From 8f0a1c4a35d80293eb51633e90916bdbdaa09ec4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=8D=C3=B1igo=20Marqu=C3=ADnez=20Prado?= <25435858+inigomarquinez@users.noreply.github.com> Date: Tue, 14 May 2024 18:19:12 +0200 Subject: [PATCH 01/45] ci: add support for OSSF scorecard reporting (#984) PR-URL: https://github.com/expressjs/session/pull/984 --- .github/workflows/scorecard.yml | 73 +++++++++++++++++++++++++++++++++ 1 file changed, 73 insertions(+) create mode 100644 .github/workflows/scorecard.yml diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml new file mode 100644 index 00000000..0e064f47 --- /dev/null +++ b/.github/workflows/scorecard.yml @@ -0,0 +1,73 @@ +# This workflow uses actions that are not certified by GitHub. They are provided +# by a third-party and are governed by separate terms of service, privacy +# policy, and support documentation. + +name: Scorecard supply-chain security + +on: + # For Branch-Protection check. Only the default branch is supported. See + # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection + branch_protection_rule: + # To guarantee Maintained check is occasionally updated. See + # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained + schedule: + - cron: '16 21 * * 1' + push: + branches: [ "master" ] + +# Declare default permissions as read only. +permissions: read-all + +jobs: + analysis: + name: Scorecard analysis + runs-on: ubuntu-latest + permissions: + # Needed to upload the results to code-scanning dashboard. + security-events: write + # Needed to publish results and get a badge (see publish_results below). + id-token: write + # Uncomment the permissions below if installing in a private repository. + # contents: read + # actions: read + + steps: + - name: "Checkout code" + uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.2 + with: + persist-credentials: false + + - name: "Run analysis" + uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1 + with: + results_file: results.sarif + results_format: sarif + # (Optional) "write" PAT token. Uncomment the `repo_token` line below if: + # - you want to enable the Branch-Protection check on a *public* repository, or + # - you are installing Scorecard on a *private* repository + # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat. + # repo_token: ${{ secrets.SCORECARD_TOKEN }} + + # Public repositories: + # - Publish results to OpenSSF REST API for easy access by consumers + # - Allows the repository to include the Scorecard badge. + # - See https://github.com/ossf/scorecard-action#publishing-results. + # For private repositories: + # - `publish_results` will always be set to `false`, regardless + # of the value entered here. + publish_results: true + + # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF + # format to the repository Actions tab. + - name: "Upload artifact" + uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1 + with: + name: SARIF file + path: results.sarif + retention-days: 5 + + # Upload the results to GitHub's code scanning dashboard. + - name: "Upload to code-scanning" + uses: github/codeql-action/upload-sarif@2f93e4319b2f04a2efc38fa7f78bd681bc3f7b2f # v2.23.2 + with: + sarif_file: results.sarif From 341b179ec67c85c751ba0f5cfee8e514a139f630 Mon Sep 17 00:00:00 2001 From: Nick O'Leary Date: Tue, 8 Oct 2024 18:50:29 +0100 Subject: [PATCH 02/45] dep: cookie@0.7.2 (#997) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Ulises Gascón --- HISTORY.md | 15 +++++++++++++++ package.json | 2 +- 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/HISTORY.md b/HISTORY.md index a9903c03..256606b7 100644 --- a/HISTORY.md +++ b/HISTORY.md @@ -1,3 +1,18 @@ +unreleased +========== + + + * deps: cookie@0.7.2 + - Fix object assignment of `hasOwnProperty` + * deps: cookie@0.7.1 + - Allow leading dot for domain + - Although not permitted in the spec, some users expect this to work and user agents ignore the leading dot according to spec + - Add fast path for `serialize` without options, use `obj.hasOwnProperty` when parsing + * deps: cookie@0.7.0 + - perf: parse cookies ~10% faster + - fix: narrow the validation of cookies to match RFC6265 + - fix: add `main` to `package.json` for rspack + 1.18.0 / 2024-01-28 =================== diff --git a/package.json b/package.json index 597a6994..910f8b6a 100644 --- a/package.json +++ b/package.json @@ -10,7 +10,7 @@ "repository": "expressjs/session", "license": "MIT", "dependencies": { - "cookie": "0.6.0", + "cookie": "0.7.2", "cookie-signature": "1.0.7", "debug": "2.6.9", "depd": "~2.0.0", From bbeca94e69b93d437c4ca300b111bd59169de925 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= Date: Tue, 8 Oct 2024 21:52:45 +0200 Subject: [PATCH 03/45] 1.18.1 PR-URL: https://github.com/expressjs/session/pull/998 --- HISTORY.md | 3 +-- package.json | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/HISTORY.md b/HISTORY.md index 256606b7..57c68d3a 100644 --- a/HISTORY.md +++ b/HISTORY.md @@ -1,7 +1,6 @@ -unreleased +1.18.1 / 2024-10-08 ========== - * deps: cookie@0.7.2 - Fix object assignment of `hasOwnProperty` * deps: cookie@0.7.1 diff --git a/package.json b/package.json index 910f8b6a..e3322438 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "express-session", - "version": "1.18.0", + "version": "1.18.1", "description": "Simple session middleware for Express", "author": "TJ Holowaychuk (http://tjholowaychuk.com)", "contributors": [ From 460e18c8f3b0cc21a437e984f0ea04b9c0138193 Mon Sep 17 00:00:00 2001 From: BaileyFirman Date: Thu, 21 Nov 2024 16:29:59 +1300 Subject: [PATCH 04/45] Refresh server.crt with existing key extending expiry to Nov 21 03:28:10 2024 GMT --- test/fixtures/server.crt | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/test/fixtures/server.crt b/test/fixtures/server.crt index c019198a..3f68e2f2 100644 --- a/test/fixtures/server.crt +++ b/test/fixtures/server.crt @@ -1,14 +1,15 @@ -----BEGIN CERTIFICATE----- -MIICMzCCAZwCCQCJTms0qcIZgDANBgkqhkiG9w0BAQUFADBeMQswCQYDVQQGEwJV -UzEQMA4GA1UECBMHSW5kaWFuYTEdMBsGA1UEChMUbm9kZS1leHByZXNzLXNlc3Np -b24xHjAcBgNVBAMTFWV4cHJlc3Mtc2Vzc2lvbi5sb2NhbDAeFw0xNDExMjMwNTQ3 -MzlaFw0yNDExMjAwNTQ3MzlaMF4xCzAJBgNVBAYTAlVTMRAwDgYDVQQIEwdJbmRp -YW5hMR0wGwYDVQQKExRub2RlLWV4cHJlc3Mtc2Vzc2lvbjEeMBwGA1UEAxMVZXhw -cmVzcy1zZXNzaW9uLmxvY2FsMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDY -G398zqN6Yv/FAx77eoLLje4VNCYDXUciWBzceaZ5u/rtP/XshTQWDKFfUbb/kmni -DazsCasSoNsUCrcqQPJF1jF3F9XjsZxcggDab8MAbAMhnhJax2l3yPJsWnB/8mrY -cdsdQNPXJxQW9MMZgUxz73gIY5/rEeayU9owgcnVcQIDAQABMA0GCSqGSIb3DQEB -BQUAA4GBADi0XXsZlQAKxOyD4qvdJNWJXlfqhr1q53dZmfF7nikDaMDiMspczTS/ -pxNbq2UaMc7g+6qmXPaPQoN3laQQtMdyVfSh6EIJHbzXXzdcCT4fDBYX7iwvh0Gg -DUpjmxmCzFCaob9+hZzwbJi5MFQ4Qq12LW1aYHMs8wgLboHml1WL +MIICWzCCAcSgAwIBAgIJAIlOazSpwhmAMA0GCSqGSIb3DQEBCwUAMF4xCzAJBgNV +BAYTAlVTMRAwDgYDVQQIEwdJbmRpYW5hMR0wGwYDVQQKExRub2RlLWV4cHJlc3Mt +c2Vzc2lvbjEeMBwGA1UEAxMVZXhwcmVzcy1zZXNzaW9uLmxvY2FsMB4XDTI0MTEy +MTAzMjgxMFoXDTM0MTExOTAzMjgxMFowXjELMAkGA1UEBhMCVVMxEDAOBgNVBAgT +B0luZGlhbmExHTAbBgNVBAoTFG5vZGUtZXhwcmVzcy1zZXNzaW9uMR4wHAYDVQQD +ExVleHByZXNzLXNlc3Npb24ubG9jYWwwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ +AoGBANgbf3zOo3pi/8UDHvt6gsuN7hU0JgNdRyJYHNx5pnm7+u0/9eyFNBYMoV9R +tv+SaeINrOwJqxKg2xQKtypA8kXWMXcX1eOxnFyCANpvwwBsAyGeElrHaXfI8mxa +cH/yathx2x1A09cnFBb0wxmBTHPveAhjn+sR5rJT2jCBydVxAgMBAAGjITAfMB0G +A1UdDgQWBBTqXycJwRboThk0uB3Cd3+oSLz1fjANBgkqhkiG9w0BAQsFAAOBgQCT +/E1rZGxemZZ5F8qX9SoTsc04ELEwT3PwA0cgU5fGmWmajPfjw339y53EQAb/H/sM +hugSreKMLVSAHRhMNGXb+dR0MzJiR4GbKRvYyHul4zjWen9uQrDHdgsqD4RnUcq8 +7HB+i49oFLN59qoI9MOoOKBfAKGKlXd+IL9+jyR/jA== -----END CERTIFICATE----- From c9d0572701a1bd2714b82ce03cf225e60a3f41a9 Mon Sep 17 00:00:00 2001 From: ctcpip Date: Wed, 22 Jan 2025 09:10:19 -0600 Subject: [PATCH 05/45] =?UTF-8?q?=F0=9F=94=92=EF=B8=8F=20use=202048=20bit?= =?UTF-8?q?=20key?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit cd test/fixtures openssl genpkey -algorithm RSA -out new_server.key -pkeyopt rsa_keygen_bits:2048 openssl x509 -in server.crt -signkey new_server.key -days 3650 -out new_server.crt openssl x509 -in new_server.crt -text -noout mv new_server.crt server.crt mv new_server.key server.key --- test/fixtures/server.crt | 28 ++++++++++++++++---------- test/fixtures/server.key | 43 ++++++++++++++++++++++++++-------------- 2 files changed, 45 insertions(+), 26 deletions(-) diff --git a/test/fixtures/server.crt b/test/fixtures/server.crt index 3f68e2f2..3bee94f1 100644 --- a/test/fixtures/server.crt +++ b/test/fixtures/server.crt @@ -1,15 +1,21 @@ -----BEGIN CERTIFICATE----- -MIICWzCCAcSgAwIBAgIJAIlOazSpwhmAMA0GCSqGSIb3DQEBCwUAMF4xCzAJBgNV +MIIDYDCCAkigAwIBAgIJAIlOazSpwhmAMA0GCSqGSIb3DQEBCwUAMF4xCzAJBgNV BAYTAlVTMRAwDgYDVQQIEwdJbmRpYW5hMR0wGwYDVQQKExRub2RlLWV4cHJlc3Mt -c2Vzc2lvbjEeMBwGA1UEAxMVZXhwcmVzcy1zZXNzaW9uLmxvY2FsMB4XDTI0MTEy -MTAzMjgxMFoXDTM0MTExOTAzMjgxMFowXjELMAkGA1UEBhMCVVMxEDAOBgNVBAgT +c2Vzc2lvbjEeMBwGA1UEAxMVZXhwcmVzcy1zZXNzaW9uLmxvY2FsMB4XDTI1MDEy +MjE1MTMyMFoXDTM1MDEyMDE1MTMyMFowXjELMAkGA1UEBhMCVVMxEDAOBgNVBAgT B0luZGlhbmExHTAbBgNVBAoTFG5vZGUtZXhwcmVzcy1zZXNzaW9uMR4wHAYDVQQD -ExVleHByZXNzLXNlc3Npb24ubG9jYWwwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ -AoGBANgbf3zOo3pi/8UDHvt6gsuN7hU0JgNdRyJYHNx5pnm7+u0/9eyFNBYMoV9R -tv+SaeINrOwJqxKg2xQKtypA8kXWMXcX1eOxnFyCANpvwwBsAyGeElrHaXfI8mxa -cH/yathx2x1A09cnFBb0wxmBTHPveAhjn+sR5rJT2jCBydVxAgMBAAGjITAfMB0G -A1UdDgQWBBTqXycJwRboThk0uB3Cd3+oSLz1fjANBgkqhkiG9w0BAQsFAAOBgQCT -/E1rZGxemZZ5F8qX9SoTsc04ELEwT3PwA0cgU5fGmWmajPfjw339y53EQAb/H/sM -hugSreKMLVSAHRhMNGXb+dR0MzJiR4GbKRvYyHul4zjWen9uQrDHdgsqD4RnUcq8 -7HB+i49oFLN59qoI9MOoOKBfAKGKlXd+IL9+jyR/jA== +ExVleHByZXNzLXNlc3Npb24ubG9jYWwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw +ggEKAoIBAQCy4w/9Wa85PGpdkzuZeU2qel+jlQd5L8b0RoKwlQ5k8NS/zIRd2fiF +8XIQMi5m7sGaYT3xUUItuksQF3XnOGQddppLCnfshjqUeSrMAoSZPnqHsZYsbRhS +3HiJFLWvBRDndVpmvdyg7BZicqEFmVBYNqsbsGH0Nrx6Xcb3iEZL8Z1mg3y+5f7c +0s0buXJmX9usc8g7CRiLfuqArAJM8NUSyBonsIlzQvudmNiyqb5UZIYqK8YvCpkZ +3QcHpzVCZ1uYIKa8MY878PhaiVqwDWGEtXO9xi3rtHXkvm5Y3wwbXYFDoOvA1YvM +/CtLXNCpHU23WhiIErBb3dvGxZZroCTtAgMBAAGjITAfMB0GA1UdDgQWBBSJqiKJ +f66iraVLqI3oZsgVeFA14jANBgkqhkiG9w0BAQsFAAOCAQEAP2VZidUCQptk4BiU +Fi390fR5wrgnqhBRmoE+iL5ok05ToLsg2DyvCefPyZgNp//NIRp6QUIHmPVXWHXx +fVDPLUC1CuOXy+o6TDWWjbtFW/PG5uPA6uhW4XpaBR5EGlptOBrGIRKIqneUwsMk +5fpDo7pbU4GSMToDDnhJxijrHIQFTs+PJLAGjCBQn/FRcDR1AJlxW/AyO0bIBSLE +fnZP+feQG6koDK8rgyT4t4z+hynAuf7y1ToFckNfTkdLdbXG5ceGu21qJCY/8uje +Nf01ik1p8gL5dZcW3qucTP5p45t3bnUDOjPFmrs87Ooeix9UjZG2hwW258FN86r6 +3PDrTw== -----END CERTIFICATE----- diff --git a/test/fixtures/server.key b/test/fixtures/server.key index dabf2b83..51b6a7b1 100644 --- a/test/fixtures/server.key +++ b/test/fixtures/server.key @@ -1,15 +1,28 @@ ------BEGIN RSA PRIVATE KEY----- -MIICXQIBAAKBgQDYG398zqN6Yv/FAx77eoLLje4VNCYDXUciWBzceaZ5u/rtP/Xs -hTQWDKFfUbb/kmniDazsCasSoNsUCrcqQPJF1jF3F9XjsZxcggDab8MAbAMhnhJa -x2l3yPJsWnB/8mrYcdsdQNPXJxQW9MMZgUxz73gIY5/rEeayU9owgcnVcQIDAQAB -AoGBALB8HGw/kPA1Ay3Qc6/qCADWYvW8BcM/nQUmMkO3sUW/R5gTYPIMglHzdKIU -aL9kwcXTZ0HIT4ZCCUffzF/cdD0lqCZjwGl0aM4xUZcPbaM/KmZOUcP92ymsN+rF -uuJXks6hxrmJ5hh5D6FXdlQjTCdG3u9w0+KD4n1BkBkEaqflAkEA9q4TBt1bLOvV -bbwz7bunI6bwS5eD7sVn1qUqrm6hcirhF1xCv75pO/uqAyccbguxjp8y2LNuN+cO -IgSwr+Jq1wJBAOBFuKSMAcg2WmJ4IAT7143yhoHKMgA8Nl4sfLFwFl2/hw+fdEBe -gndRfKHT4IV/YLcnS7d/H6mEMSAusWx5QPcCQQDTYaF+TWrW2JRAf3jEK/xyiZf6 -PrDYh6KOhWRIqxZ/fYz69p1gL6t/sg0ivH4ZMr4JKBRrK360OrOapQg+/7drAkB6 -3pfPRok/aE/SfN+F+3fX49Q/TUhhipt6ssLJ74/BYsobDBADqAOwXSt7+XmbifKx -xUydRn9RPwQvDoXT2QZ3AkAdnwR9PMEHAsaibrPyzBztKjPL2rWBRk1QAmcdrTpt -XL99XfmkERWtiBA/Lz2K332qYOa/zo5c/SADx9fm7+HP ------END RSA PRIVATE KEY----- +-----BEGIN PRIVATE KEY----- +MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCy4w/9Wa85PGpd +kzuZeU2qel+jlQd5L8b0RoKwlQ5k8NS/zIRd2fiF8XIQMi5m7sGaYT3xUUItuksQ +F3XnOGQddppLCnfshjqUeSrMAoSZPnqHsZYsbRhS3HiJFLWvBRDndVpmvdyg7BZi +cqEFmVBYNqsbsGH0Nrx6Xcb3iEZL8Z1mg3y+5f7c0s0buXJmX9usc8g7CRiLfuqA +rAJM8NUSyBonsIlzQvudmNiyqb5UZIYqK8YvCpkZ3QcHpzVCZ1uYIKa8MY878Pha +iVqwDWGEtXO9xi3rtHXkvm5Y3wwbXYFDoOvA1YvM/CtLXNCpHU23WhiIErBb3dvG +xZZroCTtAgMBAAECggEAA8BHqE4eYsKdz18EP6xfwMymn0FDghrKnvowiN/jSKIV +L/1rpCUrNTHSLL1EpFNq22AhIqOL0fYnV0vKpOHVlZmUVDEAwUSyS0U8LMF7wtPg +0WIbrkxOV4R4gZVd1vDyAQyArAlcrEIvGPri3gFwQh1JWsAI2cxhCObZAn1IzhRW +sMecAmtNzzYWeXentSfkfWr0niKDbSAAuYzgVIEWbIfE+kgqBckrWnyM9IgSdy1g +0b3NRRD/gvykszX7j9fzXGj8RAcCTbN1miaFcHRg3moa1Pu50KjokINsr5xxYqTk +ltPYU35gMYzNPvu5clvj067j6ikCFMiE4XOXf58qwQKBgQDpQJ2l6b1LrvGAV4Q6 +qieTYPTnGhnm/rSn7jK+AUIF+UmK3mtASuc14keelXeiI42MzvO1P6LLwkFIzVx0 +2X/BrTDZUvU5P5nsgBkoyiC71bkbCzoiSxIQtRurenmkD7EqM+4zBYMvCvrPFmOr +twuWk+4XLA+nl5Vl+FUgjehCQQKBgQDEVShtn68Pkq22GXR5kzgFu+GaXuVPJKu8 +z45K4mbG+WrnwuMmnIRbMfN9oGF5JXWAe5AtFqlQEcUQLElllRkdUe76WX15M2Jm +UeqFFARWjToNs7NXmxjsQZFOe0TyfAsdaX++lUhEpeCcv2MnEoNQS9n8yTwhuJM4 +8Zr9KUWfrQKBgQCFkNK1ZxtWc18nNvYpAbaX1jVnALNEayXX47Z6xw2fjhhmxOZ1 +cm7jlCeez8gpuGId94PmjgIS27G2lqIS51kY9qu6Rp7VoW3q14+Qo+4KoV/V9J/d +c09s8checUumfrXcjNAht05fadIlM5Tvh2nDWAJGkpyEQ3DxazqT4a7WAQKBgFok +Zz191Zim1c8H/Oxc5ZnsW3bPHyWpRpiYC1LihCHTHnxuhHCT6EketBb37gj7Y+mr +0dSB1RcIMZxtWP2k6TUHC1wyfmOJbiJgdfbH6/35NbBY03zjnxvKNvb7rfpPbaMB +bz+Htvid2HTfgpzL6TKSwPFJS6yH3ECG3YxiyK65AoGAHIYaLIP53pszdd1ruCO6 +0rI6/He6hKwG8SmtbXKCKYSAeNwZJkUI+B0xD8ZTq5h3geJD7CEoVPPsv9xauliG +fspe/KyTX5DqTBx9xNVYj9C2MSozQNs8ObCsUOMKzRaJtHl64US1VzweWA7Whkwf +1r8MiT2ty4eCk7V3qW1W88A= +-----END PRIVATE KEY----- From d5baeeca833a6370936a844654f0d7147dc234aa Mon Sep 17 00:00:00 2001 From: Wes Todd Date: Wed, 22 Jan 2025 17:06:47 -0600 Subject: [PATCH 06/45] feat: gencert script to regenerate the test ssl certs --- package.json | 3 ++- test/support/gencert.sh | 12 ++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) create mode 100755 test/support/gencert.sh diff --git a/package.json b/package.json index e3322438..87b31098 100644 --- a/package.json +++ b/package.json @@ -42,6 +42,7 @@ "test": "mocha --require test/support/env --check-leaks --bail --no-exit --reporter spec test/", "test-ci": "nyc --reporter=lcov --reporter=text npm test", "test-cov": "nyc npm test", - "version": "node scripts/version-history.js && git add HISTORY.md" + "version": "node scripts/version-history.js && git add HISTORY.md", + "gencert": "./test/support/gencert.sh" } } diff --git a/test/support/gencert.sh b/test/support/gencert.sh new file mode 100755 index 00000000..114bf70f --- /dev/null +++ b/test/support/gencert.sh @@ -0,0 +1,12 @@ +#! /bin/sh +set -ex + +openssl genpkey -algorithm RSA -out new_server.key -pkeyopt rsa_keygen_bits:2048 + +openssl x509 -in ./test/fixtures/server.crt -signkey new_server.key -days 3650 -out new_server.crt + +openssl x509 -in new_server.crt -text -noout + +mv new_server.crt ./test/fixtures/server.crt + +mv new_server.key ./test/fixtures/server.key From 67d61ee1799a8070dff4a5b759189be2023c7a62 Mon Sep 17 00:00:00 2001 From: ctcpip Date: Thu, 23 Jan 2025 11:01:24 -0600 Subject: [PATCH 07/45] =?UTF-8?q?=E2=9C=85=20always=20generate=20fresh=20c?= =?UTF-8?q?ert?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .gitignore | 2 ++ package.json | 5 ++--- test/fixtures/.gitkeep | 0 test/fixtures/server.crt | 21 --------------------- test/fixtures/server.key | 28 ---------------------------- test/support/gencert.sh | 11 ++--------- 6 files changed, 6 insertions(+), 61 deletions(-) create mode 100644 test/fixtures/.gitkeep delete mode 100644 test/fixtures/server.crt delete mode 100644 test/fixtures/server.key diff --git a/.gitignore b/.gitignore index 207febba..1b6fef23 100644 --- a/.gitignore +++ b/.gitignore @@ -3,3 +3,5 @@ coverage node_modules npm-debug.log package-lock.json +/test/fixtures/server.crt +/test/fixtures/server.key diff --git a/package.json b/package.json index 87b31098..79cb1b4c 100644 --- a/package.json +++ b/package.json @@ -39,10 +39,9 @@ }, "scripts": { "lint": "eslint . && node ./scripts/lint-readme.js", - "test": "mocha --require test/support/env --check-leaks --bail --no-exit --reporter spec test/", + "test": "./test/support/gencert.sh && mocha --require test/support/env --check-leaks --bail --no-exit --reporter spec test/", "test-ci": "nyc --reporter=lcov --reporter=text npm test", "test-cov": "nyc npm test", - "version": "node scripts/version-history.js && git add HISTORY.md", - "gencert": "./test/support/gencert.sh" + "version": "node scripts/version-history.js && git add HISTORY.md" } } diff --git a/test/fixtures/.gitkeep b/test/fixtures/.gitkeep new file mode 100644 index 00000000..e69de29b diff --git a/test/fixtures/server.crt b/test/fixtures/server.crt deleted file mode 100644 index 3bee94f1..00000000 --- a/test/fixtures/server.crt +++ /dev/null @@ -1,21 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIDYDCCAkigAwIBAgIJAIlOazSpwhmAMA0GCSqGSIb3DQEBCwUAMF4xCzAJBgNV -BAYTAlVTMRAwDgYDVQQIEwdJbmRpYW5hMR0wGwYDVQQKExRub2RlLWV4cHJlc3Mt -c2Vzc2lvbjEeMBwGA1UEAxMVZXhwcmVzcy1zZXNzaW9uLmxvY2FsMB4XDTI1MDEy -MjE1MTMyMFoXDTM1MDEyMDE1MTMyMFowXjELMAkGA1UEBhMCVVMxEDAOBgNVBAgT -B0luZGlhbmExHTAbBgNVBAoTFG5vZGUtZXhwcmVzcy1zZXNzaW9uMR4wHAYDVQQD -ExVleHByZXNzLXNlc3Npb24ubG9jYWwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw -ggEKAoIBAQCy4w/9Wa85PGpdkzuZeU2qel+jlQd5L8b0RoKwlQ5k8NS/zIRd2fiF -8XIQMi5m7sGaYT3xUUItuksQF3XnOGQddppLCnfshjqUeSrMAoSZPnqHsZYsbRhS -3HiJFLWvBRDndVpmvdyg7BZicqEFmVBYNqsbsGH0Nrx6Xcb3iEZL8Z1mg3y+5f7c -0s0buXJmX9usc8g7CRiLfuqArAJM8NUSyBonsIlzQvudmNiyqb5UZIYqK8YvCpkZ -3QcHpzVCZ1uYIKa8MY878PhaiVqwDWGEtXO9xi3rtHXkvm5Y3wwbXYFDoOvA1YvM -/CtLXNCpHU23WhiIErBb3dvGxZZroCTtAgMBAAGjITAfMB0GA1UdDgQWBBSJqiKJ -f66iraVLqI3oZsgVeFA14jANBgkqhkiG9w0BAQsFAAOCAQEAP2VZidUCQptk4BiU -Fi390fR5wrgnqhBRmoE+iL5ok05ToLsg2DyvCefPyZgNp//NIRp6QUIHmPVXWHXx -fVDPLUC1CuOXy+o6TDWWjbtFW/PG5uPA6uhW4XpaBR5EGlptOBrGIRKIqneUwsMk -5fpDo7pbU4GSMToDDnhJxijrHIQFTs+PJLAGjCBQn/FRcDR1AJlxW/AyO0bIBSLE -fnZP+feQG6koDK8rgyT4t4z+hynAuf7y1ToFckNfTkdLdbXG5ceGu21qJCY/8uje -Nf01ik1p8gL5dZcW3qucTP5p45t3bnUDOjPFmrs87Ooeix9UjZG2hwW258FN86r6 -3PDrTw== ------END CERTIFICATE----- diff --git a/test/fixtures/server.key b/test/fixtures/server.key deleted file mode 100644 index 51b6a7b1..00000000 --- a/test/fixtures/server.key +++ /dev/null @@ -1,28 +0,0 @@ ------BEGIN PRIVATE KEY----- -MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCy4w/9Wa85PGpd -kzuZeU2qel+jlQd5L8b0RoKwlQ5k8NS/zIRd2fiF8XIQMi5m7sGaYT3xUUItuksQ -F3XnOGQddppLCnfshjqUeSrMAoSZPnqHsZYsbRhS3HiJFLWvBRDndVpmvdyg7BZi -cqEFmVBYNqsbsGH0Nrx6Xcb3iEZL8Z1mg3y+5f7c0s0buXJmX9usc8g7CRiLfuqA -rAJM8NUSyBonsIlzQvudmNiyqb5UZIYqK8YvCpkZ3QcHpzVCZ1uYIKa8MY878Pha -iVqwDWGEtXO9xi3rtHXkvm5Y3wwbXYFDoOvA1YvM/CtLXNCpHU23WhiIErBb3dvG -xZZroCTtAgMBAAECggEAA8BHqE4eYsKdz18EP6xfwMymn0FDghrKnvowiN/jSKIV -L/1rpCUrNTHSLL1EpFNq22AhIqOL0fYnV0vKpOHVlZmUVDEAwUSyS0U8LMF7wtPg -0WIbrkxOV4R4gZVd1vDyAQyArAlcrEIvGPri3gFwQh1JWsAI2cxhCObZAn1IzhRW -sMecAmtNzzYWeXentSfkfWr0niKDbSAAuYzgVIEWbIfE+kgqBckrWnyM9IgSdy1g -0b3NRRD/gvykszX7j9fzXGj8RAcCTbN1miaFcHRg3moa1Pu50KjokINsr5xxYqTk -ltPYU35gMYzNPvu5clvj067j6ikCFMiE4XOXf58qwQKBgQDpQJ2l6b1LrvGAV4Q6 -qieTYPTnGhnm/rSn7jK+AUIF+UmK3mtASuc14keelXeiI42MzvO1P6LLwkFIzVx0 -2X/BrTDZUvU5P5nsgBkoyiC71bkbCzoiSxIQtRurenmkD7EqM+4zBYMvCvrPFmOr -twuWk+4XLA+nl5Vl+FUgjehCQQKBgQDEVShtn68Pkq22GXR5kzgFu+GaXuVPJKu8 -z45K4mbG+WrnwuMmnIRbMfN9oGF5JXWAe5AtFqlQEcUQLElllRkdUe76WX15M2Jm -UeqFFARWjToNs7NXmxjsQZFOe0TyfAsdaX++lUhEpeCcv2MnEoNQS9n8yTwhuJM4 -8Zr9KUWfrQKBgQCFkNK1ZxtWc18nNvYpAbaX1jVnALNEayXX47Z6xw2fjhhmxOZ1 -cm7jlCeez8gpuGId94PmjgIS27G2lqIS51kY9qu6Rp7VoW3q14+Qo+4KoV/V9J/d -c09s8checUumfrXcjNAht05fadIlM5Tvh2nDWAJGkpyEQ3DxazqT4a7WAQKBgFok -Zz191Zim1c8H/Oxc5ZnsW3bPHyWpRpiYC1LihCHTHnxuhHCT6EketBb37gj7Y+mr -0dSB1RcIMZxtWP2k6TUHC1wyfmOJbiJgdfbH6/35NbBY03zjnxvKNvb7rfpPbaMB -bz+Htvid2HTfgpzL6TKSwPFJS6yH3ECG3YxiyK65AoGAHIYaLIP53pszdd1ruCO6 -0rI6/He6hKwG8SmtbXKCKYSAeNwZJkUI+B0xD8ZTq5h3geJD7CEoVPPsv9xauliG -fspe/KyTX5DqTBx9xNVYj9C2MSozQNs8ObCsUOMKzRaJtHl64US1VzweWA7Whkwf -1r8MiT2ty4eCk7V3qW1W88A= ------END PRIVATE KEY----- diff --git a/test/support/gencert.sh b/test/support/gencert.sh index 114bf70f..cfdda070 100755 --- a/test/support/gencert.sh +++ b/test/support/gencert.sh @@ -1,12 +1,5 @@ #! /bin/sh set -ex -openssl genpkey -algorithm RSA -out new_server.key -pkeyopt rsa_keygen_bits:2048 - -openssl x509 -in ./test/fixtures/server.crt -signkey new_server.key -days 3650 -out new_server.crt - -openssl x509 -in new_server.crt -text -noout - -mv new_server.crt ./test/fixtures/server.crt - -mv new_server.key ./test/fixtures/server.key +openssl req -x509 -nodes -newkey rsa:2048 -keyout ./test/fixtures/server.key -out ./test/fixtures/server.crt -days 3650 \ +-subj "/C=US/ST=Illinois/L=Chicago/O=node-express-session/CN=express-session.local" From 4930de729107448e4b34b5bd39f138f71f1561f6 Mon Sep 17 00:00:00 2001 From: ctcpip Date: Thu, 23 Jan 2025 11:04:34 -0600 Subject: [PATCH 08/45] =?UTF-8?q?=E2=AC=86=EF=B8=8F=20bump=20actions?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/ci.yml | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 38dc4da7..ff3bce76 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -185,7 +185,7 @@ jobs: run: | if npm -ps ls nyc | grep -q nyc; then npm run test-ci - cp coverage/lcov.info "coverage/${{ matrix.name }}.lcov" + cp coverage/lcov.info "coverage/${{ matrix.node-version }}.lcov" else npm test fi @@ -198,17 +198,17 @@ jobs: if: steps.list_env.outputs.nyc != '' run: | if [[ -d ./coverage ]]; then - mv ./coverage "./${{ matrix.name }}" + mv ./coverage "./${{ matrix.node-version }}" mkdir ./coverage - mv "./${{ matrix.name }}" "./coverage/${{ matrix.name }}" + mv "./${{ matrix.node-version }}" "./coverage/${{ matrix.node-version }}" fi - name: Upload code coverage - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@v4 if: steps.list_env.outputs.nyc != '' with: - name: coverage - path: ./coverage + name: coverage-${{ matrix.node-version }} + path: "./coverage/${{ matrix.node-version }}" retention-days: 1 coverage: @@ -222,9 +222,8 @@ jobs: run: sudo apt-get -y install lcov - name: Collect coverage reports - uses: actions/download-artifact@v3 + uses: actions/download-artifact@v4 with: - name: coverage path: ./coverage - name: Merge coverage reports From b99e6c6fba30996069c9122e9e041a26f13d1d5e Mon Sep 17 00:00:00 2001 From: Carlos Serrano Date: Thu, 17 Apr 2025 16:18:22 +0200 Subject: [PATCH 09/45] chore: upgrade scorecard workflow pinned action versions (#1008) --- .github/workflows/scorecard.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 0e064f47..d23de00e 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -33,12 +33,12 @@ jobs: steps: - name: "Checkout code" - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.2 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: persist-credentials: false - name: "Run analysis" - uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1 + uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0 with: results_file: results.sarif results_format: sarif @@ -60,7 +60,7 @@ jobs: # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF # format to the repository Actions tab. - name: "Upload artifact" - uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1 + uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0 with: name: SARIF file path: results.sarif @@ -68,6 +68,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard. - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@2f93e4319b2f04a2efc38fa7f78bd681bc3f7b2f # v2.23.2 + uses: github/codeql-action/upload-sarif@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9 with: - sarif_file: results.sarif + sarif_file: results.sarif \ No newline at end of file From 6edf5eeab25c1b89ecd2676ce119d600c741b5f6 Mon Sep 17 00:00:00 2001 From: Sebastian Beltran Date: Sat, 26 Apr 2025 22:09:29 -0500 Subject: [PATCH 10/45] ci: add CodeQL (SAST) (#1005) --- .github/workflows/codeql.yml | 66 ++++++++++++++++++++++++++++++++++++ 1 file changed, 66 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 00000000..9d1b3041 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,66 @@ +# For most projects, this workflow file will not need changing; you simply need +# to commit it to your repository. +# +# You may wish to alter this file to override the set of languages analyzed, +# or to provide custom queries or build logic. +# +# ******** NOTE ******** +# We have attempted to detect the languages in your repository. Please check +# the `language` matrix defined below to confirm you have the correct set of +# supported CodeQL languages. +# +name: "CodeQL" + +on: + push: + branches: ["master"] + pull_request: + # The branches below must be a subset of the branches above + branches: ["master"] + schedule: + - cron: "0 0 * * 1" + +permissions: + contents: read + +jobs: + analyze: + name: Analyze + runs-on: ubuntu-latest + permissions: + actions: read + contents: read + security-events: write + + steps: + - name: Checkout repository + uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@3ab4101902695724f9365a384f86c1074d94e18c # v3.24.7 + with: + languages: javascript + # If you wish to specify custom queries, you can do so here or in a config file. + # By default, queries listed here will override any specified in a config file. + # Prefix the list here with "+" to use these queries and those in the config file. + + # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). + # If this step fails, then you should remove it and run the build manually (see below) + # - name: Autobuild + # uses: github/codeql-action/autobuild@3ab4101902695724f9365a384f86c1074d94e18c # v3.24.7 + + # ℹ️ Command-line programs to run using the OS shell. + # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun + + # If the Autobuild fails above, remove it and uncomment the following three lines. + # modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance. + + # - run: | + # echo "Run, Build Application using script" + # ./location_of_script_within_repo/buildscript.sh + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@3ab4101902695724f9365a384f86c1074d94e18c # v3.24.7 + with: + category: "/language:javascript" \ No newline at end of file From 122714cbdab4aee732d9e43a90865c73ec9819af Mon Sep 17 00:00:00 2001 From: StepSecurity Bot Date: Sat, 17 May 2025 10:33:44 -0700 Subject: [PATCH 11/45] [StepSecurity] Apply security best practices (#1047) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * [StepSecurity] Apply security best practices Signed-off-by: StepSecurity Bot * Update dependabot.yml * ping supertest versions in CI Signed-off-by: Sebastian Beltran --------- Signed-off-by: StepSecurity Bot Signed-off-by: Sebastian Beltran Co-authored-by: Ulises Gascón Co-authored-by: Sebastian Beltran --- .github/dependabot.yml | 11 +++++++++++ .github/workflows/ci.yml | 31 +++++++++++++++++++------------ 2 files changed, 30 insertions(+), 12 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..69f2040f --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: monthly + + - package-ecosystem: npm + directory: / + schedule: + interval: monthly diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ff3bce76..746b29e1 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -4,6 +4,9 @@ on: - pull_request - push +permissions: + contents: read + jobs: test: runs-on: ubuntu-latest @@ -79,33 +82,34 @@ jobs: - name: Node.js 8.x node-version: "8.17" - npm-i: mocha@7.2.0 nyc@14.1.1 + npm-i: mocha@7.2.0 nyc@14.1.1 supertest@6.1.6 - name: Node.js 9.x node-version: "9.11" - npm-i: mocha@7.2.0 nyc@14.1.1 + npm-i: mocha@7.2.0 nyc@14.1.1 supertest@6.1.6 - name: Node.js 10.x node-version: "10.24" - npm-i: mocha@8.4.0 + npm-i: mocha@8.4.0 supertest@6.1.6 - name: Node.js 11.x node-version: "11.15" - npm-i: mocha@8.4.0 + npm-i: mocha@8.4.0 supertest@6.1.6 - name: Node.js 12.x node-version: "12.22" - npm-i: mocha@9.2.2 + npm-i: mocha@9.2.2 supertest@6.1.6 - name: Node.js 13.x node-version: "13.14" - npm-i: mocha@9.2.2 + npm-i: mocha@9.2.2 supertest@6.1.6 - name: Node.js 14.x node-version: "14.21" - name: Node.js 15.x - node-version: "15.14" + node-version: "15.14" + npm-i: supertest@6.1.6 - name: Node.js 16.x node-version: "16.20" @@ -126,7 +130,7 @@ jobs: node-version: "21.6" steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Install Node.js ${{ matrix.node-version }} shell: bash -eo pipefail -l {0} @@ -204,7 +208,7 @@ jobs: fi - name: Upload code coverage - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 if: steps.list_env.outputs.nyc != '' with: name: coverage-${{ matrix.node-version }} @@ -212,17 +216,20 @@ jobs: retention-days: 1 coverage: + permissions: + checks: write # for coverallsapp/github-action to create new checks + contents: read # for actions/checkout to fetch code needs: test runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Install lcov shell: bash run: sudo apt-get -y install lcov - name: Collect coverage reports - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: path: ./coverage @@ -231,6 +238,6 @@ jobs: run: find ./coverage -name lcov.info -exec printf '-a %q\n' {} \; | xargs lcov -o ./coverage/lcov.info - name: Upload coverage report - uses: coverallsapp/github-action@master + uses: coverallsapp/github-action@09b709cf6a16e30b0808ba050c7a6e8a5ef13f8d # master with: github-token: ${{ secrets.GITHUB_TOKEN }} From 168271c665519d7d9164f97873bd0eee88d9e6fb Mon Sep 17 00:00:00 2001 From: Sebastian Beltran Date: Sat, 17 May 2025 13:02:43 -0500 Subject: [PATCH 12/45] fix(dependabot): do not update major versions Signed-off-by: Sebastian Beltran --- .github/dependabot.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 69f2040f..492d67d0 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,3 +9,6 @@ updates: directory: / schedule: interval: monthly + ignore: + - dependency-name: "*" + update-types: ["version-update:semver-major"] From 92dd3008e334eaa8466a431ae3c032b827b5816d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 18 May 2025 11:19:32 +0200 Subject: [PATCH 13/45] build(deps-dev): bump mocha from 10.2.0 to 10.8.2 (#1061) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Ulises Gascón --- HISTORY.md | 5 +++++ package.json | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/HISTORY.md b/HISTORY.md index 57c68d3a..cc879c63 100644 --- a/HISTORY.md +++ b/HISTORY.md @@ -1,3 +1,8 @@ +unpublished +========== + * deps: mocha@10.8.2 + + 1.18.1 / 2024-10-08 ========== diff --git a/package.json b/package.json index 79cb1b4c..b4978a27 100644 --- a/package.json +++ b/package.json @@ -25,7 +25,7 @@ "eslint": "8.56.0", "eslint-plugin-markdown": "3.0.1", "express": "4.17.3", - "mocha": "10.2.0", + "mocha": "10.8.2", "nyc": "15.1.0", "supertest": "6.3.4" }, From 7e2c6964263b66d7fbdbd75d1c603413880fef64 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 31 May 2025 19:32:09 -0500 Subject: [PATCH 14/45] build(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.1 (#1048) Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.0 to 2.4.1. - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](https://github.com/ossf/scorecard-action/compare/62b2cac7ed8198b15735ed49ab1e5cf35480ba46...f49aabe0b5af0936a0987cfb85d86b75731b0186) --- updated-dependencies: - dependency-name: ossf/scorecard-action dependency-version: 2.4.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index d23de00e..3d4b1114 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -38,7 +38,7 @@ jobs: persist-credentials: false - name: "Run analysis" - uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0 + uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1 with: results_file: results.sarif results_format: sarif From 2633e88780e5655db44d11f917629942cb92628d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 31 May 2025 19:32:43 -0500 Subject: [PATCH 15/45] build(deps): bump github/codeql-action from 3.24.7 to 3.28.18 (#1050) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.24.7 to 3.28.18. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/v3.24.7...ff0a06e83cb2de871e5a09832bc6a81e7276941f) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 3.28.18 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/codeql.yml | 4 ++-- .github/workflows/scorecard.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 9d1b3041..894e99aa 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -38,7 +38,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@3ab4101902695724f9365a384f86c1074d94e18c # v3.24.7 + uses: github/codeql-action/init@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18 with: languages: javascript # If you wish to specify custom queries, you can do so here or in a config file. @@ -61,6 +61,6 @@ jobs: # ./location_of_script_within_repo/buildscript.sh - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@3ab4101902695724f9365a384f86c1074d94e18c # v3.24.7 + uses: github/codeql-action/analyze@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18 with: category: "/language:javascript" \ No newline at end of file diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 3d4b1114..5ad5ef6a 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -68,6 +68,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard. - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9 + uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18 with: sarif_file: results.sarif \ No newline at end of file From 2caff6ae8976763841abbc8ed7b560cc5ebdf6cf Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 31 May 2025 19:33:21 -0500 Subject: [PATCH 16/45] build(deps): bump actions/checkout from 4.1.1 to 4.2.2 (#1049) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.1 to 4.2.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v4.1.1...11bd71901bbe5b1630ceea73d27597364c9af683) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 4.2.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/codeql.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 894e99aa..1a41f87b 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -34,7 +34,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL From ec1957b9bd169c582a00d83f5966f4c5fed9017d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 31 May 2025 19:33:55 -0500 Subject: [PATCH 17/45] build(deps): bump actions/upload-artifact from 4.5.0 to 4.6.2 (#1052) Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.5.0 to 4.6.2. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v4.5.0...ea165f8d65b6e75b540449e92b4886f43607fa02) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 4.6.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 5ad5ef6a..d53e5871 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -60,7 +60,7 @@ jobs: # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF # format to the repository Actions tab. - name: "Upload artifact" - uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: SARIF file path: results.sarif From a698c81f2ab950188cdbd7f30bb3a89fd68e2046 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 31 May 2025 19:34:41 -0500 Subject: [PATCH 18/45] build(deps): bump coverallsapp/github-action from 1.2.5 to 2.3.6 (#1051) Bumps [coverallsapp/github-action](https://github.com/coverallsapp/github-action) from 1.2.5 to 2.3.6. - [Release notes](https://github.com/coverallsapp/github-action/releases) - [Upgrade guide](https://github.com/coverallsapp/github-action/blob/main/UPGRADE.md) - [Commits](https://github.com/coverallsapp/github-action/compare/09b709cf6a16e30b0808ba050c7a6e8a5ef13f8d...648a8eb78e6d50909eff900e4ec85cab4524a45b) --- updated-dependencies: - dependency-name: coverallsapp/github-action dependency-version: 2.3.6 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 746b29e1..210657e2 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -238,6 +238,6 @@ jobs: run: find ./coverage -name lcov.info -exec printf '-a %q\n' {} \; | xargs lcov -o ./coverage/lcov.info - name: Upload coverage report - uses: coverallsapp/github-action@09b709cf6a16e30b0808ba050c7a6e8a5ef13f8d # master + uses: coverallsapp/github-action@648a8eb78e6d50909eff900e4ec85cab4524a45b # master with: github-token: ${{ secrets.GITHUB_TOKEN }} From b9fcad8a8bc8f1ac84809d81c569ffbcc6f9ef99 Mon Sep 17 00:00:00 2001 From: Noritaka Kobayashi Date: Sat, 12 Jul 2025 02:21:20 +0900 Subject: [PATCH 19/45] chore: fix typos (#1066) --- HISTORY.md | 2 +- README.md | 4 ++-- scripts/version-history.js | 2 +- test/session.js | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/HISTORY.md b/HISTORY.md index cc879c63..1dcedcc5 100644 --- a/HISTORY.md +++ b/HISTORY.md @@ -171,7 +171,7 @@ unpublished - Improve error message when `expires` is not a `Date` - perf: enable strict mode - perf: use for loop in parse - - perf: use string concatination for serialization + - perf: use string concatenation for serialization * deps: parseurl@~1.3.1 - perf: enable strict mode * deps: uid-safe@~2.1.1 diff --git a/README.md b/README.md index 65a37e63..b880e6b4 100644 --- a/README.md +++ b/README.md @@ -269,7 +269,7 @@ With this enabled, the session identifier cookie will expire in [`maxAge`](#cookiemaxage) since the last response was sent instead of in [`maxAge`](#cookiemaxage) since the session was last modified by the server. -This is typically used in conjuction with short, non-session-length +This is typically used in conjunction with short, non-session-length [`maxAge`](#cookiemaxage) values to provide a quick timeout of the session data with reduced potential of it occurring during on going server interactions. @@ -773,7 +773,7 @@ a [variety of storage types](https://www.npmjs.com/package/cache-manager#store-e [express-session-level-url]: https://www.npmjs.com/package/express-session-level [express-session-level-image]: https://badgen.net/github/stars/tgohn/express-session-level?label=%E2%98%85 -[![★][express-session-rsdb-image] express-session-rsdb][express-session-rsdb-url] Session store based on Rocket-Store: A very simple, super fast and yet powerfull, flat file database. +[![★][express-session-rsdb-image] express-session-rsdb][express-session-rsdb-url] Session store based on Rocket-Store: A very simple, super fast and yet powerful, flat file database. [express-session-rsdb-url]: https://www.npmjs.com/package/express-session-rsdb [express-session-rsdb-image]: https://badgen.net/github/stars/paragi/express-session-rsdb?label=%E2%98%85 diff --git a/scripts/version-history.js b/scripts/version-history.js index b8a2b0e8..c58268ad 100644 --- a/scripts/version-history.js +++ b/scripts/version-history.js @@ -16,7 +16,7 @@ if (!MD_HEADER_REGEXP.test(historyFileLines[1])) { } if (!VERSION_PLACEHOLDER_REGEXP.test(historyFileLines[0])) { - console.error('Missing placegolder version in HISTORY.md') + console.error('Missing placeholder version in HISTORY.md') process.exit(1) } diff --git a/test/session.js b/test/session.js index 7bf3e51f..a7d79b70 100644 --- a/test/session.js +++ b/test/session.js @@ -1710,7 +1710,7 @@ describe('session()', function(){ }) }) - it('should not override an overriden `reload` in case of errors', function (done) { + it('should not override an overridden `reload` in case of errors', function (done) { var store = new session.MemoryStore() var server = createServer({ store: store, resave: false }, function (req, res) { if (req.url === '/') { From 58087831a68787fb3c1ef8b821efb965225dc725 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= Date: Thu, 17 Jul 2025 19:25:18 +0200 Subject: [PATCH 20/45] deps: on-headers@1.1.0 (#1069) --- HISTORY.md | 3 ++- package.json | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/HISTORY.md b/HISTORY.md index 1dcedcc5..401ffbd5 100644 --- a/HISTORY.md +++ b/HISTORY.md @@ -1,7 +1,8 @@ unpublished ========== * deps: mocha@10.8.2 - + * deps: on-headers@~1.1.0 + - Fix [CVE-2025-7339](https://www.cve.org/CVERecord?id=CVE-2025-7339) ([GHSA-76c9-3jph-rj3q](https://github.com/expressjs/on-headers/security/advisories/GHSA-76c9-3jph-rj3q)) 1.18.1 / 2024-10-08 ========== diff --git a/package.json b/package.json index b4978a27..f03896af 100644 --- a/package.json +++ b/package.json @@ -14,7 +14,7 @@ "cookie-signature": "1.0.7", "debug": "2.6.9", "depd": "~2.0.0", - "on-headers": "~1.0.2", + "on-headers": "~1.1.0", "parseurl": "~1.3.3", "safe-buffer": "5.2.1", "uid-safe": "~2.1.5" From d10709f319d1ff4069e1e552fc7f3ca27989e981 Mon Sep 17 00:00:00 2001 From: Chris de Almeida Date: Thu, 17 Jul 2025 12:51:20 -0500 Subject: [PATCH 21/45] =?UTF-8?q?=F0=9F=94=96=20v1.18.2=20(#1070)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- HISTORY.md | 2 +- package.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/HISTORY.md b/HISTORY.md index 401ffbd5..9aacf124 100644 --- a/HISTORY.md +++ b/HISTORY.md @@ -1,4 +1,4 @@ -unpublished +1.18.2 / 2025-07-17 ========== * deps: mocha@10.8.2 * deps: on-headers@~1.1.0 diff --git a/package.json b/package.json index f03896af..7039d1d4 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "express-session", - "version": "1.18.1", + "version": "1.18.2", "description": "Simple session middleware for Express", "author": "TJ Holowaychuk (http://tjholowaychuk.com)", "contributors": [ From 1aa756d20a1af2b922e9897ca0010fa466ce17e7 Mon Sep 17 00:00:00 2001 From: Sebastian Beltran Date: Wed, 23 Jul 2025 07:42:19 -0500 Subject: [PATCH 22/45] chore: add funding to package.json (#1071) --- package.json | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/package.json b/package.json index 7039d1d4..3bc6ac59 100644 --- a/package.json +++ b/package.json @@ -8,6 +8,10 @@ "Joe Wagner " ], "repository": "expressjs/session", + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + }, "license": "MIT", "dependencies": { "cookie": "0.7.2", From 488102d3d79ee394c90e0b051bf0dbe137956400 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 2 Nov 2025 09:29:37 +0100 Subject: [PATCH 23/45] build(deps): bump actions/download-artifact from 4.3.0 to 6.0.0 (#1086) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 210657e2..167e2e38 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -229,7 +229,7 @@ jobs: run: sudo apt-get -y install lcov - name: Collect coverage reports - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 with: path: ./coverage From b6f79be32f4afd88b92eda9a3448b7136cecac1e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 2 Nov 2025 09:30:20 +0100 Subject: [PATCH 24/45] build(deps): bump github/codeql-action from 3.28.18 to 4.31.2 (#1085) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/codeql.yml | 4 ++-- .github/workflows/scorecard.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 1a41f87b..bdff87f4 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -38,7 +38,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18 + uses: github/codeql-action/init@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2 with: languages: javascript # If you wish to specify custom queries, you can do so here or in a config file. @@ -61,6 +61,6 @@ jobs: # ./location_of_script_within_repo/buildscript.sh - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18 + uses: github/codeql-action/analyze@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2 with: category: "/language:javascript" \ No newline at end of file diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index d53e5871..a6a29448 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -68,6 +68,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard. - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18 + uses: github/codeql-action/upload-sarif@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2 with: sarif_file: results.sarif \ No newline at end of file From c83c8e28d586c3f86f9844356590b2e704843f57 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 2 Dec 2025 09:15:55 +0100 Subject: [PATCH 25/45] build(deps): bump coverallsapp/github-action from 2.3.6 to 2.3.7 (#1091) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 167e2e38..f7078328 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -238,6 +238,6 @@ jobs: run: find ./coverage -name lcov.info -exec printf '-a %q\n' {} \; | xargs lcov -o ./coverage/lcov.info - name: Upload coverage report - uses: coverallsapp/github-action@648a8eb78e6d50909eff900e4ec85cab4524a45b # master + uses: coverallsapp/github-action@5cbfd81b66ca5d10c19b062c04de0199c215fb6e # master with: github-token: ${{ secrets.GITHUB_TOKEN }} From a095a9a17c862746af8c2d8671825e4743d38169 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 2 Dec 2025 09:16:45 +0100 Subject: [PATCH 26/45] build(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 (#1090) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci.yml | 2 +- .github/workflows/scorecard.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f7078328..30a606f2 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -208,7 +208,7 @@ jobs: fi - name: Upload code coverage - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0 if: steps.list_env.outputs.nyc != '' with: name: coverage-${{ matrix.node-version }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index a6a29448..a6efdc9e 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -60,7 +60,7 @@ jobs: # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF # format to the repository Actions tab. - name: "Upload artifact" - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0 with: name: SARIF file path: results.sarif From 0e7a438512fa584c617d681cf7fca8fb5c42da5d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 2 Dec 2025 09:17:30 +0100 Subject: [PATCH 27/45] build(deps): bump github/codeql-action from 4.31.2 to 4.31.6 (#1089) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/codeql.yml | 4 ++-- .github/workflows/scorecard.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index bdff87f4..31ffb64a 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -38,7 +38,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2 + uses: github/codeql-action/init@fe4161a26a8629af62121b670040955b330f9af2 # v4.31.6 with: languages: javascript # If you wish to specify custom queries, you can do so here or in a config file. @@ -61,6 +61,6 @@ jobs: # ./location_of_script_within_repo/buildscript.sh - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2 + uses: github/codeql-action/analyze@fe4161a26a8629af62121b670040955b330f9af2 # v4.31.6 with: category: "/language:javascript" \ No newline at end of file diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index a6efdc9e..51230d44 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -68,6 +68,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard. - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2 + uses: github/codeql-action/upload-sarif@fe4161a26a8629af62121b670040955b330f9af2 # v4.31.6 with: sarif_file: results.sarif \ No newline at end of file From 1307f30a62d10cf33f7abd59b8ecf3aae428ff3b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 2 Dec 2025 09:18:56 +0100 Subject: [PATCH 28/45] build(deps): bump actions/checkout from 4.2.2 to 6.0.0 (#1088) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci.yml | 4 ++-- .github/workflows/codeql.yml | 2 +- .github/workflows/scorecard.yml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 30a606f2..13336155 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -130,7 +130,7 @@ jobs: node-version: "21.6" steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0 - name: Install Node.js ${{ matrix.node-version }} shell: bash -eo pipefail -l {0} @@ -222,7 +222,7 @@ jobs: needs: test runs-on: ubuntu-latest steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0 - name: Install lcov shell: bash diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 31ffb64a..8534ee51 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -34,7 +34,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 51230d44..30f54d2b 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -33,7 +33,7 @@ jobs: steps: - name: "Checkout code" - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0 with: persist-credentials: false From 2cd6561f64cb9e0b847237885802351606d4029d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 17 Dec 2025 16:04:48 -0500 Subject: [PATCH 29/45] build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.3 (#1082) Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.1 to 2.4.3. - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](https://github.com/ossf/scorecard-action/compare/f49aabe0b5af0936a0987cfb85d86b75731b0186...4eaacf0543bb3f2c246792bd56e8cdeffafb205a) --- updated-dependencies: - dependency-name: ossf/scorecard-action dependency-version: 2.4.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 30f54d2b..169262af 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -38,7 +38,7 @@ jobs: persist-credentials: false - name: "Run analysis" - uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1 + uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 with: results_file: results.sarif results_format: sarif From 00b8a5ff111bba1a0ca9bb3d84947446c198a9a3 Mon Sep 17 00:00:00 2001 From: Ayoub Mabrouk <77799760+Ayoub-Mabrouk@users.noreply.github.com> Date: Thu, 18 Dec 2025 02:53:00 +0100 Subject: [PATCH 30/45] refactor: remove unused `sess` parameter from `generateSessionId` function (#1001) The `sess` parameter was not used in `generateSessionId`, so it was removed to improve code clarity and reduce potential confusion. Co-authored-by: Sebastian Beltran --- index.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/index.js b/index.js index d41b2378..85a0330c 100644 --- a/index.js +++ b/index.js @@ -523,7 +523,7 @@ function session(options) { * @private */ -function generateSessionId(sess) { +function generateSessionId() { return uid(24); } From 6d69f090d6239394e008cf39a2be2d5f60bdde97 Mon Sep 17 00:00:00 2001 From: Sebastian Beltran Date: Thu, 18 Dec 2025 06:45:22 -0500 Subject: [PATCH 31/45] chore: remove history.md from being packaged on publish (#1097) --- package.json | 1 - 1 file changed, 1 deletion(-) diff --git a/package.json b/package.json index 3bc6ac59..6d04c9c1 100644 --- a/package.json +++ b/package.json @@ -35,7 +35,6 @@ }, "files": [ "session/", - "HISTORY.md", "index.js" ], "engines": { From 264b6a0360a1d4b34955c27948bf1b1cfad74d66 Mon Sep 17 00:00:00 2001 From: Sebastian Beltran Date: Thu, 18 Dec 2025 06:46:00 -0500 Subject: [PATCH 32/45] deps: use tilde notation for dependencies (#1096) --- HISTORY.md | 6 ++++++ package.json | 8 ++++---- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/HISTORY.md b/HISTORY.md index 9aacf124..e12d0a00 100644 --- a/HISTORY.md +++ b/HISTORY.md @@ -1,3 +1,9 @@ +# Unreleased changes + +### 🚀 Improvements + +* deps: use tilde notation for dependencies + 1.18.2 / 2025-07-17 ========== * deps: mocha@10.8.2 diff --git a/package.json b/package.json index 6d04c9c1..42d244b9 100644 --- a/package.json +++ b/package.json @@ -14,13 +14,13 @@ }, "license": "MIT", "dependencies": { - "cookie": "0.7.2", - "cookie-signature": "1.0.7", - "debug": "2.6.9", + "cookie": "~0.7.2", + "cookie-signature": "~1.0.7", + "debug": "~2.6.9", "depd": "~2.0.0", "on-headers": "~1.1.0", "parseurl": "~1.3.3", - "safe-buffer": "5.2.1", + "safe-buffer": "~5.2.1", "uid-safe": "~2.1.5" }, "devDependencies": { From 73e0193afbee24bca8744e4fc8a67b92810301e8 Mon Sep 17 00:00:00 2001 From: Zacchaeus Bolaji Date: Sat, 17 Jan 2026 23:20:37 +0100 Subject: [PATCH 33/45] Add sameSite 'auto' support to match secure 'auto' pattern (#1087) * feat: add sameSite 'auto' support for automatic cross-site cookie configuration * test: enhance session tests for secure and SameSite cookie attributes * test: update session tests for SameSite cookie handling and logging * docs: add history entry * refactor: cache issecure result to avoid duplicate calls * Apply suggestion from @bjohansebas --------- Co-authored-by: Sebastian Beltran --- HISTORY.md | 4 ++ README.md | 9 +++ index.js | 8 ++- package.json | 2 +- test/session.js | 167 ++++++++++++++++++++++++++++++++++++++++++++++++ 5 files changed, 188 insertions(+), 2 deletions(-) diff --git a/HISTORY.md b/HISTORY.md index e12d0a00..60cf6db4 100644 --- a/HISTORY.md +++ b/HISTORY.md @@ -2,6 +2,10 @@ ### 🚀 Improvements +* Add sameSite 'auto' support for automatic SameSite attribute configuration + + Added `sameSite: 'auto'` option for cookie configuration that automatically sets `SameSite=None` for HTTPS and `SameSite=Lax` for HTTP connections, simplifying cookie handling across different environments. + * deps: use tilde notation for dependencies 1.18.2 / 2025-07-17 diff --git a/README.md b/README.md index b880e6b4..4f19ce59 100644 --- a/README.md +++ b/README.md @@ -130,6 +130,7 @@ By default, this is `false`. - `'lax'` will set the `SameSite` attribute to `Lax` for lax same site enforcement. - `'none'` will set the `SameSite` attribute to `None` for an explicit cross-site cookie. - `'strict'` will set the `SameSite` attribute to `Strict` for strict same site enforcement. + - `'auto'` will set the `SameSite` attribute to `None` for secure connections and `Lax` for non-secure connections. More information about the different enforcement levels can be found in [the specification][rfc-6265bis-03-4.1.2.7]. @@ -141,6 +142,14 @@ the future. This also means many clients may ignore this attribute until they un that requires that the `Secure` attribute be set to `true` when the `SameSite` attribute has been set to `'none'`. Some web browsers or other clients may be adopting this specification. +The `cookie.sameSite` option can also be set to the special value `'auto'` to have +this setting automatically match the determined security of the connection. When the connection +is secure (HTTPS), the `SameSite` attribute will be set to `None` to enable cross-site usage. +When the connection is not secure (HTTP), the `SameSite` attribute will be set to `Lax` for +better security while maintaining functionality. This is useful when the Express `"trust proxy"` +setting is properly setup to simplify development vs production configuration, particularly +for SAML authentication scenarios. + ##### cookie.secure Specifies the `boolean` value for the `Secure` `Set-Cookie` attribute. When truthy, diff --git a/index.js b/index.js index 85a0330c..1ee99eb5 100644 --- a/index.js +++ b/index.js @@ -160,8 +160,14 @@ function session(options) { req.session = new Session(req); req.session.cookie = new Cookie(cookieOptions); + var isSecure = issecure(req, trustProxy); + if (cookieOptions.secure === 'auto') { - req.session.cookie.secure = issecure(req, trustProxy); + req.session.cookie.secure = isSecure; + } + + if (cookieOptions.sameSite === 'auto') { + req.session.cookie.sameSite = isSecure ? 'none' : 'lax'; } }; diff --git a/package.json b/package.json index 42d244b9..0f7d92e7 100644 --- a/package.json +++ b/package.json @@ -42,7 +42,7 @@ }, "scripts": { "lint": "eslint . && node ./scripts/lint-readme.js", - "test": "./test/support/gencert.sh && mocha --require test/support/env --check-leaks --bail --no-exit --reporter spec test/", + "test": "./test/support/gencert.sh && mocha --require test/support/env --check-leaks --no-exit --reporter spec test/", "test-ci": "nyc --reporter=lcov --reporter=text npm test", "test-cov": "nyc npm test", "version": "node scripts/version-history.js && git add HISTORY.md" diff --git a/test/session.js b/test/session.js index a7d79b70..31f4707b 100644 --- a/test/session.js +++ b/test/session.js @@ -801,6 +801,173 @@ describe('session()', function(){ }) }) }) + + describe('when "sameSite" set to "auto"', function () { + describe('basic functionality', function () { + before(function () { + function setup (req) { + req.secure = JSON.parse(req.headers['x-secure']) + } + + function respond (req, res) { + res.end(String(req.secure)) + } + + this.server = createServer(setup, { cookie: { sameSite: 'auto' } }, respond) + }) + + it('should set SameSite=None for secure connections', function (done) { + request(this.server) + .get('/') + .set('X-Secure', 'true') + .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'None')) + .expect(200, 'true', done) + }) + + it('should set SameSite=Lax for insecure connections', function (done) { + request(this.server) + .get('/') + .set('X-Secure', 'false') + .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'Lax')) + .expect(200, 'false', done) + }) + }) + + describe('with proxy settings', function () { + describe('when "proxy" is "true"', function () { + before(function () { + this.server = createServer({ proxy: true, cookie: { sameSite: 'auto' }}) + }) + + it('should set SameSite=None when X-Forwarded-Proto is https', function (done) { + request(this.server) + .get('/') + .set('X-Forwarded-Proto', 'https') + .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'None')) + .expect(200, done) + }) + + it('should set SameSite=Lax when X-Forwarded-Proto is http', function (done) { + request(this.server) + .get('/') + .set('X-Forwarded-Proto', 'http') + .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'Lax')) + .expect(200, done) + }) + }) + + describe('when "proxy" is "false"', function () { + before(function () { + this.server = createServer({ proxy: false, cookie: { sameSite: 'auto' }}) + }) + + it('should set SameSite=Lax when X-Forwarded-Proto is https', function (done) { + request(this.server) + .get('/') + .set('X-Forwarded-Proto', 'https') + .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'Lax')) + .expect(200, done) + }) + }) + }) + + describe('combined with secure auto', function() { + describe('when "secure" is "auto"', function () { + before(function () { + function setup (req) { + req.secure = JSON.parse(req.headers['x-secure']) + } + + function respond (req, res) { + res.end(String(req.secure)) + } + + this.server = createServer(setup, { cookie: { secure: 'auto', sameSite: 'auto' } }, respond) + }) + + it('should set both Secure and SameSite=None when secure', function (done) { + request(this.server) + .get('/') + .set('X-Secure', 'true') + .expect(shouldSetCookieWithAttribute('connect.sid', 'Secure')) + .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'None')) + .expect(200, 'true', done) + }) + + it('should set neither Secure nor SameSite=None when insecure', function (done) { + request(this.server) + .get('/') + .set('X-Secure', 'false') + .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Secure')) + .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'Lax')) + .expect(200, 'false', done) + }) + }) + + describe('when "secure" is "false"', function () { + before(function () { + function setup (req) { + req.secure = JSON.parse(req.headers['x-secure']) + } + + function respond (req, res) { + res.end(String(req.secure)) + } + + this.server = createServer(setup, { cookie: { secure: false, sameSite: 'auto' } }, respond) + }) + + it('should set SameSite=None without Secure when secure', function (done) { + request(this.server) + .get('/') + .set('X-Secure', 'true') + .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Secure')) + .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'None')) + .expect(200, 'true', done) + }) + + it('should set SameSite=Lax without Secure when insecure', function (done) { + request(this.server) + .get('/') + .set('X-Secure', 'false') + .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Secure')) + .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'Lax')) + .expect(200, 'false', done) + }) + }) + + describe('when "secure" is "true"', function () { + before(function () { + function setup (req) { + req.secure = JSON.parse(req.headers['x-secure']) + } + + function respond (req, res) { + res.end(String(req.secure)) + } + + this.server = createServer(setup, { cookie: { secure: true, sameSite: 'auto' } }, respond) + }) + + it('should set both Secure and SameSite=None when secure', function (done) { + request(this.server) + .get('/') + .set('X-Secure', 'true') + .expect(shouldSetCookieWithAttribute('connect.sid', 'Secure')) + .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'None')) + .expect(200, 'true', done) + }) + + it('should not set cookie when insecure', function (done) { + request(this.server) + .get('/') + .set('X-Secure', 'false') + .expect(shouldNotHaveHeader('Set-Cookie')) + .expect(200, 'false', done) + }) + }) + }) + }) }) describe('genid option', function(){ From 2673736548304359d3d3fb8f8d3019b4ea5b61a7 Mon Sep 17 00:00:00 2001 From: Lincon Date: Mon, 19 Jan 2026 11:44:13 -0300 Subject: [PATCH 34/45] feat: add support to dynamic cookie options (#1027) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Sebastian Beltran Co-authored-by: Ulises Gascón --- HISTORY.md | 21 ++++++++++++++++++++ README.md | 20 +++++++++++++++++++ index.js | 7 ++++--- test/session.js | 52 +++++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 97 insertions(+), 3 deletions(-) diff --git a/HISTORY.md b/HISTORY.md index 60cf6db4..e28c5427 100644 --- a/HISTORY.md +++ b/HISTORY.md @@ -2,6 +2,27 @@ ### 🚀 Improvements +* Add dynamic cookie options support + + Cookie options can now be dynamic, allowing for more flexible and context-aware configuration based on each request. This feature enables programmatic modification of cookie attributes like `secure`, `httpOnly`, `sameSite`, `maxAge`, `domain`, and `path` based on session or request conditions. + + ```js + var app = express() + app.use(session({ + secret: 'keyboard cat', + resave: false, + saveUninitialized: true, + cookie: function (req) { + var match = req.url.match(/^\/([^/]+)/); + return { + path: match ? '/' + match[1] : '/', + httpOnly: true, + secure: req.secure || false, + maxAge: 60000 + } + } + })) + ``` * Add sameSite 'auto' support for automatic SameSite attribute configuration Added `sameSite: 'auto'` option for cookie configuration that automatically sets `SameSite=None` for HTTPS and `SameSite=Lax` for HTTP connections, simplifying cookie handling across different environments. diff --git a/README.md b/README.md index 4f19ce59..292b2024 100644 --- a/README.md +++ b/README.md @@ -49,6 +49,26 @@ For a list of stores, see [compatible session stores](#compatible-session-stores Settings object for the session ID cookie. The default value is `{ path: '/', httpOnly: true, secure: false, maxAge: null }`. +In addition to providing a static object, you can also pass a callback function to dynamically generate the cookie options for each request. The callback receives the `req` object as its argument and should return an object containing the cookie settings. + +```js +var app = express() +app.use(session({ + secret: 'keyboard cat', + resave: false, + saveUninitialized: true, + cookie: function(req) { + var match = req.url.match(/^\/([^/]+)/); + return { + path: match ? '/' + match[1] : '/', + httpOnly: true, + secure: req.secure || false, + maxAge: 60000 + } + } +})) +``` + The following are options that can be set in this object. ##### cookie.domain diff --git a/index.js b/index.js index 1ee99eb5..1a509318 100644 --- a/index.js +++ b/index.js @@ -70,7 +70,7 @@ var defer = typeof setImmediate === 'function' * Setup session store with the given `options`. * * @param {Object} [options] - * @param {Object} [options.cookie] Options for cookie + * @param {Object|Function} [options.cookie] Options for cookie * @param {Function} [options.genid] * @param {String} [options.name=connect.sid] Session ID cookie name * @param {Boolean} [options.proxy] @@ -158,7 +158,7 @@ function session(options) { store.generate = function(req){ req.sessionID = generateId(req); req.session = new Session(req); - req.session.cookie = new Cookie(cookieOptions); + req.session.cookie = new Cookie(typeof cookieOptions === 'function' ? cookieOptions(req) : cookieOptions); var isSecure = issecure(req, trustProxy); @@ -199,7 +199,8 @@ function session(options) { // pathname mismatch var originalPath = parseUrl.original(req).pathname || '/' - if (originalPath.indexOf(cookieOptions.path || '/') !== 0) { + var resolvedCookieOptions = typeof cookieOptions === 'function' ? cookieOptions(req) : cookieOptions + if (originalPath.indexOf(resolvedCookieOptions.path || '/') !== 0) { debug('pathname mismatch') next() return diff --git a/test/session.js b/test/session.js index 31f4707b..46fed763 100644 --- a/test/session.js +++ b/test/session.js @@ -802,6 +802,58 @@ describe('session()', function(){ }) }) + describe('when "cookie" is a function', function () { + it('should call custom function and apply cookie options', function (done) { + var cookieCallbackCalled = false; + var cookieCallback = function () { + cookieCallbackCalled = true; + return { path: '/test', httpOnly: true, secure: false }; + }; + var server = createServer({ cookie: cookieCallback }); + request(server) + .get('/test') + .expect( + shouldSetCookieWithAttributeAndValue('connect.sid', 'Path', '/test') + ) + .expect(shouldSetCookieWithAttribute('connect.sid', 'HttpOnly')) + .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Secure')) + .expect(200, function (err) { + if (err) return done(err); + assert.strictEqual( + cookieCallbackCalled, + true, + 'should have called cookie callback' + ); + done(); + }); + }); + + it('should provide req argument', function (done) { + var _path = '/test'; + var cookieCallbackCalled = false; + var cookieCallback = function (req) { + cookieCallbackCalled = true; + return { path: req.url, httpOnly: true, secure: false }; + }; + var server = createServer({ cookie: cookieCallback }); + request(server) + .get(_path) + .expect( + shouldSetCookieWithAttributeAndValue('connect.sid', 'Path', _path) + ) + .expect(shouldSetCookieWithAttribute('connect.sid', 'HttpOnly')) + .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Secure')) + .expect(200, function (err) { + if (err) return done(err); + assert.strictEqual( + cookieCallbackCalled, + true, + 'should have called cookie callback' + ); + done(); + }); + }); + }); describe('when "sameSite" set to "auto"', function () { describe('basic functionality', function () { before(function () { From c10b2a383841766899f6dcf53c8aff8c7fd3d2e7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= Date: Thu, 22 Jan 2026 15:44:27 +0100 Subject: [PATCH 35/45] 1.19.0 (#1107) --- HISTORY.md | 36 ++++++------------------------------ package.json | 2 +- 2 files changed, 7 insertions(+), 31 deletions(-) diff --git a/HISTORY.md b/HISTORY.md index e28c5427..fae1a0f1 100644 --- a/HISTORY.md +++ b/HISTORY.md @@ -1,33 +1,9 @@ -# Unreleased changes - -### 🚀 Improvements - -* Add dynamic cookie options support - - Cookie options can now be dynamic, allowing for more flexible and context-aware configuration based on each request. This feature enables programmatic modification of cookie attributes like `secure`, `httpOnly`, `sameSite`, `maxAge`, `domain`, and `path` based on session or request conditions. - - ```js - var app = express() - app.use(session({ - secret: 'keyboard cat', - resave: false, - saveUninitialized: true, - cookie: function (req) { - var match = req.url.match(/^\/([^/]+)/); - return { - path: match ? '/' + match[1] : '/', - httpOnly: true, - secure: req.secure || false, - maxAge: 60000 - } - } - })) - ``` -* Add sameSite 'auto' support for automatic SameSite attribute configuration - - Added `sameSite: 'auto'` option for cookie configuration that automatically sets `SameSite=None` for HTTPS and `SameSite=Lax` for HTTP connections, simplifying cookie handling across different environments. - -* deps: use tilde notation for dependencies +1.19.0 / 2026-01-22 +========== + + * Add dynamic cookie options support + * Add sameSite 'auto' support for automatic SameSite attribute configuration + * deps: use tilde notation for dependencies 1.18.2 / 2025-07-17 ========== diff --git a/package.json b/package.json index 0f7d92e7..36387796 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "express-session", - "version": "1.18.2", + "version": "1.19.0", "description": "Simple session middleware for Express", "author": "TJ Holowaychuk (http://tjholowaychuk.com)", "contributors": [ From 31bb90351eceb003e4fb40d01c6c0ca1c1ba2f6f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 2 Mar 2026 08:42:03 +0100 Subject: [PATCH 36/45] build(deps): bump github/codeql-action from 4.31.6 to 4.32.4 (#1111) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.31.6 to 4.32.4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/fe4161a26a8629af62121b670040955b330f9af2...89a39a4e59826350b863aa6b6252a07ad50cf83e) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.32.4 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/codeql.yml | 4 ++-- .github/workflows/scorecard.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 8534ee51..e4fbd605 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -38,7 +38,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@fe4161a26a8629af62121b670040955b330f9af2 # v4.31.6 + uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4 with: languages: javascript # If you wish to specify custom queries, you can do so here or in a config file. @@ -61,6 +61,6 @@ jobs: # ./location_of_script_within_repo/buildscript.sh - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@fe4161a26a8629af62121b670040955b330f9af2 # v4.31.6 + uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4 with: category: "/language:javascript" \ No newline at end of file diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 169262af..a1566ba6 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -68,6 +68,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard. - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@fe4161a26a8629af62121b670040955b330f9af2 # v4.31.6 + uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4 with: sarif_file: results.sarif \ No newline at end of file From 1d90a1a61921ae600fc127b3bc0ce6de03890cc5 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 2 Mar 2026 08:42:39 +0100 Subject: [PATCH 37/45] build(deps): bump actions/upload-artifact from 5.0.0 to 7.0.0 (#1112) Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 5.0.0 to 7.0.0. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/330a01c490aca151604b8cf639adc76d48f6c5d4...bbbca2ddaa5d8feaa63e36b76fdaad77386f024f) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci.yml | 2 +- .github/workflows/scorecard.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 13336155..152d687d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -208,7 +208,7 @@ jobs: fi - name: Upload code coverage - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0 + uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 if: steps.list_env.outputs.nyc != '' with: name: coverage-${{ matrix.node-version }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index a1566ba6..e6ba6369 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -60,7 +60,7 @@ jobs: # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF # format to the repository Actions tab. - name: "Upload artifact" - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0 + uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 with: name: SARIF file path: results.sarif From 625c136fe52189ed3cc6e7ad4eb45b1cf11540b1 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 2 Mar 2026 08:43:16 +0100 Subject: [PATCH 38/45] build(deps): bump actions/download-artifact from 6.0.0 to 8.0.0 (#1113) Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 6.0.0 to 8.0.0. - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/018cc2cf5baa6db3ef3c5f8a56943fffe632ef53...70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: 8.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 152d687d..9dee4344 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -229,7 +229,7 @@ jobs: run: sudo apt-get -y install lcov - name: Collect coverage reports - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 + uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0 with: path: ./coverage From 663359c771f6b13b9b3bd60ee7d56062d98c63bd Mon Sep 17 00:00:00 2001 From: Ignacio Mangas Date: Mon, 16 Mar 2026 12:23:53 +0100 Subject: [PATCH 39/45] chore: fix node to v25 (#1110) --- .github/workflows/ci.yml | 27 ++++++++++++++++++++++++--- 1 file changed, 24 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9dee4344..29b55239 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -37,6 +37,10 @@ jobs: - Node.js 19.x - Node.js 20.x - Node.js 21.x + - Node.js 22.x + - Node.js 23.x + - Node.js 24.x + - Node.js 25.x include: - name: Node.js 0.8 @@ -124,10 +128,22 @@ jobs: node-version: "19.9" - name: Node.js 20.x - node-version: "20.11" + node-version: "20" - name: Node.js 21.x - node-version: "21.6" + node-version: "21" + + - name: Node.js 22.x + node-version: "22" + + - name: Node.js 23.x + node-version: "23" + + - name: Node.js 24.x + node-version: "24" + + - name: Node.js 25.x + node-version: "25" steps: - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0 @@ -139,7 +155,12 @@ jobs: if [[ "${{ matrix.node-version }}" == 0.* && "$(cut -d. -f2 <<< "${{ matrix.node-version }}")" -lt 10 ]]; then nvm install --alias=npm 0.10 nvm use ${{ matrix.node-version }} - sed -i '1s;^.*$;'"$(printf '#!%q' "$(nvm which npm)")"';' "$(readlink -f "$(which npm)")" + if [[ "$(npm -v)" == 1.1.* ]]; then + nvm exec npm npm install -g npm@1.1 + ln -fs "$(which npm)" "$(dirname "$(nvm which npm)")/npm" + else + sed -i '1s;^.*$;'"$(printf '#!%q' "$(nvm which npm)")"';' "$(readlink -f "$(which npm)")" + fi npm config set strict-ssl false fi dirname "$(nvm which ${{ matrix.node-version }})" >> "$GITHUB_PATH" From 2c9512fb790e4bf80b3b62305eb8078028607785 Mon Sep 17 00:00:00 2001 From: krzysdz <12915102+krzysdz@users.noreply.github.com> Date: Sun, 14 Jun 2026 19:11:21 +0000 Subject: [PATCH 40/45] Remove nonexistent projects and update link in readme (#1122) - sequelize has a new website and a slightly broken redirect to the new one - cyclic has shut down - dynamodb-store-v3 package does not exist https://github.com/sequelize/website/issues/839 https://github.com/cyclic-software/www/blob/31e26692f2f04e29917fe011b9bfd7a03fbd7e81/content/posts/cyclic-is-shutting-down.md https://web.archive.org/web/20240501064115/https://www.cyclic.sh/posts/cyclic-is-shutting-down/ --- README.md | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) diff --git a/README.md b/README.md index 292b2024..0a7edb04 100644 --- a/README.md +++ b/README.md @@ -733,7 +733,7 @@ and other multi-core embedded devices). [connect-session-knex-image]: https://badgen.net/github/stars/llambda/connect-session-knex?label=%E2%98%85 [![★][connect-session-sequelize-image] connect-session-sequelize][connect-session-sequelize-url] A session store using -[Sequelize.js](http://sequelizejs.com/), which is a Node.js / io.js ORM for PostgreSQL, MySQL, SQLite and MSSQL. +[Sequelize.js](https://sequelize.org/), which is a Node.js / io.js ORM for PostgreSQL, MySQL, SQLite and MSSQL. [connect-session-sequelize-url]: https://www.npmjs.com/package/connect-session-sequelize [connect-session-sequelize-image]: https://badgen.net/github/stars/mweibel/connect-session-sequelize?label=%E2%98%85 @@ -758,11 +758,6 @@ and other multi-core embedded devices). [dynamodb-store-url]: https://www.npmjs.com/package/dynamodb-store [dynamodb-store-image]: https://badgen.net/github/stars/rafaelrpinto/dynamodb-store?label=%E2%98%85 -[![★][dynamodb-store-v3-image] dynamodb-store-v3][dynamodb-store-v3-url] Implementation of a session store using DynamoDB backed by the [AWS SDK for JavaScript v3](https://github.com/aws/aws-sdk-js-v3). - -[dynamodb-store-v3-url]: https://www.npmjs.com/package/dynamodb-store-v3 -[dynamodb-store-v3-image]: https://badgen.net/github/stars/FryDay/dynamodb-store-v3?label=%E2%98%85 - [![★][express-etcd-image] express-etcd][express-etcd-url] An [etcd](https://github.com/stianeikeland/node-etcd) based session store. [express-etcd-url]: https://www.npmjs.com/package/express-etcd @@ -868,7 +863,7 @@ based session store. Supports all backends supported by Fortune (MongoDB, Redis, [restsession-url]: https://www.npmjs.com/package/restsession [restsession-image]: https://badgen.net/github/stars/jankal/restsession?label=%E2%98%85 -[![★][sequelstore-connect-image] sequelstore-connect][sequelstore-connect-url] A session store using [Sequelize.js](http://sequelizejs.com/). +[![★][sequelstore-connect-image] sequelstore-connect][sequelstore-connect-url] A session store using [Sequelize.js](https://sequelize.org/). [sequelstore-connect-url]: https://www.npmjs.com/package/sequelstore-connect [sequelstore-connect-image]: https://badgen.net/github/stars/MattMcFarland/sequelstore-connect?label=%E2%98%85 @@ -883,11 +878,6 @@ based session store. Supports all backends supported by Fortune (MongoDB, Redis, [session-pouchdb-store-url]: https://www.npmjs.com/package/session-pouchdb-store [session-pouchdb-store-image]: https://badgen.net/github/stars/solzimer/session-pouchdb-store?label=%E2%98%85 -[![★][@cyclic.sh/session-store-image] @cyclic.sh/session-store][@cyclic.sh/session-store-url] A DynamoDB-based session store for [Cyclic.sh](https://www.cyclic.sh/) apps. - -[@cyclic.sh/session-store-url]: https://www.npmjs.com/package/@cyclic.sh/session-store -[@cyclic.sh/session-store-image]: https://badgen.net/github/stars/cyclic-software/session-store?label=%E2%98%85 - [![★][@databunker/session-store-image] @databunker/session-store][@databunker/session-store-url] A [Databunker](https://databunker.org/)-based encrypted session store. [@databunker/session-store-url]: https://www.npmjs.com/package/@databunker/session-store From e6509b12dea0c2911352725af99874d574c8d66c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= Date: Mon, 6 Jul 2026 04:07:01 +0200 Subject: [PATCH 41/45] fix: use RFC 6265 path matching for cookie path option (#1114) * test: add specific RFC 6265 5.1.4 compliance tests * feat: add specific RFC 6265 5.1.4 handler * docs: note RFC 6265 5.1.4 compliance in cookie.path documentation * feat: enhance cookie handling for RFC 6265 compliance with path matching and auto secure/sameSite options * feat: enforce RFC 6265 section 5.1.4 path matching for session cookie path --------- Co-authored-by: Sebastian Beltran --- HISTORY.md | 6 ++ README.md | 7 +++ index.js | 48 ++++++++++++++-- test/session.js | 143 ++++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 200 insertions(+), 4 deletions(-) diff --git a/HISTORY.md b/HISTORY.md index fae1a0f1..251d5fa7 100644 --- a/HISTORY.md +++ b/HISTORY.md @@ -1,3 +1,9 @@ +unreleased +========== + + * Enforce RFC 6265 section 5.1.4 path matching for the session cookie path + * Fix `secure: 'auto'` and `sameSite: 'auto'` not being resolved when `cookie` is a function + 1.19.0 / 2026-01-22 ========== diff --git a/README.md b/README.md index 0a7edb04..162ea14d 100644 --- a/README.md +++ b/README.md @@ -126,6 +126,12 @@ More information about can be found in [the proposal](https://github.com/privacy Specifies the value for the `Path` `Set-Cookie`. By default, this is set to `'/'`, which is the root path of the domain. +Since 1.19.1, path matching follows [RFC 6265 section 5.1.4][rfc-6265-5.1.4]. This means +the session middleware will only activate when the request path is an exact match or falls +under a segment boundary of the cookie path. For example, a cookie path of `/admin` will +match `/admin` and `/admin/users` but will **not** match `/administrator`. Prior versions +used a simple prefix check that did not enforce segment boundaries. + ##### cookie.priority Specifies the `string` to be the value for the [`Priority` `Set-Cookie` attribute][rfc-west-cookie-priority-00-4.1]. @@ -1038,6 +1044,7 @@ On Windows, use the corresponding command; [MIT](LICENSE) +[rfc-6265-5.1.4]: https://datatracker.ietf.org/doc/html/rfc6265#section-5.1.4 [rfc-6265bis-03-4.1.2.7]: https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-03#section-4.1.2.7 [rfc-cutler-httpbis-partitioned-cookies]: https://tools.ietf.org/html/draft-cutler-httpbis-partitioned-cookies/ [rfc-west-cookie-priority-00-4.1]: https://tools.ietf.org/html/draft-west-cookie-priority-00#section-4.1 diff --git a/index.js b/index.js index 1a509318..41f9447f 100644 --- a/index.js +++ b/index.js @@ -158,15 +158,16 @@ function session(options) { store.generate = function(req){ req.sessionID = generateId(req); req.session = new Session(req); - req.session.cookie = new Cookie(typeof cookieOptions === 'function' ? cookieOptions(req) : cookieOptions); + var resolvedCookieOptions = typeof cookieOptions === 'function' ? cookieOptions(req) : cookieOptions; + req.session.cookie = new Cookie(resolvedCookieOptions); var isSecure = issecure(req, trustProxy); - if (cookieOptions.secure === 'auto') { + if (resolvedCookieOptions.secure === 'auto') { req.session.cookie.secure = isSecure; } - if (cookieOptions.sameSite === 'auto') { + if (resolvedCookieOptions.sameSite === 'auto') { req.session.cookie.sameSite = isSecure ? 'none' : 'lax'; } }; @@ -200,12 +201,15 @@ function session(options) { // pathname mismatch var originalPath = parseUrl.original(req).pathname || '/' var resolvedCookieOptions = typeof cookieOptions === 'function' ? cookieOptions(req) : cookieOptions - if (originalPath.indexOf(resolvedCookieOptions.path || '/') !== 0) { + var cfgPath = resolvedCookieOptions.path || '/' + + if (!rfcPathMatch(originalPath, cfgPath)) { debug('pathname mismatch') next() return } + // ensure a secret is available or bail if (!secret && !req.secret) { next(new Error('secret option required for sessions')); @@ -523,6 +527,42 @@ function session(options) { }; }; +/** + * Check if the cookiePath matches the requestPath following the + * rules in RFC 6265 section 5.1.4. + * + * @param {String} requestPath + * @param {String} cookiePath + * @return {Boolean} + * @private + */ + +function rfcPathMatch(requestPath, cookiePath) { + // Normalize inputs (Node 0.8-safe) + requestPath = (typeof requestPath === 'string' && requestPath.length) ? requestPath : '/'; + cookiePath = (typeof cookiePath === 'string' && cookiePath.length) ? cookiePath : '/'; + + // Root cookie matches everything + if (cookiePath === '/') return true; + + // Exact match + if (requestPath === cookiePath) return true; + + // Prefix match + if (requestPath.indexOf(cookiePath) === 0) { + // If cookiePath ends with '/', any longer requestPath is OK + if (cookiePath.charAt(cookiePath.length - 1) === '/') return true; + + // Otherwise the next char after the prefix must be '/' + var nextChar = requestPath.length > cookiePath.length + ? requestPath.charAt(cookiePath.length) + : ''; + return nextChar === '/'; + } + + return false; +} + /** * Generate a session ID for a new session. * diff --git a/test/session.js b/test/session.js index 46fed763..330c4137 100644 --- a/test/session.js +++ b/test/session.js @@ -853,6 +853,40 @@ describe('session()', function(){ done(); }); }); + + it('should not set cookie when request-path does not match returned path', function (done) { + var cookieCallback = function () { + return { path: '/admin', httpOnly: true, secure: false }; + }; + var server = createServer({ cookie: cookieCallback }); + request(server) + .get('/administrator') + .expect(shouldNotHaveHeader('Set-Cookie')) + .expect(200, done); + }); + + it('should resolve "secure" and "sameSite" set to "auto"', function (done) { + function setup (req) { + req.secure = JSON.parse(req.headers['x-secure']) + } + + function respond (req, res) { + res.end(String(req.secure)) + } + + var cookieCallback = function () { + return { path: '/', secure: 'auto', sameSite: 'auto' }; + }; + var server = createServer(setup, { cookie: cookieCallback }, respond); + request(server) + .get('/') + .set('X-Secure', 'true') + .expect(shouldSetCookieWithAttribute('connect.sid', 'Secure')) + .expect( + shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'None') + ) + .expect(200, 'true', done); + }); }); describe('when "sameSite" set to "auto"', function () { describe('basic functionality', function () { @@ -2620,6 +2654,115 @@ describe('session()', function(){ }) }) +describe('path matching (RFC 6265)', function () { + describe('when "path" is "/" (root path)', function () { + before(function () { + this.server = createServer({ cookie: { path: '/' } }) + }) + + it('should set cookie when request-path is "/" (root path)', function (done) { + // RFC 6265 5.1.4: "The cookie-path and the request-path are identical." + request(this.server) + .get('/') + .expect(shouldSetCookie('connect.sid')) + .expect(200, done) + }) + + it('should set cookie when request-path is any path ("/foo")', function (done) { + // RFC 6265 5.1.4: "The cookie-path is a prefix of the request-path, and the last + // character of the cookie-path is %x2F ("/")." + request(this.server) + .get('/foo') + .expect(shouldSetCookie('connect.sid')) + .expect(200, done) + }) + + it('should set cookie when request-path has multiple segments ("/foo/bar/baz")', function (done) { + // RFC 6265 5.1.4: "The cookie-path is a prefix of the request-path, and the last + // character of the cookie-path is %x2F ("/")." + request(this.server) + .get('/foo/bar/baz') + .expect(shouldSetCookie('connect.sid')) + .expect(200, done) + }) + }) + + describe('when "path" is "/admin"', function () { + before(function () { + this.server = createServer({ cookie: { path: '/admin' } }) + }) + + it('should set cookie when request-path and cookie-path are identical ("/admin")', function (done) { + // RFC 6265 5.1.4: "The cookie-path and the request-path are identical." + request(this.server) + .get('/admin') + .expect(shouldSetCookie('connect.sid')) + .expect(200, done) + }) + + it('should set cookie when cookie-path is prefix and last char is "/" ("/admin/")', function (done) { + // RFC 6265 5.1.4: "The cookie-path is a prefix of the request-path, and the last + // character of the cookie-path is %x2F ("/")." + request(this.server) + .get('/admin/') + .expect(shouldSetCookie('connect.sid')) + .expect(200, done) + }) + + it('should set cookie when cookie-path is prefix and next char is "/" ("/admin/users")', function (done) { + // RFC 6265 5.1.4: "The cookie-path is a prefix of the request-path, and the first + // character of the request-path that is not included in the cookie-path is a %x2F ("/") character." + request(this.server) + .get('/admin/users') + .expect(shouldSetCookie('connect.sid')) + .expect(200, done) + }) + + it('should NOT set cookie when cookie-path is not a prefix ("/administrator")', function (done) { + // RFC 6265 5.1.4: None of the path-match conditions are met + request(this.server) + .get('/administrator') + .expect(shouldNotHaveHeader('Set-Cookie')) + .expect(200, done) + }) + }) + + describe('when "path" is "/admin/" (trailing slash)', function () { + before(function () { + this.server = createServer({ cookie: { path: '/admin/' } }) + }) + + it('should set cookie when cookie-path is prefix and last char is "/" ("/admin/x")', function (done) { + // RFC 6265 5.1.4: "The cookie-path is a prefix of the request-path, and the last + // character of the cookie-path is %x2F ("/")." + request(this.server) + .get('/admin/x') + .expect(shouldSetCookie('connect.sid')) + .expect(200, done) + }) + + it('should NOT set cookie when request-path is not prefixed by cookie-path ("/admin")', function (done) { + // RFC 6265 5.1.4: cookie-path "/admin/" is not a prefix of request-path "/admin" + request(this.server) + .get('/admin') + .expect(shouldNotHaveHeader('Set-Cookie')) + .expect(200, done) + }) + + it('should NOT set cookie when cookie-path is not a prefix ("/administrator")', function (done) { + // RFC 6265 5.1.4: None of the path-match conditions are met: + // 1. The paths are not identical + // 2. "/admin/" is not a prefix of "/administrator" + // 3. The prefix condition with next character "/" is not applicable + request(this.server) + .get('/administrator') + .expect(shouldNotHaveHeader('Set-Cookie')) + .expect(200, done) + }) + }) +}) + + function cookie(res) { var setCookie = res.headers['set-cookie']; return (setCookie && setCookie[0]) || undefined; From 953bfe2ea1878fe79b5494335c0f1c5e332224c2 Mon Sep 17 00:00:00 2001 From: Raashish Aggarwal <94279692+raashish1601@users.noreply.github.com> Date: Mon, 6 Jul 2026 07:54:05 +0530 Subject: [PATCH 42/45] fix: detect secure socket when connection is missing (#1124) * fix: detect secure socket when connection is missing * fix: improve secure socket detection logic in session handling --------- Co-authored-by: Sebastian Beltran --- index.js | 3 ++- test/session.js | 27 +++++++++++++++++++++++++++ 2 files changed, 29 insertions(+), 1 deletion(-) diff --git a/index.js b/index.js index 41f9447f..eb15ea64 100644 --- a/index.js +++ b/index.js @@ -677,7 +677,8 @@ function hash(sess) { function issecure(req, trustProxy) { // socket is https server - if (req.connection && req.connection.encrypted) { + var socket = req.socket || req.connection; + if (socket && socket.encrypted) { return true; } diff --git a/test/session.js b/test/session.js index 330c4137..abf846f5 100644 --- a/test/session.js +++ b/test/session.js @@ -800,6 +800,31 @@ describe('session()', function(){ .expect(200, 'false', done) }) }) + + describe('when request socket is encrypted', function () { + it('should set secure over TLS', function (done) { + var cert = fs.readFileSync(__dirname + '/fixtures/server.crt', 'ascii') + var server = https.createServer({ + key: fs.readFileSync(__dirname + '/fixtures/server.key', 'ascii'), + cert: cert + }) + + server.on('request', createRequestListener({ secret: 'keyboard cat', cookie: { secure: 'auto' } })) + + var agent = new https.Agent({ ca: cert }) + var createConnection = agent.createConnection + + agent.createConnection = function (options) { + options.servername = 'express-session.local' + return createConnection.call(this, options) + } + + var req = request(server).get('/') + req.agent(agent) + req.expect(shouldSetCookieWithAttribute('connect.sid', 'Secure')) + req.expect(200, done) + }) + }) }) describe('when "cookie" is a function', function () { @@ -888,6 +913,8 @@ describe('session()', function(){ .expect(200, 'true', done); }); }); + + describe('when "sameSite" set to "auto"', function () { describe('basic functionality', function () { before(function () { From 2deb78e42a8dff6c6d8ffcf3f196dfc4ed0f02da Mon Sep 17 00:00:00 2001 From: Ayoub Mabrouk <77799760+Ayoub-Mabrouk@users.noreply.github.com> Date: Mon, 6 Jul 2026 03:30:48 +0100 Subject: [PATCH 43/45] refactor: replace deprecated substr() with slice() (#1099) Replace all instances of String.prototype.substr() with String.prototype.slice() to use the standard, non-deprecated method. This maintains compatibility with Node.js >= 0.8.0 while following modern JavaScript best practices. All replacements maintain identical functionality as slice() and substr() behave the same for these use cases. Co-authored-by: bjohansebas <103585995+bjohansebas@users.noreply.github.com> --- index.js | 6 +++--- test/session.js | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/index.js b/index.js index eb15ea64..3e23e901 100644 --- a/index.js +++ b/index.js @@ -593,7 +593,7 @@ function getcookie(req, name, secrets) { raw = cookies[name]; if (raw) { - if (raw.substr(0, 2) === 's:') { + if (raw.slice(0, 2) === 's:') { val = unsigncookie(raw.slice(2), secrets); if (val === false) { @@ -620,7 +620,7 @@ function getcookie(req, name, secrets) { raw = req.cookies[name]; if (raw) { - if (raw.substr(0, 2) === 's:') { + if (raw.slice(0, 2) === 's:') { val = unsigncookie(raw.slice(2), secrets); if (val) { @@ -696,7 +696,7 @@ function issecure(req, trustProxy) { var header = req.headers['x-forwarded-proto'] || ''; var index = header.indexOf(','); var proto = index !== -1 - ? header.substr(0, index).toLowerCase().trim() + ? header.slice(0, index).toLowerCase().trim() : header.toLowerCase().trim() return proto === 'https'; diff --git a/test/session.js b/test/session.js index abf846f5..405e3ddf 100644 --- a/test/session.js +++ b/test/session.js @@ -1299,7 +1299,7 @@ describe('session()', function(){ var store = new session.MemoryStore() var server = createServer({ resave: false, store: store }, function (req, res) { if (req.method === 'PUT') { - req.session.token = req.url.substr(1) + req.session.token = req.url.slice(1) } res.end('token=' + (req.session.token || '')) }) From 2799984fd07d4963fbc128f5f0d9d9f2f48829fe Mon Sep 17 00:00:00 2001 From: Sebastian Beltran Date: Tue, 7 Jul 2026 11:15:48 -0500 Subject: [PATCH 44/45] chore: add groups for GitHub Actions and npm dependencies in dependabot (#1133) --- .github/dependabot.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 492d67d0..7d2c7033 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,6 +4,10 @@ updates: directory: / schedule: interval: monthly + groups: + github-actions: + patterns: + - "*" - package-ecosystem: npm directory: / @@ -12,3 +16,7 @@ updates: ignore: - dependency-name: "*" update-types: ["version-update:semver-major"] + groups: + npm-dependencies: + patterns: + - "*" From d209c1f4cd645e514cd7320afd15acf7e7b5fcb6 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 14 Jul 2026 12:23:53 -0500 Subject: [PATCH 45/45] build(deps): bump the github-actions group with 6 updates (#1140) Bumps the github-actions group with 6 updates: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `6.0.0` | `7.0.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.0` | `7.0.1` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.0` | `8.0.1` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.32.4` | `4.36.3` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.32.4` | `4.36.3` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.32.4` | `4.36.3` | Updates `actions/checkout` from 6.0.0 to 7.0.0 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/1af3b93b6815bc44a9784bd300feb67ff0d1eeb3...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0) Updates `actions/upload-artifact` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a) Updates `actions/download-artifact` from 8.0.0 to 8.0.1 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c) Updates `github/codeql-action/init` from 4.32.4 to 4.36.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/89a39a4e59826350b863aa6b6252a07ad50cf83e...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a) Updates `github/codeql-action/analyze` from 4.32.4 to 4.36.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/89a39a4e59826350b863aa6b6252a07ad50cf83e...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a) Updates `github/codeql-action/upload-sarif` from 4.32.4 to 4.36.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/89a39a4e59826350b863aa6b6252a07ad50cf83e...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 8.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/init dependency-version: 4.36.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.36.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.36.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci.yml | 8 ++++---- .github/workflows/codeql.yml | 6 +++--- .github/workflows/scorecard.yml | 6 +++--- 3 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 29b55239..004c35ed 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -146,7 +146,7 @@ jobs: node-version: "25" steps: - - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install Node.js ${{ matrix.node-version }} shell: bash -eo pipefail -l {0} @@ -229,7 +229,7 @@ jobs: fi - name: Upload code coverage - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: steps.list_env.outputs.nyc != '' with: name: coverage-${{ matrix.node-version }} @@ -243,14 +243,14 @@ jobs: needs: test runs-on: ubuntu-latest steps: - - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install lcov shell: bash run: sudo apt-get -y install lcov - name: Collect coverage reports - uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: path: ./coverage diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index e4fbd605..139ec706 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -34,11 +34,11 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4 + uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 with: languages: javascript # If you wish to specify custom queries, you can do so here or in a config file. @@ -61,6 +61,6 @@ jobs: # ./location_of_script_within_repo/buildscript.sh - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4 + uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 with: category: "/language:javascript" \ No newline at end of file diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index e6ba6369..2bb15b23 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -33,7 +33,7 @@ jobs: steps: - name: "Checkout code" - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false @@ -60,7 +60,7 @@ jobs: # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF # format to the repository Actions tab. - name: "Upload artifact" - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: SARIF file path: results.sarif @@ -68,6 +68,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard. - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4 + uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 with: sarif_file: results.sarif \ No newline at end of file