
    • deps: cookie@0.4.2
from express-session GitHub release notes

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • This PR was automatically created by Snyk using the credentials of a real user.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

@snyk-bot
fix: upgrade express-session from 1.17.3 to 1.19.0
37647e6 
Snyk has created this PR to upgrade express-session from 1.17.3 to 1.19.0.

See this package in npm:
express-session

See this project in Snyk:
https://app.snyk.io/org/lennyulemsee/project/0113a75d-af39-4da7-8c18-a0c69a1cb863?utm_source=github&utm_medium=referral&page=upgrade-pr
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@LeoMuchuki @snyk-bot