From d943e3764aaf037aeb3c5e6abd3657a8977fa36d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 5 Nov 2018 00:12:30 -0500
Subject: [PATCH 001/272] build: Node.js@10.13

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 5a16d310..e84788db 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -12,7 +12,7 @@ node_js:
   - "7.10"
   - "8.12"
   - "9.11"
-  - "10.12"
+  - "10.13"
 sudo: false
 cache:
   directories:

From 2f971f95ca087e2fe4670aa3c6a35a94108f1cd0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 5 Nov 2018 00:43:11 -0500
Subject: [PATCH 002/272] docs: switch badges to badgen

---
 README.md | 116 +++++++++++++++++++++++++++---------------------------
 1 file changed, 58 insertions(+), 58 deletions(-)

diff --git a/README.md b/README.md
index cd52f9b9..2be21d2c 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,7 @@
 # express-session
 
-[![NPM Version][npm-image]][npm-url]
-[![NPM Downloads][downloads-image]][downloads-url]
+[![NPM Version][npm-version-image]][npm-url]
+[![NPM Downloads][npm-downloads-image]][node-url]
 [![Build Status][travis-image]][travis-url]
 [![Test Coverage][coveralls-image]][coveralls-url]
 
@@ -492,262 +492,262 @@ module. Please make a PR to add additional modules :)
 [![★][aerospike-session-store-image] aerospike-session-store][aerospike-session-store-url] A session store using [Aerospike](http://www.aerospike.com/).
 
 [aerospike-session-store-url]: https://www.npmjs.com/package/aerospike-session-store
-[aerospike-session-store-image]: https://img.shields.io/github/stars/aerospike/aerospike-session-store-expressjs.svg?label=%E2%98%85
+[aerospike-session-store-image]: https://badgen.net/github/stars/aerospike/aerospike-session-store-expressjs?label=%E2%98%85
 
 [![★][cassandra-store-image] cassandra-store][cassandra-store-url] An Apache Cassandra-based session store.
 
 [cassandra-store-url]: https://www.npmjs.com/package/cassandra-store
-[cassandra-store-image]: https://img.shields.io/github/stars/webcc/cassandra-store.svg?label=%E2%98%85
+[cassandra-store-image]: https://badgen.net/github/stars/webcc/cassandra-store?label=%E2%98%85
 
 [![★][cluster-store-image] cluster-store][cluster-store-url] A wrapper for using in-process / embedded
 stores - such as SQLite (via knex), leveldb, files, or memory - with node cluster (desirable for Raspberry Pi 2
 and other multi-core embedded devices).
 
 [cluster-store-url]: https://www.npmjs.com/package/cluster-store
-[cluster-store-image]: https://img.shields.io/github/stars/coolaj86/cluster-store.svg?label=%E2%98%85
+[cluster-store-image]: https://badgen.net/github/stars/coolaj86/cluster-store?label=%E2%98%85
 
 [![★][connect-azuretables-image] connect-azuretables][connect-azuretables-url] An [Azure Table Storage](https://azure.microsoft.com/en-gb/services/storage/tables/)-based session store.
 
 [connect-azuretables-url]: https://www.npmjs.com/package/connect-azuretables
-[connect-azuretables-image]: https://img.shields.io/github/stars/mike-goodwin/connect-azuretables.svg?label=%E2%98%85
+[connect-azuretables-image]: https://badgen.net/github/stars/mike-goodwin/connect-azuretables?label=%E2%98%85
 
 [![★][connect-cloudant-store-image] connect-cloudant-store][connect-cloudant-store-url] An [IBM Cloudant](https://cloudant.com/)-based session store.
 
 [connect-cloudant-store-url]: https://www.npmjs.com/package/connect-cloudant-store
-[connect-cloudant-store-image]: https://img.shields.io/github/stars/adriantanasa/connect-cloudant-store.svg?label=%E2%98%85
+[connect-cloudant-store-image]: https://badgen.net/github/stars/adriantanasa/connect-cloudant-store?label=%E2%98%85
 
 [![★][connect-couchbase-image] connect-couchbase][connect-couchbase-url] A [couchbase](http://www.couchbase.com/)-based session store.
 
 [connect-couchbase-url]: https://www.npmjs.com/package/connect-couchbase
-[connect-couchbase-image]: https://img.shields.io/github/stars/christophermina/connect-couchbase.svg?label=%E2%98%85
+[connect-couchbase-image]: https://badgen.net/github/stars/christophermina/connect-couchbase?label=%E2%98%85
 
 [![★][connect-datacache-image] connect-datacache][connect-datacache-url] An [IBM Bluemix Data Cache](http://www.ibm.com/cloud-computing/bluemix/)-based session store.
 
 [connect-datacache-url]: https://www.npmjs.com/package/connect-datacache
-[connect-datacache-image]: https://img.shields.io/github/stars/adriantanasa/connect-datacache.svg?label=%E2%98%85
+[connect-datacache-image]: https://badgen.net/github/stars/adriantanasa/connect-datacache?label=%E2%98%85
 
 [![★][@google-cloud/connect-datastore-image] @google-cloud/connect-datastore][@google-cloud/connect-datastore-url] A [Google Cloud Datastore](https://cloud.google.com/datastore/docs/concepts/overview)-based session store.
 
 [@google-cloud/connect-datastore-url]: https://www.npmjs.com/package/@google-cloud/connect-datastore
-[@google-cloud/connect-datastore-image]: https://img.shields.io/github/stars/GoogleCloudPlatform/cloud-datastore-session-node.svg?label=%E2%98%85
+[@google-cloud/connect-datastore-image]: https://badgen.net/github/stars/GoogleCloudPlatform/cloud-datastore-session-node?label=%E2%98%85
 
 [![★][connect-db2-image] connect-db2][connect-db2-url] An IBM DB2-based session store built using [ibm_db](https://www.npmjs.com/package/ibm_db) module.
 
 [connect-db2-url]: https://www.npmjs.com/package/connect-db2
-[connect-db2-image]: https://img.shields.io/github/stars/wallali/connect-db2.svg?label=%E2%98%85
+[connect-db2-image]: https://badgen.net/github/stars/wallali/connect-db2?label=%E2%98%85
 
 [![★][connect-dynamodb-image] connect-dynamodb][connect-dynamodb-url] A DynamoDB-based session store.
 
 [connect-dynamodb-url]: https://github.com/ca98am79/connect-dynamodb
-[connect-dynamodb-image]: https://img.shields.io/github/stars/ca98am79/connect-dynamodb.svg?label=%E2%98%85
+[connect-dynamodb-image]: https://badgen.net/github/stars/ca98am79/connect-dynamodb?label=%E2%98%85
 
 [![★][connect-loki-image] connect-loki][connect-loki-url] A Loki.js-based session store.
 
 [connect-loki-url]: https://www.npmjs.com/package/connect-loki
-[connect-loki-image]: https://img.shields.io/github/stars/Requarks/connect-loki.svg?label=%E2%98%85
+[connect-loki-image]: https://badgen.net/github/stars/Requarks/connect-loki?label=%E2%98%85
 
 [![★][connect-ml-image] connect-ml][connect-ml-url] A MarkLogic Server-based session store.
 
 [connect-ml-url]: https://www.npmjs.com/package/connect-ml
-[connect-ml-image]: https://img.shields.io/github/stars/bluetorch/connect-ml.svg?label=%E2%98%85
+[connect-ml-image]: https://badgen.net/github/stars/bluetorch/connect-ml?label=%E2%98%85
 
 [![★][connect-mssql-image] connect-mssql][connect-mssql-url] A SQL Server-based session store.
 
 [connect-mssql-url]: https://www.npmjs.com/package/connect-mssql
-[connect-mssql-image]: https://img.shields.io/github/stars/patriksimek/connect-mssql.svg?label=%E2%98%85
+[connect-mssql-image]: https://badgen.net/github/stars/patriksimek/connect-mssql?label=%E2%98%85
 
 [![★][connect-monetdb-image] connect-monetdb][connect-monetdb-url] A MonetDB-based session store.
 
 [connect-monetdb-url]: https://www.npmjs.com/package/connect-monetdb
-[connect-monetdb-image]: https://img.shields.io/github/stars/MonetDB/npm-connect-monetdb.svg?label=%E2%98%85
+[connect-monetdb-image]: https://badgen.net/github/stars/MonetDB/npm-connect-monetdb?label=%E2%98%85
 
 [![★][connect-mongo-image] connect-mongo][connect-mongo-url] A MongoDB-based session store.
 
 [connect-mongo-url]: https://www.npmjs.com/package/connect-mongo
-[connect-mongo-image]: https://img.shields.io/github/stars/kcbanner/connect-mongo.svg?label=%E2%98%85
+[connect-mongo-image]: https://badgen.net/github/stars/kcbanner/connect-mongo?label=%E2%98%85
 
 [![★][connect-mongodb-session-image] connect-mongodb-session][connect-mongodb-session-url] Lightweight MongoDB-based session store built and maintained by MongoDB.
 
 [connect-mongodb-session-url]: https://www.npmjs.com/package/connect-mongodb-session
-[connect-mongodb-session-image]: https://img.shields.io/github/stars/mongodb-js/connect-mongodb-session.svg?label=%E2%98%85
+[connect-mongodb-session-image]: https://badgen.net/github/stars/mongodb-js/connect-mongodb-session?label=%E2%98%85
 
 [![★][connect-pg-simple-image] connect-pg-simple][connect-pg-simple-url] A PostgreSQL-based session store.
 
 [connect-pg-simple-url]: https://www.npmjs.com/package/connect-pg-simple
-[connect-pg-simple-image]: https://img.shields.io/github/stars/voxpelli/node-connect-pg-simple.svg?label=%E2%98%85
+[connect-pg-simple-image]: https://badgen.net/github/stars/voxpelli/node-connect-pg-simple?label=%E2%98%85
 
 [![★][connect-redis-image] connect-redis][connect-redis-url] A Redis-based session store.
 
 [connect-redis-url]: https://www.npmjs.com/package/connect-redis
-[connect-redis-image]: https://img.shields.io/github/stars/tj/connect-redis.svg?label=%E2%98%85
+[connect-redis-image]: https://badgen.net/github/stars/tj/connect-redis?label=%E2%98%85
 
 [![★][connect-memcached-image] connect-memcached][connect-memcached-url] A memcached-based session store.
 
 [connect-memcached-url]: https://www.npmjs.com/package/connect-memcached
-[connect-memcached-image]: https://img.shields.io/github/stars/balor/connect-memcached.svg?label=%E2%98%85
+[connect-memcached-image]: https://badgen.net/github/stars/balor/connect-memcached?label=%E2%98%85
 
 [![★][connect-memjs-image] connect-memjs][connect-memjs-url] A memcached-based session store using
 [memjs](https://www.npmjs.com/package/memjs) as the memcached client.
 
 [connect-memjs-url]: https://www.npmjs.com/package/connect-memjs
-[connect-memjs-image]: https://img.shields.io/github/stars/liamdon/connect-memjs.svg?label=%E2%98%85
+[connect-memjs-image]: https://badgen.net/github/stars/liamdon/connect-memjs?label=%E2%98%85
 
 [![★][connect-session-firebase-image] connect-session-firebase][connect-session-firebase-url] A session store based on the [Firebase Realtime Database](https://firebase.google.com/docs/database/)
 
 [connect-session-firebase-url]: https://www.npmjs.com/package/connect-session-firebase
-[connect-session-firebase-image]: https://img.shields.io/github/stars/benweier/connect-session-firebase.svg?label=%E2%98%85
+[connect-session-firebase-image]: https://badgen.net/github/stars/benweier/connect-session-firebase?label=%E2%98%85
 
 [![★][connect-session-knex-image] connect-session-knex][connect-session-knex-url] A session store using
 [Knex.js](http://knexjs.org/), which is a SQL query builder for PostgreSQL, MySQL, MariaDB, SQLite3, and Oracle.
 
 [connect-session-knex-url]: https://www.npmjs.com/package/connect-session-knex
-[connect-session-knex-image]: https://img.shields.io/github/stars/llambda/connect-session-knex.svg?label=%E2%98%85
+[connect-session-knex-image]: https://badgen.net/github/stars/llambda/connect-session-knex?label=%E2%98%85
 
 [![★][connect-session-sequelize-image] connect-session-sequelize][connect-session-sequelize-url] A session store using
 [Sequelize.js](http://sequelizejs.com/), which is a Node.js / io.js ORM for PostgreSQL, MySQL, SQLite and MSSQL.
 
 [connect-session-sequelize-url]: https://www.npmjs.com/package/connect-session-sequelize
-[connect-session-sequelize-image]: https://img.shields.io/github/stars/mweibel/connect-session-sequelize.svg?label=%E2%98%85
+[connect-session-sequelize-image]: https://badgen.net/github/stars/mweibel/connect-session-sequelize?label=%E2%98%85
 
 [![★][couchdb-expression-image] couchdb-expression][couchdb-expression-url] A [CouchDB](https://couchdb.apache.org/)-based session store.
 
 [couchdb-expression-url]: https://www.npmjs.com/package/couchdb-expression
-[couchdb-expression-image]: https://img.shields.io/github/stars/tkshnwesper/couchdb-expression.svg?label=%E2%98%85
+[couchdb-expression-image]: https://badgen.net/github/stars/tkshnwesper/couchdb-expression?label=%E2%98%85
 
 [![★][dynamodb-store-image] dynamodb-store][dynamodb-store-url] A DynamoDB-based session store.
 
 [dynamodb-store-url]: https://www.npmjs.com/package/dynamodb-store
-[dynamodb-store-image]: https://img.shields.io/github/stars/rafaelrpinto/dynamodb-store.svg?label=%E2%98%85
+[dynamodb-store-image]: https://badgen.net/github/stars/rafaelrpinto/dynamodb-store?label=%E2%98%85
 
 [![★][express-mysql-session-image] express-mysql-session][express-mysql-session-url] A session store using native
 [MySQL](https://www.mysql.com/) via the [node-mysql](https://github.com/felixge/node-mysql) module.
 
 [express-mysql-session-url]: https://www.npmjs.com/package/express-mysql-session
-[express-mysql-session-image]: https://img.shields.io/github/stars/chill117/express-mysql-session.svg?label=%E2%98%85
+[express-mysql-session-image]: https://badgen.net/github/stars/chill117/express-mysql-session?label=%E2%98%85
 
 [![★][express-oracle-session-image] express-oracle-session][express-oracle-session-url] A session store using native
 [oracle](https://www.oracle.com/) via the [node-oracledb](https://www.npmjs.com/package/oracledb) module.
 
 [express-oracle-session-url]: https://www.npmjs.com/package/express-oracle-session
-[express-oracle-session-image]: https://img.shields.io/github/stars/slumber86/express-oracle-session.svg?label=%E2%98%85
+[express-oracle-session-image]: https://badgen.net/github/stars/slumber86/express-oracle-session?label=%E2%98%85
 
 [![★][express-sessions-image] express-sessions][express-sessions-url]: A session store supporting both MongoDB and Redis.
 
 [express-sessions-url]: https://www.npmjs.com/package/express-sessions
-[express-sessions-image]: https://img.shields.io/github/stars/konteck/express-sessions.svg?label=%E2%98%85
+[express-sessions-image]: https://badgen.net/github/stars/konteck/express-sessions?label=%E2%98%85
 
 [![★][connect-sqlite3-image] connect-sqlite3][connect-sqlite3-url] A [SQLite3](https://github.com/mapbox/node-sqlite3) session store modeled after the TJ's `connect-redis` store.
 
 [connect-sqlite3-url]: https://www.npmjs.com/package/connect-sqlite3
-[connect-sqlite3-image]: https://img.shields.io/github/stars/rawberg/connect-sqlite3.svg?label=%E2%98%85
+[connect-sqlite3-image]: https://badgen.net/github/stars/rawberg/connect-sqlite3?label=%E2%98%85
 
 [![★][documentdb-session-image] documentdb-session][documentdb-session-url] A session store for Microsoft Azure's [DocumentDB](https://azure.microsoft.com/en-us/services/documentdb/) NoSQL database service.
 
 [documentdb-session-url]: https://www.npmjs.com/package/documentdb-session
-[documentdb-session-image]: https://img.shields.io/github/stars/dwhieb/documentdb-session.svg?label=%E2%98%85
+[documentdb-session-image]: https://badgen.net/github/stars/dwhieb/documentdb-session?label=%E2%98%85
 
 [![★][express-nedb-session-image] express-nedb-session][express-nedb-session-url] A NeDB-based session store.
 
 [express-nedb-session-url]: https://www.npmjs.com/package/express-nedb-session
-[express-nedb-session-image]: https://img.shields.io/github/stars/louischatriot/express-nedb-session.svg?label=%E2%98%85
+[express-nedb-session-image]: https://badgen.net/github/stars/louischatriot/express-nedb-session?label=%E2%98%85
 
 [![★][express-session-cache-manager-image] express-session-cache-manager][express-session-cache-manager-url]
 A store that implements [cache-manager](https://www.npmjs.com/package/cache-manager), which supports
 a [variety of storage types](https://www.npmjs.com/package/cache-manager#store-engines).
 
 [express-session-cache-manager-url]: https://www.npmjs.com/package/express-session-cache-manager
-[express-session-cache-manager-image]: https://img.shields.io/github/stars/theogravity/express-session-cache-manager.svg?label=%E2%98%85
+[express-session-cache-manager-image]: https://badgen.net/github/stars/theogravity/express-session-cache-manager?label=%E2%98%85
 
 [![★][express-session-level-image] express-session-level][express-session-level-url] A [LevelDB](https://github.com/Level/levelup) based session store.
 
 [express-session-level-url]: https://www.npmjs.com/package/express-session-level
-[express-session-level-image]: https://img.shields.io/github/stars/tgohn/express-session-level.svg?label=%E2%98%85
+[express-session-level-image]: https://badgen.net/github/stars/tgohn/express-session-level?label=%E2%98%85
 
 [![★][express-etcd-image] express-etcd][express-etcd-url] An [etcd](https://github.com/stianeikeland/node-etcd) based session store.
 
 [express-etcd-url]: https://www.npmjs.com/package/express-etcd
-[express-etcd-image]: https://img.shields.io/github/stars/gildean/express-etcd.svg?label=%E2%98%85
+[express-etcd-image]: https://badgen.net/github/stars/gildean/express-etcd?label=%E2%98%85
 
 [![★][express-session-etcd3-image] express-session-etcd3][express-session-etcd3-url] An [etcd3](https://github.com/mixer/etcd3) based session store.
 
 [express-session-etcd3-url]: https://www.npmjs.com/package/express-session-etcd3
-[express-session-etcd3-image]: https://img.shields.io/github/stars/willgm/express-session-etcd3.svg?label=%E2%98%85
+[express-session-etcd3-image]: https://badgen.net/github/stars/willgm/express-session-etcd3?label=%E2%98%85
 
 [![★][firestore-store-image] firestore-store][firestore-store-url] A [Firestore](https://github.com/hendrysadrak/firestore-store)-based session store.
 
 [firestore-store-url]: https://github.com/hendrysadrak/firestore-store
-[firestore-store-image]: https://img.shields.io/github/stars/hendrysadrak/firestore-store.svg?label=%E2%98%85
+[firestore-store-image]: https://badgen.net/github/stars/hendrysadrak/firestore-store?label=%E2%98%85
 
 [![★][fortune-session-image] fortune-session][fortune-session-url] A [Fortune.js](https://github.com/fortunejs/fortune)
 based session store. Supports all backends supported by Fortune (MongoDB, Redis, Postgres, NeDB).
 
 [fortune-session-url]: https://www.npmjs.com/package/fortune-session
-[fortune-session-image]: https://img.shields.io/github/stars/aliceklipper/fortune-session.svg?label=%E2%98%85
+[fortune-session-image]: https://badgen.net/github/stars/aliceklipper/fortune-session?label=%E2%98%85
 
 [![★][hazelcast-store-image] hazelcast-store][hazelcast-store-url] A Hazelcast-based session store built on the [Hazelcast Node Client](https://www.npmjs.com/package/hazelcast-client).
 
 [hazelcast-store-url]: https://www.npmjs.com/package/hazelcast-store
-[hazelcast-store-image]: https://img.shields.io/github/stars/jackspaniel/hazelcast-store.svg?label=%E2%98%85
+[hazelcast-store-image]: https://badgen.net/github/stars/jackspaniel/hazelcast-store?label=%E2%98%85
 
 [![★][level-session-store-image] level-session-store][level-session-store-url] A LevelDB-based session store.
 
 [level-session-store-url]: https://www.npmjs.com/package/level-session-store
-[level-session-store-image]: https://img.shields.io/github/stars/scriptollc/level-session-store.svg?label=%E2%98%85
+[level-session-store-image]: https://badgen.net/github/stars/scriptollc/level-session-store?label=%E2%98%85
 
 [![★][medea-session-store-image] medea-session-store][medea-session-store-url] A Medea-based session store.
 
 [medea-session-store-url]: https://www.npmjs.com/package/medea-session-store
-[medea-session-store-image]: https://img.shields.io/github/stars/BenjaminVadant/medea-session-store.svg?label=%E2%98%85
+[medea-session-store-image]: https://badgen.net/github/stars/BenjaminVadant/medea-session-store?label=%E2%98%85
 
 [![★][memorystore-image] memorystore][memorystore-url] A memory session store made for production.
 
 [memorystore-url]: https://www.npmjs.com/package/memorystore
-[memorystore-image]: https://img.shields.io/github/stars/roccomuso/memorystore.svg?label=%E2%98%85
+[memorystore-image]: https://badgen.net/github/stars/roccomuso/memorystore?label=%E2%98%85
 
 [![★][mssql-session-store-image] mssql-session-store][mssql-session-store-url] A SQL Server-based session store.
 
 [mssql-session-store-url]: https://www.npmjs.com/package/mssql-session-store
-[mssql-session-store-image]: https://img.shields.io/github/stars/jwathen/mssql-session-store.svg?label=%E2%98%85
+[mssql-session-store-image]: https://badgen.net/github/stars/jwathen/mssql-session-store?label=%E2%98%85
 
 [![★][nedb-session-store-image] nedb-session-store][nedb-session-store-url] An alternate NeDB-based (either in-memory or file-persisted) session store.
 
 [nedb-session-store-url]: https://www.npmjs.com/package/nedb-session-store
-[nedb-session-store-image]: https://img.shields.io/github/stars/JamesMGreene/nedb-session-store.svg?label=%E2%98%85
+[nedb-session-store-image]: https://badgen.net/github/stars/JamesMGreene/nedb-session-store?label=%E2%98%85
 
 [![★][restsession-image] restsession][restsession-url] Store sessions utilizing a RESTful API
 
 [restsession-url]: https://www.npmjs.com/package/restsession
-[restsession-image]: https://img.shields.io/github/stars/jankal/restsession.svg?label=%E2%98%85
+[restsession-image]: https://badgen.net/github/stars/jankal/restsession?label=%E2%98%85
 
 [![★][sequelstore-connect-image] sequelstore-connect][sequelstore-connect-url] A session store using [Sequelize.js](http://sequelizejs.com/).
 
 [sequelstore-connect-url]: https://www.npmjs.com/package/sequelstore-connect
-[sequelstore-connect-image]: https://img.shields.io/github/stars/MattMcFarland/sequelstore-connect.svg?label=%E2%98%85
+[sequelstore-connect-image]: https://badgen.net/github/stars/MattMcFarland/sequelstore-connect?label=%E2%98%85
 
 [![★][session-file-store-image] session-file-store][session-file-store-url] A file system-based session store.
 
 [session-file-store-url]: https://www.npmjs.com/package/session-file-store
-[session-file-store-image]: https://img.shields.io/github/stars/valery-barysok/session-file-store.svg?label=%E2%98%85
+[session-file-store-image]: https://badgen.net/github/stars/valery-barysok/session-file-store?label=%E2%98%85
 
 [![★][session-pouchdb-store-image] session-pouchdb-store][session-pouchdb-store-url] Session store for PouchDB / CouchDB. Accepts embedded, custom, or remote PouchDB instance and realtime synchronization.
 
 [session-pouchdb-store-url]: https://www.npmjs.com/package/session-pouchdb-store
-[session-pouchdb-store-image]: https://img.shields.io/github/stars/solzimer/session-pouchdb-store.svg?label=%E2%98%85
+[session-pouchdb-store-image]: https://badgen.net/github/stars/solzimer/session-pouchdb-store?label=%E2%98%85
 
 [![★][session-rethinkdb-image] session-rethinkdb][session-rethinkdb-url] A [RethinkDB](http://rethinkdb.com/)-based session store.
 
 [session-rethinkdb-url]: https://www.npmjs.com/package/session-rethinkdb
-[session-rethinkdb-image]: https://img.shields.io/github/stars/llambda/session-rethinkdb.svg?label=%E2%98%85
+[session-rethinkdb-image]: https://badgen.net/github/stars/llambda/session-rethinkdb?label=%E2%98%85
 
 [![★][sessionstore-image] sessionstore][sessionstore-url] A session store that works with various databases.
 
 [sessionstore-url]: https://www.npmjs.com/package/sessionstore
-[sessionstore-image]: https://img.shields.io/github/stars/adrai/sessionstore.svg?label=%E2%98%85
+[sessionstore-image]: https://badgen.net/github/stars/adrai/sessionstore?label=%E2%98%85
 
 [![★][tch-nedb-session-image] tch-nedb-session][tch-nedb-session-url] A file system session store based on NeDB.
 
 [tch-nedb-session-url]: https://www.npmjs.com/package/tch-nedb-session
-[tch-nedb-session-image]: https://img.shields.io/github/stars/tomaschyly/NeDBSession.svg?label=%E2%98%85
+[tch-nedb-session-image]: https://badgen.net/github/stars/tomaschyly/NeDBSession?label=%E2%98%85
 
 ## Example
 
@@ -793,11 +793,11 @@ app.get('/bar', function (req, res, next) {
 
 [MIT](LICENSE)
 
-[npm-image]: https://img.shields.io/npm/v/express-session.svg
+[coveralls-image]: https://badgen.net/coveralls/c/github/expressjs/session/master
+[coveralls-url]: https://coveralls.io/r/expressjs/session?branch=master
+[node-url]: https://nodejs.org/en/download
+[npm-downloads-image]: https://badgen.net/npm/dm/express-session
 [npm-url]: https://npmjs.org/package/express-session
-[travis-image]: https://img.shields.io/travis/expressjs/session/master.svg
+[npm-version-image]: https://badgen.net/npm/v/express-session
+[travis-image]: https://badgen.net/travis/expressjs/session/master
 [travis-url]: https://travis-ci.org/expressjs/session
-[coveralls-image]: https://img.shields.io/coveralls/expressjs/session/master.svg
-[coveralls-url]: https://coveralls.io/r/expressjs/session?branch=master
-[downloads-image]: https://img.shields.io/npm/dm/express-session.svg
-[downloads-url]: https://npmjs.org/package/express-session

From 868c5fb9adc37dd6b2db4520c6c1c60c5875207d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 5 Nov 2018 13:09:27 -0500
Subject: [PATCH 003/272] tests: add maxAge to new Cookie tests

---
 test/cookie.js | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/test/cookie.js b/test/cookie.js
index 6f6992c3..dc083e85 100644
--- a/test/cookie.js
+++ b/test/cookie.js
@@ -12,6 +12,11 @@ describe('new Cookie()', function () {
     assert.strictEqual(cookie.expires, null)
   })
 
+  it('should default maxAge to null', function () {
+    var cookie = new Cookie()
+    assert.strictEqual(cookie.maxAge, null)
+  })
+
   it('should default httpOnly to true', function () {
     var cookie = new Cookie()
     assert.strictEqual(cookie.httpOnly, true)
@@ -53,6 +58,15 @@ describe('new Cookie()', function () {
       assert.strictEqual(cookie.httpOnly, false)
     })
 
+    it('should set maxAge', function () {
+      var maxAge = 60000
+      var cookie = new Cookie({ maxAge: maxAge })
+
+      assert.ok(cookie.expires.getTime() - Date.now() - 1000 <= maxAge)
+      assert.ok(cookie.expires.getTime() - Date.now() + 1000 >= maxAge)
+      assert.strictEqual(cookie.maxAge, maxAge)
+    })
+
     it('should set path', function () {
       var cookie = new Cookie({ path: '/foo' })
 

From 19b4f4ed410b3d045c634a37a218efd843ad4e09 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 5 Nov 2018 13:14:30 -0500
Subject: [PATCH 004/272] tests: reorganize new Cookie options tests

---
 test/cookie.js | 55 ++++++++++++++++++++++++++++++++++----------------
 1 file changed, 38 insertions(+), 17 deletions(-)

diff --git a/test/cookie.js b/test/cookie.js
index dc083e85..cac5ef6f 100644
--- a/test/cookie.js
+++ b/test/cookie.js
@@ -44,33 +44,54 @@ describe('new Cookie()', function () {
       assert.throws(function () { new Cookie(function () {}) }, /argument options/)
     })
 
-    it('should set expires', function () {
-      var expires = new Date()
-      var cookie = new Cookie({ expires: expires })
+    describe('expires', function () {
+      it('should set expires', function () {
+        var expires = new Date(Date.now() + 60000)
+        var cookie = new Cookie({ expires: expires })
 
-      assert.strictEqual(cookie.expires, expires)
-      assert.notStrictEqual(cookie.maxAge, null)
+        assert.strictEqual(cookie.expires, expires)
+      })
+
+      it('should set maxAge', function () {
+        var expires = new Date(Date.now() + 60000)
+        var cookie = new Cookie({ expires: expires })
+
+        assert.ok(expires.getTime() - Date.now() - 1000 <= cookie.maxAge)
+        assert.ok(expires.getTime() - Date.now() + 1000 >= cookie.maxAge)
+      })
     })
 
-    it('should set httpOnly', function () {
-      var cookie = new Cookie({ httpOnly: false })
+    describe('httpOnly', function () {
+      it('should set httpOnly', function () {
+        var cookie = new Cookie({ httpOnly: false })
 
-      assert.strictEqual(cookie.httpOnly, false)
+        assert.strictEqual(cookie.httpOnly, false)
+      })
     })
 
-    it('should set maxAge', function () {
-      var maxAge = 60000
-      var cookie = new Cookie({ maxAge: maxAge })
+    describe('maxAge', function () {
+      it('should set expires', function () {
+        var maxAge = 60000
+        var cookie = new Cookie({ maxAge: maxAge })
+
+        assert.ok(cookie.expires.getTime() - Date.now() - 1000 <= maxAge)
+        assert.ok(cookie.expires.getTime() - Date.now() + 1000 >= maxAge)
+      })
+
+      it('should set maxAge', function () {
+        var maxAge = 60000
+        var cookie = new Cookie({ maxAge: maxAge })
 
-      assert.ok(cookie.expires.getTime() - Date.now() - 1000 <= maxAge)
-      assert.ok(cookie.expires.getTime() - Date.now() + 1000 >= maxAge)
-      assert.strictEqual(cookie.maxAge, maxAge)
+        assert.strictEqual(cookie.maxAge, maxAge)
+      })
     })
 
-    it('should set path', function () {
-      var cookie = new Cookie({ path: '/foo' })
+    describe('path', function () {
+      it('should set path', function () {
+        var cookie = new Cookie({ path: '/foo' })
 
-      assert.strictEqual(cookie.path, '/foo')
+        assert.strictEqual(cookie.path, '/foo')
+      })
     })
   })
 })

From 2cf079688afcce6824da8345935bc20fdb96c5ae Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 5 Nov 2018 13:27:09 -0500
Subject: [PATCH 005/272] tests: add tests for Date as maxAge

---
 test/cookie.js | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/test/cookie.js b/test/cookie.js
index cac5ef6f..80409876 100644
--- a/test/cookie.js
+++ b/test/cookie.js
@@ -84,6 +84,15 @@ describe('new Cookie()', function () {
 
         assert.strictEqual(cookie.maxAge, maxAge)
       })
+
+      it('should accept Date object', function () {
+        var maxAge = new Date(Date.now() + 60000)
+        var cookie = new Cookie({ maxAge: maxAge })
+
+        assert.strictEqual(cookie.expires.getTime(), maxAge.getTime())
+        assert.ok(maxAge.getTime() - Date.now() - 1000 <= cookie.maxAge)
+        assert.ok(maxAge.getTime() - Date.now() + 1000 >= cookie.maxAge)
+      })
     })
 
     describe('path', function () {

From 784d7434da9a34a44c7d93959e4b18bf8285d9f1 Mon Sep 17 00:00:00 2001
From: Paul Berg <hello@paulrberg.com>
Date: Sat, 31 Mar 2018 20:15:52 +0100
Subject: [PATCH 006/272] Catch invalid cookie.maxAge value earlier

closes #432
closes #574
---
 HISTORY.md        | 1 +
 session/cookie.js | 4 ++++
 test/cookie.js    | 6 ++++++
 3 files changed, 11 insertions(+)

diff --git a/HISTORY.md b/HISTORY.md
index c91d901a..6a775a6c 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Catch invalid `cookie.maxAge` value earlier
   * Fix issue where `resave: false` may not save altered sessions
   * Use `safe-buffer` for improved Buffer API
   * Use `Set-Cookie` as cookie header name for compatibility
diff --git a/session/cookie.js b/session/cookie.js
index edac988f..bf8ee33b 100644
--- a/session/cookie.js
+++ b/session/cookie.js
@@ -77,6 +77,10 @@ Cookie.prototype = {
    */
 
   set maxAge(ms) {
+    if (ms && typeof ms !== 'number' && !(ms instanceof Date)) {
+      throw new TypeError('maxAge must be a number or Date')
+    }
+
     this.expires = 'number' == typeof ms
       ? new Date(Date.now() + ms)
       : ms;
diff --git a/test/cookie.js b/test/cookie.js
index 80409876..4cca87bb 100644
--- a/test/cookie.js
+++ b/test/cookie.js
@@ -93,6 +93,12 @@ describe('new Cookie()', function () {
         assert.ok(maxAge.getTime() - Date.now() - 1000 <= cookie.maxAge)
         assert.ok(maxAge.getTime() - Date.now() + 1000 >= cookie.maxAge)
       })
+
+      it('should reject invalid types', function() {
+        assert.throws(function() { new Cookie({ maxAge: '42' }) }, /maxAge/)
+        assert.throws(function() { new Cookie({ maxAge: true }) }, /maxAge/)
+        assert.throws(function() { new Cookie({ maxAge: function () {} }) }, /maxAge/)
+      })
     })
 
     describe('path', function () {

From ad717fe9aeaf9af016ab72cdaf25b490ebde8591 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 20 Nov 2018 15:05:13 -0500
Subject: [PATCH 007/272] Remove utils-merge dependency

---
 HISTORY.md        | 1 +
 package.json      | 3 +--
 session/cookie.js | 5 +++--
 3 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 6a775a6c..1e5a3a40 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -3,6 +3,7 @@ unreleased
 
   * Catch invalid `cookie.maxAge` value earlier
   * Fix issue where `resave: false` may not save altered sessions
+  * Remove `utils-merge` dependency
   * Use `safe-buffer` for improved Buffer API
   * Use `Set-Cookie` as cookie header name for compatibility
   * deps: depd@~2.0.0
diff --git a/package.json b/package.json
index 6c8ac6b9..03d016eb 100644
--- a/package.json
+++ b/package.json
@@ -17,8 +17,7 @@
     "on-headers": "~1.0.1",
     "parseurl": "~1.3.2",
     "safe-buffer": "5.1.2",
-    "uid-safe": "~2.1.5",
-    "utils-merge": "1.0.1"
+    "uid-safe": "~2.1.5"
   },
   "devDependencies": {
     "after": "0.8.2",
diff --git a/session/cookie.js b/session/cookie.js
index bf8ee33b..ae7e7d7a 100644
--- a/session/cookie.js
+++ b/session/cookie.js
@@ -12,7 +12,6 @@
  */
 
 var cookie = require('cookie')
-var merge = require('utils-merge')
 
 /**
  * Initialize a new `Cookie` with the given `options`.
@@ -32,7 +31,9 @@ var Cookie = module.exports = function Cookie(options) {
       throw new TypeError('argument options must be a object')
     }
 
-    merge(this, options)
+    for (var key in options) {
+      this[key] = options[key]
+    }
   }
 
   this.originalMaxAge = undefined == this.originalMaxAge

From 15fe12144527ed3ca60781f7993e446e74b5c3e6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 20 Nov 2018 15:33:24 -0500
Subject: [PATCH 008/272] Deprecate setting cookie.maxAge to a Date object

---
 HISTORY.md        | 1 +
 session/cookie.js | 5 +++++
 2 files changed, 6 insertions(+)

diff --git a/HISTORY.md b/HISTORY.md
index 1e5a3a40..d9ca7e60 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
   * Catch invalid `cookie.maxAge` value earlier
+  * Deprecate setting `cookie.maxAge` to a `Date` object
   * Fix issue where `resave: false` may not save altered sessions
   * Remove `utils-merge` dependency
   * Use `safe-buffer` for improved Buffer API
diff --git a/session/cookie.js b/session/cookie.js
index ae7e7d7a..1dd9bf95 100644
--- a/session/cookie.js
+++ b/session/cookie.js
@@ -12,6 +12,7 @@
  */
 
 var cookie = require('cookie')
+var deprecate = require('depd')('express-session')
 
 /**
  * Initialize a new `Cookie` with the given `options`.
@@ -82,6 +83,10 @@ Cookie.prototype = {
       throw new TypeError('maxAge must be a number or Date')
     }
 
+    if (ms instanceof Date) {
+      deprecate('maxAge as Date; pass number of milliseconds instead')
+    }
+
     this.expires = 'number' == typeof ms
       ? new Date(Date.now() + ms)
       : ms;

From a856618f4d7d3f88f1620608acda46485a939f9e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 21 Nov 2018 00:30:28 -0500
Subject: [PATCH 009/272] build: eslint-plugin-markdown@1.0.0-rc.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 03d016eb..eed1ff33 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,7 @@
     "after": "0.8.2",
     "cookie-parser": "1.4.3",
     "eslint": "3.19.0",
-    "eslint-plugin-markdown": "1.0.0-beta.6",
+    "eslint-plugin-markdown": "1.0.0-rc.1",
     "express": "4.16.4",
     "istanbul": "0.4.5",
     "mocha": "5.2.0",

From 0f5913ceb5812f6f24738a776d3502797388e0b7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 21 Nov 2018 00:37:22 -0500
Subject: [PATCH 010/272] build: Node.js@8.13

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index e84788db..361d170e 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -10,7 +10,7 @@ node_js:
   - "5.12"
   - "6.14"
   - "7.10"
-  - "8.12"
+  - "8.13"
   - "9.11"
   - "10.13"
 sudo: false

From 6a3cf0ec90261faeec48854ceb91be6aced00a4f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 21 Nov 2018 00:56:21 -0500
Subject: [PATCH 011/272] build: support Node.js 11.x

---
 .travis.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.travis.yml b/.travis.yml
index 361d170e..0cd58dbe 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -13,6 +13,7 @@ node_js:
   - "8.13"
   - "9.11"
   - "10.13"
+  - "11.2"
 sudo: false
 cache:
   directories:

From 5508375d95796b402b6c32d710911a86a559ea10 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 22 Jan 2019 23:41:20 -0500
Subject: [PATCH 012/272] build: Node.js@6.16

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 0cd58dbe..22cb8b69 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -8,7 +8,7 @@ node_js:
   - "3.3"
   - "4.9"
   - "5.12"
-  - "6.14"
+  - "6.16"
   - "7.10"
   - "8.13"
   - "9.11"

From 80bf8b28c2f86c560a7840a251635f95ff35f668 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 23 Jan 2019 01:27:10 -0500
Subject: [PATCH 013/272] build: Node.js@8.15

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 22cb8b69..5b2ebd48 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -10,7 +10,7 @@ node_js:
   - "5.12"
   - "6.16"
   - "7.10"
-  - "8.13"
+  - "8.15"
   - "9.11"
   - "10.13"
   - "11.2"

From dd21b1401eb570514495e8d64ce1c5c371d405da Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 23 Jan 2019 01:32:33 -0500
Subject: [PATCH 014/272] build: Node.js@10.15

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 5b2ebd48..7950bb88 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -12,7 +12,7 @@ node_js:
   - "7.10"
   - "8.15"
   - "9.11"
-  - "10.13"
+  - "10.15"
   - "11.2"
 sudo: false
 cache:

From 73cbcb01162abdb2b4de43bd6390f8c9b6ebf78e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 23 Jan 2019 01:39:03 -0500
Subject: [PATCH 015/272] build: Node.js@11.7

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 7950bb88..33ce5cfd 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -13,7 +13,7 @@ node_js:
   - "8.15"
   - "9.11"
   - "10.15"
-  - "11.2"
+  - "11.7"
 sudo: false
 cache:
   directories:

From 787721123331bdf122e895762676043aee2386fc Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 1 Feb 2019 12:09:28 -0500
Subject: [PATCH 016/272] build: supertest@3.4.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index eed1ff33..f8e53c81 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "express": "4.16.4",
     "istanbul": "0.4.5",
     "mocha": "5.2.0",
-    "supertest": "3.3.0"
+    "supertest": "3.4.2"
   },
   "files": [
     "session/",

From a7b66fb94d09fd9f701c836c7af05b0dc711dfb7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 14 Feb 2019 12:50:13 -0500
Subject: [PATCH 017/272] build: Node.js@11.9

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 33ce5cfd..2a828984 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -13,7 +13,7 @@ node_js:
   - "8.15"
   - "9.11"
   - "10.15"
-  - "11.7"
+  - "11.9"
 sudo: false
 cache:
   directories:

From 85c0ff56b71a691d422353b7e46d8dd9c4fd6a68 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 14 Feb 2019 12:54:10 -0500
Subject: [PATCH 018/272] build: fix istanbul/eslint detection in Travis CI

---
 .travis.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 2a828984..0eba9a47 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -67,14 +67,14 @@ before_install:
 script:
   - |
     # Run test script, depending on istanbul install
-    if [[ -n "$(npm -ps ls istanbul)" ]]; then
+    if npm -ps ls istanbul | grep -q istanbul; then
       npm run-script test-travis
     else
       npm test
     fi
   - |
     # Run linting, depending on eslint install
-    if [[ -n "$(npm -ps ls eslint)" ]]; then
+    if npm -ps ls eslint | grep -q eslint; then
       npm run-script lint
     fi
 after_script:

From 6e3ff5dffe4ce26c239cb7b5da1d1c797306bdca Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 14 Feb 2019 13:31:54 -0500
Subject: [PATCH 019/272] build: make Travis CI version compare readable

---
 .travis.yml | 30 ++++++++++++++++++------------
 1 file changed, 18 insertions(+), 12 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 0eba9a47..7f60f4e3 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -19,6 +19,12 @@ cache:
   directories:
     - node_modules
 before_install:
+  - |
+    function v () {
+      tr '.' '\n' <<< "${1}" \
+        | awk '{ printf "%03d", $0 }' \
+        | sed 's/^0*//'
+    }
   # Configure npm
   - |
     # Skip updating shrinkwrap / lock
@@ -26,34 +32,34 @@ before_install:
   # Setup Node.js version-specific dependencies
   - |
     # eslint for linting
-    # - remove on Node.js < 4
-    if [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 4 ]]; then
+    if [[ "$(v "$TRAVIS_NODE_VERSION")" -lt "$(v '4.0')" ]]; then
+      # - remove on Node.js < 4
       node -pe 'Object.keys(require("./package").devDependencies).join("\n")' | \
         grep -E '^eslint(-|$)' | \
         xargs npm rm --save-dev
     fi
   - |
     # istanbul for coverage
-    # - remove on Node.js < 0.10
-    if [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -eq 0 && "$(cut -d. -f2 <<< "$TRAVIS_NODE_VERSION")" -lt 10 ]]; then
+    if [[ "$(v "$TRAVIS_NODE_VERSION")" -lt "$(v '0.10')" ]]; then
+      # - remove on Node.js < 0.10
       npm rm --save-dev istanbul
     fi
   - |
     # mocha for testing
-    # - use 2.x for Node.js < 0.10
-    # - use 3.x for Node.js < 6
-    if [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -eq 0 && "$(cut -d. -f2 <<< "$TRAVIS_NODE_VERSION")" -lt 10 ]]; then
+    if [[ "$(v "$TRAVIS_NODE_VERSION")" -lt "$(v '0.10')" ]]; then
+      # - use 2.x for Node.js < 0.10
       npm install --save-dev mocha@2.5.3
-    elif [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 6 ]]; then
+    elif [[ "$(v "$TRAVIS_NODE_VERSION")" -lt "$(v '6.0')" ]]; then
+      # - use 3.x for Node.js < 6
       npm install --save-dev mocha@3.5.3
     fi
   - |
     # supertest for http calls
-    # - use 1.1.0 for Node.js < 0.10
-    # - use 2.0.0 for Node.js < 4
-    if [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -eq 0 && "$(cut -d. -f2 <<< "$TRAVIS_NODE_VERSION")" -lt 10 ]]; then
+    if [[ "$(v "$TRAVIS_NODE_VERSION")" -lt "$(v '0.10')" ]]; then
+      # - use 1.1.0 for Node.js < 0.10
       npm install --save-dev supertest@1.1.0
-    elif [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 4 ]]; then
+    elif [[ "$(v "$TRAVIS_NODE_VERSION")" -lt "$(v '4.0')" ]]; then
+      # - use 2.0.0 for Node.js < 4
       npm install --save-dev supertest@2.0.0
     fi
   # Update Node.js modules

From fee8e68b1d77bf7cf3cba1b588a5cfdd8ccc7656 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 15 Feb 2019 11:49:53 -0500
Subject: [PATCH 020/272] build: eslint-plugin-markdown@1.0.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index f8e53c81..d473f546 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,7 @@
     "after": "0.8.2",
     "cookie-parser": "1.4.3",
     "eslint": "3.19.0",
-    "eslint-plugin-markdown": "1.0.0-rc.1",
+    "eslint-plugin-markdown": "1.0.0",
     "express": "4.16.4",
     "istanbul": "0.4.5",
     "mocha": "5.2.0",

From 99288b44c2a1f5057cdd44eb8fb116c41361407c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 15 Feb 2019 11:50:30 -0500
Subject: [PATCH 021/272] build: cookie-parser@1.4.4

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index d473f546..158f6310 100644
--- a/package.json
+++ b/package.json
@@ -21,7 +21,7 @@
   },
   "devDependencies": {
     "after": "0.8.2",
-    "cookie-parser": "1.4.3",
+    "cookie-parser": "1.4.4",
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.0",
     "express": "4.16.4",

From 3602d293b51cf81bf02742b764e32426a0384a56 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 23 Feb 2019 20:03:39 -0500
Subject: [PATCH 022/272] build: Node.js@11.10

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 7f60f4e3..aa29ae70 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -13,7 +13,7 @@ node_js:
   - "8.15"
   - "9.11"
   - "10.15"
-  - "11.9"
+  - "11.10"
 sudo: false
 cache:
   directories:

From eda02b213370399e0ec21fd141399252075f7ff9 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 23 Feb 2019 20:18:02 -0500
Subject: [PATCH 023/272] deps: on-headers@~1.0.2

---
 HISTORY.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index d9ca7e60..b21a4b41 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -11,6 +11,8 @@ unreleased
     - Replace internal `eval` usage with `Function` constructor
     - Use instance methods on `process` to check for listeners
     - perf: remove argument reassignment
+  * deps: on-headers@~1.0.2
+    - Fix `res.writeHead` patch missing return value
 
 1.15.6 / 2017-09-26
 ===================
diff --git a/package.json b/package.json
index 158f6310..fc58c2bf 100644
--- a/package.json
+++ b/package.json
@@ -14,7 +14,7 @@
     "cookie-signature": "1.0.6",
     "debug": "2.6.9",
     "depd": "~2.0.0",
-    "on-headers": "~1.0.1",
+    "on-headers": "~1.0.2",
     "parseurl": "~1.3.2",
     "safe-buffer": "5.1.2",
     "uid-safe": "~2.1.5"

From 4cbb93f6138c3c6219144637ca648b8580945755 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 28 Feb 2019 22:09:18 -0500
Subject: [PATCH 024/272] build: simplify & speed up logic in Travis CI build
 steps

---
 .travis.yml | 69 ++++++++++++++++++++++++++++++-----------------------
 1 file changed, 39 insertions(+), 30 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index aa29ae70..4a1fd41d 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -20,6 +20,32 @@ cache:
     - node_modules
 before_install:
   - |
+    # Setup utility functions
+    function node_version_lt () {
+      [[ "$(v "$TRAVIS_NODE_VERSION")" -lt "$(v "${1}")" ]]
+    }
+    function npm_module_installed () {
+      npm -lsp ls | grep -Fq "$(pwd)/node_modules/${1}:${1}@"
+    }
+    function npm_remove_module_re () {
+      node -e '
+        fs = require("fs");
+        p = JSON.parse(fs.readFileSync("package.json", "utf8"));
+        r = RegExp(process.argv[1]);
+        for (k in p.devDependencies) {
+          if (r.test(k)) delete p.devDependencies[k];
+        }
+        fs.writeFileSync("package.json", JSON.stringify(p, null, 2) + "\n");
+      ' "$@"
+    }
+    function npm_use_module () {
+      node -e '
+        fs = require("fs");
+        p = JSON.parse(fs.readFileSync("package.json", "utf8"));
+        p.devDependencies[process.argv[1]] = process.argv[2];
+        fs.writeFileSync("package.json", JSON.stringify(p, null, 2) + "\n");
+      ' "$@"
+    }
     function v () {
       tr '.' '\n' <<< "${1}" \
         | awk '{ printf "%03d", $0 }' \
@@ -31,36 +57,22 @@ before_install:
     npm config set shrinkwrap false
   # Setup Node.js version-specific dependencies
   - |
-    # eslint for linting
-    if [[ "$(v "$TRAVIS_NODE_VERSION")" -lt "$(v '4.0')" ]]; then
-      # - remove on Node.js < 4
-      node -pe 'Object.keys(require("./package").devDependencies).join("\n")' | \
-        grep -E '^eslint(-|$)' | \
-        xargs npm rm --save-dev
+    # Configure eslint for linting
+    if node_version_lt '4.0'; then npm_remove_module_re '^eslint(-|$)'
     fi
   - |
-    # istanbul for coverage
-    if [[ "$(v "$TRAVIS_NODE_VERSION")" -lt "$(v '0.10')" ]]; then
-      # - remove on Node.js < 0.10
-      npm rm --save-dev istanbul
+    # Configure istanbul for coverage
+    if node_version_lt '0.10'; then npm_remove_module_re '^istanbul$'
     fi
   - |
-    # mocha for testing
-    if [[ "$(v "$TRAVIS_NODE_VERSION")" -lt "$(v '0.10')" ]]; then
-      # - use 2.x for Node.js < 0.10
-      npm install --save-dev mocha@2.5.3
-    elif [[ "$(v "$TRAVIS_NODE_VERSION")" -lt "$(v '6.0')" ]]; then
-      # - use 3.x for Node.js < 6
-      npm install --save-dev mocha@3.5.3
+    # Configure mocha for testing
+    if   node_version_lt '0.10'; then npm_use_module 'mocha' '2.5.3'
+    elif node_version_lt '4.0' ; then npm_use_module 'mocha' '3.5.3'
     fi
   - |
-    # supertest for http calls
-    if [[ "$(v "$TRAVIS_NODE_VERSION")" -lt "$(v '0.10')" ]]; then
-      # - use 1.1.0 for Node.js < 0.10
-      npm install --save-dev supertest@1.1.0
-    elif [[ "$(v "$TRAVIS_NODE_VERSION")" -lt "$(v '4.0')" ]]; then
-      # - use 2.0.0 for Node.js < 4
-      npm install --save-dev supertest@2.0.0
+    # Configure supertest for http calls
+    if   node_version_lt '0.10'; then npm_use_module 'supertest' '1.1.0'
+    elif node_version_lt '4.0' ; then npm_use_module 'supertest' '2.0.0'
     fi
   # Update Node.js modules
   - |
@@ -73,15 +85,12 @@ before_install:
 script:
   - |
     # Run test script, depending on istanbul install
-    if npm -ps ls istanbul | grep -q istanbul; then
-      npm run-script test-travis
-    else
-      npm test
+    if npm_module_installed 'istanbul'; then npm run-script test-travis
+    else npm test
     fi
   - |
     # Run linting, depending on eslint install
-    if npm -ps ls eslint | grep -q eslint; then
-      npm run-script lint
+    if npm_module_installed 'eslint'; then npm run-script lint
     fi
 after_script:
   - |

From 2f0759cfcb7b6f828754c6cd3983fee06cfe8028 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 28 Feb 2019 22:14:40 -0500
Subject: [PATCH 025/272] build: mocha@6.0.2

---
 .travis.yml  | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 4a1fd41d..09447479 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -68,6 +68,7 @@ before_install:
     # Configure mocha for testing
     if   node_version_lt '0.10'; then npm_use_module 'mocha' '2.5.3'
     elif node_version_lt '4.0' ; then npm_use_module 'mocha' '3.5.3'
+    elif node_version_lt '6.0' ; then npm_use_module 'mocha' '5.2.0'
     fi
   - |
     # Configure supertest for http calls
diff --git a/package.json b/package.json
index fc58c2bf..5473f28b 100644
--- a/package.json
+++ b/package.json
@@ -26,7 +26,7 @@
     "eslint-plugin-markdown": "1.0.0",
     "express": "4.16.4",
     "istanbul": "0.4.5",
-    "mocha": "5.2.0",
+    "mocha": "6.0.2",
     "supertest": "3.4.2"
   },
   "files": [

From 3e0d5489f53763899a91395b26b57f1e8f54a8d3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 2 Mar 2019 13:09:20 -0500
Subject: [PATCH 026/272] tests: move some code into support/

---
 test/session.js            | 82 ++++++--------------------------------
 test/support/sync-store.js | 27 +++++++++++++
 test/support/utils.js      | 42 +++++++++++++++++++
 3 files changed, 81 insertions(+), 70 deletions(-)
 create mode 100644 test/support/sync-store.js
 create mode 100644 test/support/utils.js

diff --git a/test/session.js b/test/session.js
index 6862ccc4..383a3024 100644
--- a/test/session.js
+++ b/test/session.js
@@ -8,7 +8,8 @@ var http = require('http')
 var https = require('https')
 var request = require('supertest')
 var session = require('../')
-var util = require('util')
+var SyncStore = require('./support/sync-store')
+var utils = require('./support/utils')
 
 var Cookie = require('../session/cookie')
 
@@ -1396,7 +1397,7 @@ describe('session()', function(){
   describe('res.end patch', function () {
     it('should correctly handle res.end/res.write patched prior', function (done) {
       function setup (req, res) {
-        writePatch(res)
+        utils.writePatch(res)
       }
 
       function respond (req, res) {
@@ -1412,7 +1413,7 @@ describe('session()', function(){
 
     it('should correctly handle res.end/res.write patched after', function (done) {
       function respond (req, res) {
-        writePatch(res)
+        utils.writePatch(res)
         req.session.hit = true
         res.write('hello, ')
         res.end('world')
@@ -2185,7 +2186,7 @@ function end(req, res) {
 
 function expires (res) {
   var header = cookie(res)
-  return header && parseSetCookie(header).expires
+  return header && utils.parseSetCookie(header).expires
 }
 
 function mountAt (path) {
@@ -2197,25 +2198,6 @@ function mountAt (path) {
   }
 }
 
-function parseSetCookie (header) {
-  var match
-  var pairs = []
-  var pattern = /\s*([^=;]+)(?:=([^;]*);?|;|$)/g
-
-  while ((match = pattern.exec(header))) {
-    pairs.push({ name: match[1], value: match[2] })
-  }
-
-  var cookie = pairs.shift()
-
-  for (var i = 0; i < pairs.length; i++) {
-    match = pairs[i]
-    cookie[match.name.toLowerCase()] = (match.value || true)
-  }
-
-  return cookie
-}
-
 function shouldNotHaveHeader(header) {
   return function (res) {
     assert.ok(!(header.toLowerCase() in res.headers), 'should not have ' + header + ' header')
@@ -2239,7 +2221,7 @@ function shouldNotSetSessionInStore(store) {
 function shouldSetCookie (name) {
   return function (res) {
     var header = cookie(res)
-    var data = header && parseSetCookie(header)
+    var data = header && utils.parseSetCookie(header)
     assert.ok(header, 'should have a cookie header')
     assert.strictEqual(data.name, name, 'should set cookie ' + name)
   }
@@ -2254,7 +2236,7 @@ function shouldSetCookieToDifferentSessionId (id) {
 function shouldSetCookieToExpireIn (name, delta) {
   return function (res) {
     var header = cookie(res)
-    var data = header && parseSetCookie(header)
+    var data = header && utils.parseSetCookie(header)
     assert.ok(header, 'should have a cookie header')
     assert.strictEqual(data.name, name, 'should set cookie ' + name)
     assert.ok(('expires' in data), 'should set cookie with attribute Expires')
@@ -2266,7 +2248,7 @@ function shouldSetCookieToExpireIn (name, delta) {
 function shouldSetCookieToValue (name, val) {
   return function (res) {
     var header = cookie(res)
-    var data = header && parseSetCookie(header)
+    var data = header && utils.parseSetCookie(header)
     assert.ok(header, 'should have a cookie header')
     assert.strictEqual(data.name, name, 'should set cookie ' + name)
     assert.strictEqual(data.value, val, 'should set cookie ' + name + ' to ' + val)
@@ -2276,7 +2258,7 @@ function shouldSetCookieToValue (name, val) {
 function shouldSetCookieWithAttribute (name, attrib) {
   return function (res) {
     var header = cookie(res)
-    var data = header && parseSetCookie(header)
+    var data = header && utils.parseSetCookie(header)
     assert.ok(header, 'should have a cookie header')
     assert.strictEqual(data.name, name, 'should set cookie ' + name)
     assert.ok((attrib.toLowerCase() in data), 'should set cookie with attribute ' + attrib)
@@ -2286,7 +2268,7 @@ function shouldSetCookieWithAttribute (name, attrib) {
 function shouldSetCookieWithAttributeAndValue (name, attrib, value) {
   return function (res) {
     var header = cookie(res)
-    var data = header && parseSetCookie(header)
+    var data = header && utils.parseSetCookie(header)
     assert.ok(header, 'should have a cookie header')
     assert.strictEqual(data.name, name, 'should set cookie ' + name)
     assert.ok((attrib.toLowerCase() in data), 'should set cookie with attribute ' + attrib)
@@ -2297,7 +2279,7 @@ function shouldSetCookieWithAttributeAndValue (name, attrib, value) {
 function shouldSetCookieWithoutAttribute (name, attrib) {
   return function (res) {
     var header = cookie(res)
-    var data = header && parseSetCookie(header)
+    var data = header && utils.parseSetCookie(header)
     assert.ok(header, 'should have a cookie header')
     assert.strictEqual(data.name, name, 'should set cookie ' + name)
     assert.ok(!(attrib.toLowerCase() in data), 'should set cookie without attribute ' + attrib)
@@ -2320,48 +2302,8 @@ function shouldSetSessionInStore(store) {
 
 function sid (res) {
   var header = cookie(res)
-  var data = header && parseSetCookie(header)
+  var data = header && utils.parseSetCookie(header)
   var value = data && unescape(data.value)
   var sid = value && value.substring(2, value.indexOf('.'))
   return sid || undefined
 }
-
-function writePatch (res) {
-  var _end = res.end
-  var _write = res.write
-  var ended = false
-
-  res.end = function end() {
-    ended = true
-    return _end.apply(this, arguments)
-  }
-
-  res.write = function write() {
-    if (ended) {
-      throw new Error('write after end')
-    }
-
-    return _write.apply(this, arguments)
-  }
-}
-
-function SyncStore () {
-  session.Store.call(this)
-  this.sessions = Object.create(null)
-}
-
-util.inherits(SyncStore, session.Store)
-
-SyncStore.prototype.destroy = function destroy(sid, callback) {
-  delete this.sessions[sid];
-  callback();
-};
-
-SyncStore.prototype.get = function get(sid, callback) {
-  callback(null, JSON.parse(this.sessions[sid]));
-};
-
-SyncStore.prototype.set = function set(sid, sess, callback) {
-  this.sessions[sid] = JSON.stringify(sess);
-  callback();
-};
diff --git a/test/support/sync-store.js b/test/support/sync-store.js
new file mode 100644
index 00000000..b45dc9a8
--- /dev/null
+++ b/test/support/sync-store.js
@@ -0,0 +1,27 @@
+'use strict'
+
+var session = require('../../')
+var util = require('util')
+
+module.exports = SyncStore
+
+function SyncStore () {
+  session.Store.call(this)
+  this.sessions = Object.create(null)
+}
+
+util.inherits(SyncStore, session.Store)
+
+SyncStore.prototype.destroy = function destroy (sid, callback) {
+  delete this.sessions[sid]
+  callback()
+}
+
+SyncStore.prototype.get = function get (sid, callback) {
+  callback(null, JSON.parse(this.sessions[sid]))
+}
+
+SyncStore.prototype.set = function set (sid, sess, callback) {
+  this.sessions[sid] = JSON.stringify(sess)
+  callback()
+}
diff --git a/test/support/utils.js b/test/support/utils.js
new file mode 100644
index 00000000..0f13ba6a
--- /dev/null
+++ b/test/support/utils.js
@@ -0,0 +1,42 @@
+'use strict'
+
+module.exports.parseSetCookie = parseSetCookie
+module.exports.writePatch = writePatch
+
+function parseSetCookie (header) {
+  var match
+  var pairs = []
+  var pattern = /\s*([^=;]+)(?:=([^;]*);?|;|$)/g
+
+  while ((match = pattern.exec(header))) {
+    pairs.push({ name: match[1], value: match[2] })
+  }
+
+  var cookie = pairs.shift()
+
+  for (var i = 0; i < pairs.length; i++) {
+    match = pairs[i]
+    cookie[match.name.toLowerCase()] = (match.value || true)
+  }
+
+  return cookie
+}
+
+function writePatch (res) {
+  var _end = res.end
+  var _write = res.write
+  var ended = false
+
+  res.end = function end () {
+    ended = true
+    return _end.apply(this, arguments)
+  }
+
+  res.write = function write () {
+    if (ended) {
+      throw new Error('write after end')
+    }
+
+    return _write.apply(this, arguments)
+  }
+}

From ed8a50f725b2b4a5837b868cae524c424cb4d49b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 5 Mar 2019 23:09:17 -0500
Subject: [PATCH 027/272] build: supertest@4.0.2

---
 .travis.yml  | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 09447479..eef1707b 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -74,6 +74,7 @@ before_install:
     # Configure supertest for http calls
     if   node_version_lt '0.10'; then npm_use_module 'supertest' '1.1.0'
     elif node_version_lt '4.0' ; then npm_use_module 'supertest' '2.0.0'
+    elif node_version_lt '6.0' ; then npm_use_module 'supertest' '3.4.2'
     fi
   # Update Node.js modules
   - |
diff --git a/package.json b/package.json
index 5473f28b..e8f866c5 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "express": "4.16.4",
     "istanbul": "0.4.5",
     "mocha": "6.0.2",
-    "supertest": "3.4.2"
+    "supertest": "4.0.2"
   },
   "files": [
     "session/",

From cc5c83abf710c6e9e4d0bb887777b44faefd2251 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 6 Mar 2019 22:08:17 -0500
Subject: [PATCH 028/272] lint: ensure strict equality checks

---
 .eslintrc.yml     |  1 +
 index.js          |  4 ++--
 session/cookie.js |  8 ++++----
 session/store.js  | 12 +++++++++---
 4 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/.eslintrc.yml b/.eslintrc.yml
index e48de5ea..0740b11f 100644
--- a/.eslintrc.yml
+++ b/.eslintrc.yml
@@ -1,6 +1,7 @@
 root: true
 rules:
   eol-last: error
+  eqeqeq: ["error", "always", { "null": "ignore" }]
   indent: ["error", 2, { "SwitchCase": 1 }]
   no-mixed-spaces-and-tabs: error
   no-trailing-spaces: error
diff --git a/index.js b/index.js
index 42639913..1cd02f6e 100644
--- a/index.js
+++ b/index.js
@@ -150,7 +150,7 @@ function session(options) {
   // notify user that this store is not
   // meant for a production environment
   /* istanbul ignore next: not tested */
-  if ('production' == env && store instanceof MemoryStore) {
+  if (env === 'production' && store instanceof MemoryStore) {
     console.warn(warning);
   }
 
@@ -443,7 +443,7 @@ function session(options) {
         return false;
       }
 
-      return cookieId != req.sessionID
+      return cookieId !== req.sessionID
         ? saveUninitializedSession || isModified(req.session)
         : rollingSessions || req.session.cookie.expires != null && isModified(req.session);
     }
diff --git a/session/cookie.js b/session/cookie.js
index 1dd9bf95..3197d272 100644
--- a/session/cookie.js
+++ b/session/cookie.js
@@ -37,9 +37,9 @@ var Cookie = module.exports = function Cookie(options) {
     }
   }
 
-  this.originalMaxAge = undefined == this.originalMaxAge
-    ? this.maxAge
-    : this.originalMaxAge;
+  if (this.originalMaxAge === undefined || this.originalMaxAge === null) {
+    this.originalMaxAge = this.maxAge
+  }
 };
 
 /*!
@@ -87,7 +87,7 @@ Cookie.prototype = {
       deprecate('maxAge as Date; pass number of milliseconds instead')
     }
 
-    this.expires = 'number' == typeof ms
+    this.expires = typeof ms === 'number'
       ? new Date(Date.now() + ms)
       : ms;
   },
diff --git a/session/store.js b/session/store.js
index 00f3ac41..baefbf8d 100644
--- a/session/store.js
+++ b/session/store.js
@@ -85,11 +85,17 @@ Store.prototype.load = function(sid, fn){
 
 Store.prototype.createSession = function(req, sess){
   var expires = sess.cookie.expires
-  var orig = sess.cookie.originalMaxAge
+  var originalMaxAge = sess.cookie.originalMaxAge
 
   sess.cookie = new Cookie(sess.cookie);
-  if ('string' == typeof expires) sess.cookie.expires = new Date(expires);
-  sess.cookie.originalMaxAge = orig;
+
+  if (typeof expires === 'string') {
+    // convert expires to a Date object,
+    // keeping originalMaxAge intact
+    sess.cookie.expires = new Date(expires)
+    sess.cookie.originalMaxAge = originalMaxAge
+  }
+
   req.session = new Session(req, sess);
   return req.session;
 };

From 03aa560b17e0e038050d379b8d0b040ee5255011 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 6 Mar 2019 22:14:43 -0500
Subject: [PATCH 029/272] build: Node.js@6.17

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index eef1707b..99eddf67 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -8,7 +8,7 @@ node_js:
   - "3.3"
   - "4.9"
   - "5.12"
-  - "6.16"
+  - "6.17"
   - "7.10"
   - "8.15"
   - "9.11"

From a7cf57f56bd60878e0067d8c507415e356e36e94 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 6 Mar 2019 22:18:11 -0500
Subject: [PATCH 030/272] build: Node.js@11.11

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 99eddf67..bcebedef 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -13,7 +13,7 @@ node_js:
   - "8.15"
   - "9.11"
   - "10.15"
-  - "11.10"
+  - "11.11"
 sudo: false
 cache:
   directories:

From e926b8846d9cfbf092a626dcc866b8055d99cf73 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 9 Apr 2019 18:09:22 -0400
Subject: [PATCH 031/272] build: mocha@6.1.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index e8f866c5..0117e2e2 100644
--- a/package.json
+++ b/package.json
@@ -26,7 +26,7 @@
     "eslint-plugin-markdown": "1.0.0",
     "express": "4.16.4",
     "istanbul": "0.4.5",
-    "mocha": "6.0.2",
+    "mocha": "6.1.2",
     "supertest": "4.0.2"
   },
   "files": [

From dc5262a2c83759d54325ab62c2cd657d7d8eb8ec Mon Sep 17 00:00:00 2001
From: ich <me89@users.noreply.github.com>
Date: Sun, 10 Mar 2019 17:01:35 +1000
Subject: [PATCH 032/272] docs: add connect-arango to the list of session
 stores

closes #642
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 2be21d2c..5f96d794 100644
--- a/README.md
+++ b/README.md
@@ -506,6 +506,11 @@ and other multi-core embedded devices).
 [cluster-store-url]: https://www.npmjs.com/package/cluster-store
 [cluster-store-image]: https://badgen.net/github/stars/coolaj86/cluster-store?label=%E2%98%85
 
+[![★][connect-arango-image] connect-arango][connect-arango-url] An ArangoDB-based session store.
+
+[connect-arango-url]: https://www.npmjs.com/package/connect-arango
+[connect-arango-image]: https://badgen.net/github/stars/AlexanderArvidsson/connect-arango?label=%E2%98%85
+
 [![★][connect-azuretables-image] connect-azuretables][connect-azuretables-url] An [Azure Table Storage](https://azure.microsoft.com/en-gb/services/storage/tables/)-based session store.
 
 [connect-azuretables-url]: https://www.npmjs.com/package/connect-azuretables

From 6e514a4cc9cb5a683af6f0b75439e5546f7b3dcd Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 10 Apr 2019 23:57:02 -0400
Subject: [PATCH 033/272] build: Node.js@11.13

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index bcebedef..c2fd08f1 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -13,7 +13,7 @@ node_js:
   - "8.15"
   - "9.11"
   - "10.15"
-  - "11.11"
+  - "11.13"
 sudo: false
 cache:
   directories:

From 9495367f7cfd750a48cf99b74370d18c1f8930e9 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 11 Apr 2019 00:00:37 -0400
Subject: [PATCH 034/272] docs: update badge for level-session-store store

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 5f96d794..48c1ab1e 100644
--- a/README.md
+++ b/README.md
@@ -697,7 +697,7 @@ based session store. Supports all backends supported by Fortune (MongoDB, Redis,
 [![★][level-session-store-image] level-session-store][level-session-store-url] A LevelDB-based session store.
 
 [level-session-store-url]: https://www.npmjs.com/package/level-session-store
-[level-session-store-image]: https://badgen.net/github/stars/scriptollc/level-session-store?label=%E2%98%85
+[level-session-store-image]: https://badgen.net/github/stars/toddself/level-session-store?label=%E2%98%85
 
 [![★][medea-session-store-image] medea-session-store][medea-session-store-url] A Medea-based session store.
 

From e77cbfa93fb083209c4973c2bc6113b86bc32dc2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 11 Apr 2019 00:04:56 -0400
Subject: [PATCH 035/272] build: add version script for npm version releases

---
 package.json               |  3 +-
 scripts/version-history.js | 63 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 65 insertions(+), 1 deletion(-)
 create mode 100644 scripts/version-history.js

diff --git a/package.json b/package.json
index 0117e2e2..5d243086 100644
--- a/package.json
+++ b/package.json
@@ -42,6 +42,7 @@
     "lint": "eslint --plugin markdown --ext js,md .",
     "test": "mocha --require test/support/env --check-leaks --bail --no-exit --reporter spec test/",
     "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --check-leaks --no-exit --reporter dot test/",
-    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --check-leaks --no-exit --reporter spec test/"
+    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --check-leaks --no-exit --reporter spec test/",
+    "version": "node scripts/version-history.js && git add HISTORY.md"
   }
 }
diff --git a/scripts/version-history.js b/scripts/version-history.js
new file mode 100644
index 00000000..b8a2b0e8
--- /dev/null
+++ b/scripts/version-history.js
@@ -0,0 +1,63 @@
+'use strict'
+
+var fs = require('fs')
+var path = require('path')
+
+var HISTORY_FILE_PATH = path.join(__dirname, '..', 'HISTORY.md')
+var MD_HEADER_REGEXP = /^====*$/
+var VERSION = process.env.npm_package_version
+var VERSION_PLACEHOLDER_REGEXP = /^(?:unreleased|(\d+\.)+x)$/
+
+var historyFileLines = fs.readFileSync(HISTORY_FILE_PATH, 'utf-8').split('\n')
+
+if (!MD_HEADER_REGEXP.test(historyFileLines[1])) {
+  console.error('Missing header in HISTORY.md')
+  process.exit(1)
+}
+
+if (!VERSION_PLACEHOLDER_REGEXP.test(historyFileLines[0])) {
+  console.error('Missing placegolder version in HISTORY.md')
+  process.exit(1)
+}
+
+if (historyFileLines[0].indexOf('x') !== -1) {
+  var versionCheckRegExp = new RegExp('^' + historyFileLines[0].replace('x', '.+') + '$')
+
+  if (!versionCheckRegExp.test(VERSION)) {
+    console.error('Version %s does not match placeholder %s', VERSION, historyFileLines[0])
+    process.exit(1)
+  }
+}
+
+historyFileLines[0] = VERSION + ' / ' + getLocaleDate()
+historyFileLines[1] = repeat('=', historyFileLines[0].length)
+
+fs.writeFileSync(HISTORY_FILE_PATH, historyFileLines.join('\n'))
+
+function getLocaleDate () {
+  var now = new Date()
+
+  return zeroPad(now.getFullYear(), 4) + '-' +
+    zeroPad(now.getMonth() + 1, 2) + '-' +
+    zeroPad(now.getDate(), 2)
+}
+
+function repeat (str, length) {
+  var out = ''
+
+  for (var i = 0; i < length; i++) {
+    out += str
+  }
+
+  return out
+}
+
+function zeroPad (number, length) {
+  var num = number.toString()
+
+  while (num.length < length) {
+    num = '0' + num
+  }
+
+  return num
+}

From b1f0984086c8ed15162aa6ce22562ff829bf5ba7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 11 Apr 2019 00:09:18 -0400
Subject: [PATCH 036/272] 1.16.0

---
 HISTORY.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index b21a4b41..aca5825e 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+1.16.0 / 2019-04-10
+===================
 
   * Catch invalid `cookie.maxAge` value earlier
   * Deprecate setting `cookie.maxAge` to a `Date` object
diff --git a/package.json b/package.json
index 5d243086..c0787d66 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.15.6",
+  "version": "1.16.0",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From 1e3fc39a3fc3810772dfa00a7535a710042c42aa Mon Sep 17 00:00:00 2001
From: eol95 <bragin.egor.95@gmail.com>
Date: Thu, 11 Apr 2019 16:35:27 +0500
Subject: [PATCH 037/272] Fix error passing "data" option to Cookie constructor

fixes #648
closes #649
---
 HISTORY.md        | 5 +++++
 session/cookie.js | 4 +++-
 test/cookie.js    | 9 +++++++++
 3 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index aca5825e..9eee06f9 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Fix error passing `data` option to `Cookie` constructor
+
 1.16.0 / 2019-04-10
 ===================
 
diff --git a/session/cookie.js b/session/cookie.js
index 3197d272..a8b4e570 100644
--- a/session/cookie.js
+++ b/session/cookie.js
@@ -33,7 +33,9 @@ var Cookie = module.exports = function Cookie(options) {
     }
 
     for (var key in options) {
-      this[key] = options[key]
+      if (key !== 'data') {
+        this[key] = options[key]
+      }
     }
   }
 
diff --git a/test/cookie.js b/test/cookie.js
index 4cca87bb..b280dff1 100644
--- a/test/cookie.js
+++ b/test/cookie.js
@@ -44,6 +44,15 @@ describe('new Cookie()', function () {
       assert.throws(function () { new Cookie(function () {}) }, /argument options/)
     })
 
+    it('should ignore "data" option', function () {
+      var cookie = new Cookie({ data: { foo: 'bar' }, path: '/foo' })
+
+      assert.strictEqual(typeof cookie, 'object')
+      assert.strictEqual(typeof cookie.data, 'object')
+      assert.strictEqual(cookie.data.path, '/foo')
+      assert.notStrictEqual(cookie.data.foo, 'bar')
+    })
+
     describe('expires', function () {
       it('should set expires', function () {
         var expires = new Date(Date.now() + 60000)

From 85682a2a56c5bdbed8d7e7cd2cc5e1343c951af6 Mon Sep 17 00:00:00 2001
From: geekjob-ru <47718537+geekjob-ru@users.noreply.github.com>
Date: Thu, 21 Feb 2019 22:34:20 +0300
Subject: [PATCH 038/272] Fix uncaught error from bad session data

closes #634
---
 HISTORY.md        |  1 +
 index.js          | 51 ++++++++++++++++++++++++++---------------------
 session/memory.js | 18 +++++++++--------
 test/session.js   | 25 +++++++++++++++++++++++
 4 files changed, 64 insertions(+), 31 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 9eee06f9..e58674b8 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
   * Fix error passing `data` option to `Cookie` constructor
+  * Fix uncaught error from bad session data
 
 1.16.0 / 2019-04-10
 ===================
diff --git a/index.js b/index.js
index 1cd02f6e..24221b48 100644
--- a/index.js
+++ b/index.js
@@ -363,6 +363,19 @@ function session(options) {
       wrapmethods(req.session);
     }
 
+    // inflate the session
+    function inflate (req, sess) {
+      store.createSession(req, sess)
+      originalId = req.sessionID
+      originalHash = hash(sess)
+
+      if (!resaveSession) {
+        savedHash = originalHash
+      }
+
+      wrapmethods(req.session)
+    }
+
     // wrap session methods
     function wrapmethods(sess) {
       var _reload = sess.reload
@@ -460,34 +473,26 @@ function session(options) {
     debug('fetching %s', req.sessionID);
     store.get(req.sessionID, function(err, sess){
       // error handling
-      if (err) {
+      if (err && err.code !== 'ENOENT') {
         debug('error %j', err);
+        next(err)
+        return
+      }
 
-        if (err.code !== 'ENOENT') {
-          next(err);
-          return;
-        }
-
-        generate();
-      // no session
-      } else if (!sess) {
-        debug('no session found');
-        generate();
-      // populate req.session
-      } else {
-        debug('session found');
-        store.createSession(req, sess);
-        originalId = req.sessionID;
-        originalHash = hash(sess);
-
-        if (!resaveSession) {
-          savedHash = originalHash
+      try {
+        if (err || !sess) {
+          debug('no session found')
+          generate()
+        } else {
+          debug('session found')
+          inflate(req, sess)
         }
-
-        wrapmethods(req.session);
+      } catch (e) {
+        next(e)
+        return
       }
 
-      next();
+      next()
     });
   };
 };
diff --git a/session/memory.js b/session/memory.js
index 25252b6c..11ed686c 100644
--- a/session/memory.js
+++ b/session/memory.js
@@ -171,14 +171,16 @@ function getSession(sessionId) {
   // parse
   sess = JSON.parse(sess)
 
-  var expires = typeof sess.cookie.expires === 'string'
-    ? new Date(sess.cookie.expires)
-    : sess.cookie.expires
-
-  // destroy expired session
-  if (expires && expires <= Date.now()) {
-    delete this.sessions[sessionId]
-    return
+  if (sess.cookie) {
+    var expires = typeof sess.cookie.expires === 'string'
+      ? new Date(sess.cookie.expires)
+      : sess.cookie.expires
+
+    // destroy expired session
+    if (expires && expires <= Date.now()) {
+      delete this.sessions[sessionId]
+      return
+    }
   }
 
   return sess
diff --git a/test/session.js b/test/session.js
index 383a3024..437baf0e 100644
--- a/test/session.js
+++ b/test/session.js
@@ -610,6 +610,31 @@ describe('session()', function(){
     })
   })
 
+  describe('when session without cookie property in store', function () {
+    it('should pass error from inflate', function (done) {
+      var count = 0
+      var store = new session.MemoryStore()
+      var server = createServer({ store: store }, function (req, res) {
+        req.session.num = req.session.num || ++count
+        res.end('session ' + req.session.num)
+      })
+
+      request(server)
+      .get('/')
+      .expect(shouldSetCookie('connect.sid'))
+      .expect(200, 'session 1', function (err, res) {
+        if (err) return done(err)
+        store.set(sid(res), { foo: 'bar' }, function (err) {
+          if (err) return done(err)
+          request(server)
+          .get('/')
+          .set('Cookie', cookie(res))
+          .expect(500, /Cannot read property/, done)
+        })
+      })
+    })
+  })
+
   describe('proxy option', function(){
     describe('when enabled', function(){
       var server

From 421bb3f320b2bbbb6f5ff386666ecd574a53fec6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 11 Apr 2019 12:14:05 -0400
Subject: [PATCH 039/272] 1.16.1

---
 HISTORY.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index e58674b8..b842fbe3 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+1.16.1 / 2019-04-11
+===================
 
   * Fix error passing `data` option to `Cookie` constructor
   * Fix uncaught error from bad session data
diff --git a/package.json b/package.json
index c0787d66..6e1ef2b9 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.16.0",
+  "version": "1.16.1",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From 5d2e4ec6a9241f634e629e0ff4cf5765236ed24d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 21 Apr 2019 18:04:22 -0400
Subject: [PATCH 040/272] build: mocha@6.1.4

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 6e1ef2b9..8cc2d597 100644
--- a/package.json
+++ b/package.json
@@ -26,7 +26,7 @@
     "eslint-plugin-markdown": "1.0.0",
     "express": "4.16.4",
     "istanbul": "0.4.5",
-    "mocha": "6.1.2",
+    "mocha": "6.1.4",
     "supertest": "4.0.2"
   },
   "files": [

From 072f0b11834186791a303d0cb7392d9fc53f7e3d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 21 Apr 2019 18:09:19 -0400
Subject: [PATCH 041/272] deps: parseurl@~1.3.3

---
 HISTORY.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index b842fbe3..a5cd3507 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * deps: parseurl@~1.3.3
+
 1.16.1 / 2019-04-11
 ===================
 
diff --git a/package.json b/package.json
index 8cc2d597..60b3df93 100644
--- a/package.json
+++ b/package.json
@@ -15,7 +15,7 @@
     "debug": "2.6.9",
     "depd": "~2.0.0",
     "on-headers": "~1.0.2",
-    "parseurl": "~1.3.2",
+    "parseurl": "~1.3.3",
     "safe-buffer": "5.1.2",
     "uid-safe": "~2.1.5"
   },

From cc3d51bd87566b4d7dd85fe46537957c9b618608 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 24 Apr 2019 11:47:51 -0400
Subject: [PATCH 042/272] lint: add linter for session store readme list

---
 README.md              | 92 ++++++++++++++++++++---------------------
 package.json           |  2 +-
 scripts/lint-readme.js | 93 ++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 140 insertions(+), 47 deletions(-)
 create mode 100644 scripts/lint-readme.js

diff --git a/README.md b/README.md
index 48c1ab1e..7b39aafb 100644
--- a/README.md
+++ b/README.md
@@ -543,7 +543,7 @@ and other multi-core embedded devices).
 
 [![★][connect-dynamodb-image] connect-dynamodb][connect-dynamodb-url] A DynamoDB-based session store.
 
-[connect-dynamodb-url]: https://github.com/ca98am79/connect-dynamodb
+[connect-dynamodb-url]: https://www.npmjs.com/package/connect-dynamodb
 [connect-dynamodb-image]: https://badgen.net/github/stars/ca98am79/connect-dynamodb?label=%E2%98%85
 
 [![★][connect-loki-image] connect-loki][connect-loki-url] A Loki.js-based session store.
@@ -551,16 +551,22 @@ and other multi-core embedded devices).
 [connect-loki-url]: https://www.npmjs.com/package/connect-loki
 [connect-loki-image]: https://badgen.net/github/stars/Requarks/connect-loki?label=%E2%98%85
 
+[![★][connect-memcached-image] connect-memcached][connect-memcached-url] A memcached-based session store.
+
+[connect-memcached-url]: https://www.npmjs.com/package/connect-memcached
+[connect-memcached-image]: https://badgen.net/github/stars/balor/connect-memcached?label=%E2%98%85
+
+[![★][connect-memjs-image] connect-memjs][connect-memjs-url] A memcached-based session store using
+[memjs](https://www.npmjs.com/package/memjs) as the memcached client.
+
+[connect-memjs-url]: https://www.npmjs.com/package/connect-memjs
+[connect-memjs-image]: https://badgen.net/github/stars/liamdon/connect-memjs?label=%E2%98%85
+
 [![★][connect-ml-image] connect-ml][connect-ml-url] A MarkLogic Server-based session store.
 
 [connect-ml-url]: https://www.npmjs.com/package/connect-ml
 [connect-ml-image]: https://badgen.net/github/stars/bluetorch/connect-ml?label=%E2%98%85
 
-[![★][connect-mssql-image] connect-mssql][connect-mssql-url] A SQL Server-based session store.
-
-[connect-mssql-url]: https://www.npmjs.com/package/connect-mssql
-[connect-mssql-image]: https://badgen.net/github/stars/patriksimek/connect-mssql?label=%E2%98%85
-
 [![★][connect-monetdb-image] connect-monetdb][connect-monetdb-url] A MonetDB-based session store.
 
 [connect-monetdb-url]: https://www.npmjs.com/package/connect-monetdb
@@ -576,6 +582,11 @@ and other multi-core embedded devices).
 [connect-mongodb-session-url]: https://www.npmjs.com/package/connect-mongodb-session
 [connect-mongodb-session-image]: https://badgen.net/github/stars/mongodb-js/connect-mongodb-session?label=%E2%98%85
 
+[![★][connect-mssql-image] connect-mssql][connect-mssql-url] A SQL Server-based session store.
+
+[connect-mssql-url]: https://www.npmjs.com/package/connect-mssql
+[connect-mssql-image]: https://badgen.net/github/stars/patriksimek/connect-mssql?label=%E2%98%85
+
 [![★][connect-pg-simple-image] connect-pg-simple][connect-pg-simple-url] A PostgreSQL-based session store.
 
 [connect-pg-simple-url]: https://www.npmjs.com/package/connect-pg-simple
@@ -586,17 +597,6 @@ and other multi-core embedded devices).
 [connect-redis-url]: https://www.npmjs.com/package/connect-redis
 [connect-redis-image]: https://badgen.net/github/stars/tj/connect-redis?label=%E2%98%85
 
-[![★][connect-memcached-image] connect-memcached][connect-memcached-url] A memcached-based session store.
-
-[connect-memcached-url]: https://www.npmjs.com/package/connect-memcached
-[connect-memcached-image]: https://badgen.net/github/stars/balor/connect-memcached?label=%E2%98%85
-
-[![★][connect-memjs-image] connect-memjs][connect-memjs-url] A memcached-based session store using
-[memjs](https://www.npmjs.com/package/memjs) as the memcached client.
-
-[connect-memjs-url]: https://www.npmjs.com/package/connect-memjs
-[connect-memjs-image]: https://badgen.net/github/stars/liamdon/connect-memjs?label=%E2%98%85
-
 [![★][connect-session-firebase-image] connect-session-firebase][connect-session-firebase-url] A session store based on the [Firebase Realtime Database](https://firebase.google.com/docs/database/)
 
 [connect-session-firebase-url]: https://www.npmjs.com/package/connect-session-firebase
@@ -614,48 +614,48 @@ and other multi-core embedded devices).
 [connect-session-sequelize-url]: https://www.npmjs.com/package/connect-session-sequelize
 [connect-session-sequelize-image]: https://badgen.net/github/stars/mweibel/connect-session-sequelize?label=%E2%98%85
 
+[![★][connect-sqlite3-image] connect-sqlite3][connect-sqlite3-url] A [SQLite3](https://github.com/mapbox/node-sqlite3) session store modeled after the TJ's `connect-redis` store.
+
+[connect-sqlite3-url]: https://www.npmjs.com/package/connect-sqlite3
+[connect-sqlite3-image]: https://badgen.net/github/stars/rawberg/connect-sqlite3?label=%E2%98%85
+
 [![★][couchdb-expression-image] couchdb-expression][couchdb-expression-url] A [CouchDB](https://couchdb.apache.org/)-based session store.
 
 [couchdb-expression-url]: https://www.npmjs.com/package/couchdb-expression
 [couchdb-expression-image]: https://badgen.net/github/stars/tkshnwesper/couchdb-expression?label=%E2%98%85
 
+[![★][documentdb-session-image] documentdb-session][documentdb-session-url] A session store for Microsoft Azure's [DocumentDB](https://azure.microsoft.com/en-us/services/documentdb/) NoSQL database service.
+
+[documentdb-session-url]: https://www.npmjs.com/package/documentdb-session
+[documentdb-session-image]: https://badgen.net/github/stars/dwhieb/documentdb-session?label=%E2%98%85
+
 [![★][dynamodb-store-image] dynamodb-store][dynamodb-store-url] A DynamoDB-based session store.
 
 [dynamodb-store-url]: https://www.npmjs.com/package/dynamodb-store
 [dynamodb-store-image]: https://badgen.net/github/stars/rafaelrpinto/dynamodb-store?label=%E2%98%85
 
+[![★][express-etcd-image] express-etcd][express-etcd-url] An [etcd](https://github.com/stianeikeland/node-etcd) based session store.
+
+[express-etcd-url]: https://www.npmjs.com/package/express-etcd
+[express-etcd-image]: https://badgen.net/github/stars/gildean/express-etcd?label=%E2%98%85
+
 [![★][express-mysql-session-image] express-mysql-session][express-mysql-session-url] A session store using native
 [MySQL](https://www.mysql.com/) via the [node-mysql](https://github.com/felixge/node-mysql) module.
 
 [express-mysql-session-url]: https://www.npmjs.com/package/express-mysql-session
 [express-mysql-session-image]: https://badgen.net/github/stars/chill117/express-mysql-session?label=%E2%98%85
 
+[![★][express-nedb-session-image] express-nedb-session][express-nedb-session-url] A NeDB-based session store.
+
+[express-nedb-session-url]: https://www.npmjs.com/package/express-nedb-session
+[express-nedb-session-image]: https://badgen.net/github/stars/louischatriot/express-nedb-session?label=%E2%98%85
+
 [![★][express-oracle-session-image] express-oracle-session][express-oracle-session-url] A session store using native
 [oracle](https://www.oracle.com/) via the [node-oracledb](https://www.npmjs.com/package/oracledb) module.
 
 [express-oracle-session-url]: https://www.npmjs.com/package/express-oracle-session
 [express-oracle-session-image]: https://badgen.net/github/stars/slumber86/express-oracle-session?label=%E2%98%85
 
-[![★][express-sessions-image] express-sessions][express-sessions-url]: A session store supporting both MongoDB and Redis.
-
-[express-sessions-url]: https://www.npmjs.com/package/express-sessions
-[express-sessions-image]: https://badgen.net/github/stars/konteck/express-sessions?label=%E2%98%85
-
-[![★][connect-sqlite3-image] connect-sqlite3][connect-sqlite3-url] A [SQLite3](https://github.com/mapbox/node-sqlite3) session store modeled after the TJ's `connect-redis` store.
-
-[connect-sqlite3-url]: https://www.npmjs.com/package/connect-sqlite3
-[connect-sqlite3-image]: https://badgen.net/github/stars/rawberg/connect-sqlite3?label=%E2%98%85
-
-[![★][documentdb-session-image] documentdb-session][documentdb-session-url] A session store for Microsoft Azure's [DocumentDB](https://azure.microsoft.com/en-us/services/documentdb/) NoSQL database service.
-
-[documentdb-session-url]: https://www.npmjs.com/package/documentdb-session
-[documentdb-session-image]: https://badgen.net/github/stars/dwhieb/documentdb-session?label=%E2%98%85
-
-[![★][express-nedb-session-image] express-nedb-session][express-nedb-session-url] A NeDB-based session store.
-
-[express-nedb-session-url]: https://www.npmjs.com/package/express-nedb-session
-[express-nedb-session-image]: https://badgen.net/github/stars/louischatriot/express-nedb-session?label=%E2%98%85
-
 [![★][express-session-cache-manager-image] express-session-cache-manager][express-session-cache-manager-url]
 A store that implements [cache-manager](https://www.npmjs.com/package/cache-manager), which supports
 a [variety of storage types](https://www.npmjs.com/package/cache-manager#store-engines).
@@ -663,24 +663,24 @@ a [variety of storage types](https://www.npmjs.com/package/cache-manager#store-e
 [express-session-cache-manager-url]: https://www.npmjs.com/package/express-session-cache-manager
 [express-session-cache-manager-image]: https://badgen.net/github/stars/theogravity/express-session-cache-manager?label=%E2%98%85
 
+[![★][express-session-etcd3-image] express-session-etcd3][express-session-etcd3-url] An [etcd3](https://github.com/mixer/etcd3) based session store.
+
+[express-session-etcd3-url]: https://www.npmjs.com/package/express-session-etcd3
+[express-session-etcd3-image]: https://badgen.net/github/stars/willgm/express-session-etcd3?label=%E2%98%85
+
 [![★][express-session-level-image] express-session-level][express-session-level-url] A [LevelDB](https://github.com/Level/levelup) based session store.
 
 [express-session-level-url]: https://www.npmjs.com/package/express-session-level
 [express-session-level-image]: https://badgen.net/github/stars/tgohn/express-session-level?label=%E2%98%85
 
-[![★][express-etcd-image] express-etcd][express-etcd-url] An [etcd](https://github.com/stianeikeland/node-etcd) based session store.
-
-[express-etcd-url]: https://www.npmjs.com/package/express-etcd
-[express-etcd-image]: https://badgen.net/github/stars/gildean/express-etcd?label=%E2%98%85
-
-[![★][express-session-etcd3-image] express-session-etcd3][express-session-etcd3-url] An [etcd3](https://github.com/mixer/etcd3) based session store.
+[![★][express-sessions-image] express-sessions][express-sessions-url] A session store supporting both MongoDB and Redis.
 
-[express-session-etcd3-url]: https://www.npmjs.com/package/express-session-etcd3
-[express-session-etcd3-image]: https://badgen.net/github/stars/willgm/express-session-etcd3?label=%E2%98%85
+[express-sessions-url]: https://www.npmjs.com/package/express-sessions
+[express-sessions-image]: https://badgen.net/github/stars/konteck/express-sessions?label=%E2%98%85
 
 [![★][firestore-store-image] firestore-store][firestore-store-url] A [Firestore](https://github.com/hendrysadrak/firestore-store)-based session store.
 
-[firestore-store-url]: https://github.com/hendrysadrak/firestore-store
+[firestore-store-url]: https://www.npmjs.com/package/firestore-store
 [firestore-store-image]: https://badgen.net/github/stars/hendrysadrak/firestore-store?label=%E2%98%85
 
 [![★][fortune-session-image] fortune-session][fortune-session-url] A [Fortune.js](https://github.com/fortunejs/fortune)
diff --git a/package.json b/package.json
index 60b3df93..c6543b84 100644
--- a/package.json
+++ b/package.json
@@ -39,7 +39,7 @@
     "node": ">= 0.8.0"
   },
   "scripts": {
-    "lint": "eslint --plugin markdown --ext js,md .",
+    "lint": "eslint --plugin markdown --ext js,md . && node ./scripts/lint-readme.js",
     "test": "mocha --require test/support/env --check-leaks --bail --no-exit --reporter spec test/",
     "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --check-leaks --no-exit --reporter dot test/",
     "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --check-leaks --no-exit --reporter spec test/",
diff --git a/scripts/lint-readme.js b/scripts/lint-readme.js
new file mode 100644
index 00000000..a93129e2
--- /dev/null
+++ b/scripts/lint-readme.js
@@ -0,0 +1,93 @@
+var assert = require('assert')
+var fs = require('fs')
+var path = require('path')
+
+var BADGE_STAR_LINK_REGEXP = /^https:\/\/badgen.net\/github\/stars\/[^/]+\/[^/]+?label=%E2%98%85$/
+var MARKDOWN_LINK_REGEXP = /^\[([^ \]]+)\]: ([^ ]+)$/
+var MARKDOWN_SECTION_REGEXP = /^#+ (.+)$/
+var NEWLINE_REGEXP = /\r?\n/
+var README_PATH = path.join(__dirname, '..', 'README.md')
+var README_CONTENTS = fs.readFileSync(README_PATH, 'utf-8')
+var STORE_HEADER_REGEXP = /^\[!\[★\]\[([^ \]]+)\] ([^ \]]+)\]\[([^ \]]+)\](?: .+)?$/
+
+var header = null
+var lintedStores = false
+var section = null
+var state = 0
+
+README_CONTENTS.split(NEWLINE_REGEXP).forEach(function (line, lineidx) {
+  section = (MARKDOWN_SECTION_REGEXP.exec(line) || [])[1] || section
+
+  if (section === 'Compatible Session Stores') {
+    lintedStores = true
+
+    switch (state) {
+      case 0: // premble
+        if (line[0] !== '[') break
+        state = 1
+      case 1: // header
+        var prev = header
+
+        if (!(header = STORE_HEADER_REGEXP.exec(line))) {
+          expect(lineidx, 'session store header', line)
+        } else if (prev && prev[2].replace(/^[^/]+\//, '').localeCompare(header[2].replace(/^[^/]+\//, '')) > 0) {
+          expect(lineidx, (header[2] + ' to be alphabetically after ' + prev[2]), line)
+          state = 2
+        } else {
+          state = 2
+        }
+
+        break
+      case 2: // blank line
+        if (line && MARKDOWN_LINK_REGEXP.test(line)) {
+          expect(lineidx, 'blank line or wrapped description', line)
+        } else if (line === '') {
+          state = 3
+        }
+        break
+      case 3: // url link
+        var urlLink = MARKDOWN_LINK_REGEXP.exec(line)
+
+        if (!urlLink) {
+          expect(lineidx, 'link reference', line)
+        } else if (urlLink[1] !== header[3]) {
+          expect(lineidx, ('link name of ' + header[3]), line)
+        } else if (urlLink[2] !== ('https://www.npmjs.com/package/' + header[2])) {
+          expect(lineidx, ('link url of https://www.npmjs.com/package/' + header[2]), line)
+        } else {
+          state = 4
+        }
+
+        break
+      case 4: // image link
+        var imageLink = MARKDOWN_LINK_REGEXP.exec(line)
+
+        if (!imageLink) {
+          expect(lineidx, 'link reference', line)
+        } else if (imageLink[1] !== header[1]) {
+          expect(lineidx, ('link name of ' + header[1]), line)
+        } else if (!BADGE_STAR_LINK_REGEXP.test(imageLink[2])) {
+          expect(lineidx, ('link url to github stars badge'), line)
+        } else {
+          state = 5
+        }
+
+        break
+      case 5: // blank line
+        if (line !== '') {
+          expect(lineidx, 'blank line after links', line)
+        } else {
+          state = 1
+        }
+        break
+    }
+  }
+})
+
+assert.ok(lintedStores, 'Compatible Session Stores section linted')
+
+function expect (lineidx, message, line) {
+  console.log('Expected %s on line %d', message, (lineidx + 1))
+  console.log('  Got: %s', line)
+  process.exitCode = 1
+}

From 1588ef6c0903469c48355f7a3a867591b7864357 Mon Sep 17 00:00:00 2001
From: Huseyin BABAL <huseyinbabal88@gmail.com>
Date: Tue, 23 Apr 2019 12:59:55 +0300
Subject: [PATCH 043/272] docs: add connect-hazelcast to the list of session
 stores

closes #654
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 7b39aafb..f89453ae 100644
--- a/README.md
+++ b/README.md
@@ -546,6 +546,11 @@ and other multi-core embedded devices).
 [connect-dynamodb-url]: https://www.npmjs.com/package/connect-dynamodb
 [connect-dynamodb-image]: https://badgen.net/github/stars/ca98am79/connect-dynamodb?label=%E2%98%85
 
+[![★][connect-hazelcast-image] connect-hazelcast][connect-hazelcast-url] Hazelcast session store for Connect and Express.
+
+[connect-hazelcast-url]: https://www.npmjs.com/package/connect-hazelcast
+[connect-hazelcast-image]: https://badgen.net/github/stars/huseyinbabal/connect-hazelcast?label=%E2%98%85
+
 [![★][connect-loki-image] connect-loki][connect-loki-url] A Loki.js-based session store.
 
 [connect-loki-url]: https://www.npmjs.com/package/connect-loki

From 3d5fa06375ea649e37b63dd0202c85e112db4f98 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 24 Apr 2019 14:29:49 -0400
Subject: [PATCH 044/272] build: use nyc for coverage testing

---
 .eslintignore |  1 +
 .gitignore    |  1 +
 .travis.yml   | 14 ++++++++------
 package.json  |  6 +++---
 4 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/.eslintignore b/.eslintignore
index 62562b74..76b1021d 100644
--- a/.eslintignore
+++ b/.eslintignore
@@ -1,2 +1,3 @@
+.nyc_output
 coverage
 node_modules
diff --git a/.gitignore b/.gitignore
index 84a48637..207febba 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
+.nyc_output
 coverage
 node_modules
 npm-debug.log
diff --git a/.travis.yml b/.travis.yml
index c2fd08f1..531f9a6a 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -60,16 +60,18 @@ before_install:
     # Configure eslint for linting
     if node_version_lt '4.0'; then npm_remove_module_re '^eslint(-|$)'
     fi
-  - |
-    # Configure istanbul for coverage
-    if node_version_lt '0.10'; then npm_remove_module_re '^istanbul$'
-    fi
   - |
     # Configure mocha for testing
     if   node_version_lt '0.10'; then npm_use_module 'mocha' '2.5.3'
     elif node_version_lt '4.0' ; then npm_use_module 'mocha' '3.5.3'
     elif node_version_lt '6.0' ; then npm_use_module 'mocha' '5.2.0'
     fi
+  - |
+    # Configure nyc for coverage
+    if   node_version_lt '0.10'; then npm_remove_module_re '^nyc$'
+    elif node_version_lt '4.0' ; then npm_use_module 'nyc' '10.3.2'
+    elif node_version_lt '6.0' ; then npm_use_module 'nyc' '11.9.0'
+    fi
   - |
     # Configure supertest for http calls
     if   node_version_lt '0.10'; then npm_use_module 'supertest' '1.1.0'
@@ -97,7 +99,7 @@ script:
 after_script:
   - |
     # Upload coverage to coveralls, if exists
-    if [[ -f ./coverage/lcov.info ]]; then
+    if [[ -d .nyc_output ]]; then
       npm install --save-dev coveralls@2
-      coveralls < ./coverage/lcov.info
+      nyc report --reporter=text-lcov | coveralls
     fi
diff --git a/package.json b/package.json
index c6543b84..a40271ee 100644
--- a/package.json
+++ b/package.json
@@ -25,8 +25,8 @@
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.0",
     "express": "4.16.4",
-    "istanbul": "0.4.5",
     "mocha": "6.1.4",
+    "nyc": "14.0.0",
     "supertest": "4.0.2"
   },
   "files": [
@@ -41,8 +41,8 @@
   "scripts": {
     "lint": "eslint --plugin markdown --ext js,md . && node ./scripts/lint-readme.js",
     "test": "mocha --require test/support/env --check-leaks --bail --no-exit --reporter spec test/",
-    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --check-leaks --no-exit --reporter dot test/",
-    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --check-leaks --no-exit --reporter spec test/",
+    "test-cov": "nyc npm test",
+    "test-travis": "nyc npm test -- --no-exit",
     "version": "node scripts/version-history.js && git add HISTORY.md"
   }
 }

From 268c929fb598a21dc5e4806c310d14039bcacf73 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 24 Apr 2019 14:58:58 -0400
Subject: [PATCH 045/272] build: Node.js@8.16

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 531f9a6a..13c8fdb2 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -10,7 +10,7 @@ node_js:
   - "5.12"
   - "6.17"
   - "7.10"
-  - "8.15"
+  - "8.16"
   - "9.11"
   - "10.15"
   - "11.13"

From 327695e3d1dd4d7a5d3857f2afbb5852b7710213 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 24 Apr 2019 14:59:24 -0400
Subject: [PATCH 046/272] build: Node.js@11.14

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 13c8fdb2..5cc7b7fb 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -13,7 +13,7 @@ node_js:
   - "8.16"
   - "9.11"
   - "10.15"
-  - "11.13"
+  - "11.14"
 sudo: false
 cache:
   directories:

From e0feb046108642d190facf18e59e05ab80213419 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 13 May 2019 18:30:53 -0400
Subject: [PATCH 047/272] build: support Node.js 12.x

---
 .travis.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.travis.yml b/.travis.yml
index 5cc7b7fb..e483a9a0 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -14,6 +14,7 @@ node_js:
   - "9.11"
   - "10.15"
   - "11.14"
+  - "12.2"
 sudo: false
 cache:
   directories:

From 8d6430e7df82a7b9bd29ca100bbfacc0ed530b67 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 13 May 2019 18:38:08 -0400
Subject: [PATCH 048/272] build: nyc@14.1.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index a40271ee..b03fe961 100644
--- a/package.json
+++ b/package.json
@@ -26,7 +26,7 @@
     "eslint-plugin-markdown": "1.0.0",
     "express": "4.16.4",
     "mocha": "6.1.4",
-    "nyc": "14.0.0",
+    "nyc": "14.1.1",
     "supertest": "4.0.2"
   },
   "files": [

From 969e4c19d8439f2c6a73a9793a8bb08a84c246a3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 4 Jun 2019 19:03:22 -0400
Subject: [PATCH 049/272] build: express@4.17.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index b03fe961..19488f15 100644
--- a/package.json
+++ b/package.json
@@ -24,7 +24,7 @@
     "cookie-parser": "1.4.4",
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.0",
-    "express": "4.16.4",
+    "express": "4.17.1",
     "mocha": "6.1.4",
     "nyc": "14.1.1",
     "supertest": "4.0.2"

From ad90250d77685890b422990cb274544a3655815f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 4 Jun 2019 19:09:58 -0400
Subject: [PATCH 050/272] build: Node.js@10.16

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index e483a9a0..069b7d5b 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -12,7 +12,7 @@ node_js:
   - "7.10"
   - "8.16"
   - "9.11"
-  - "10.15"
+  - "10.16"
   - "11.14"
   - "12.2"
 sudo: false

From 1c75fa049e363449cb52b4aacfed83b95e375356 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 5 Jun 2019 00:01:28 -0400
Subject: [PATCH 051/272] build: Node.js@11.15

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 069b7d5b..485800b5 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -13,7 +13,7 @@ node_js:
   - "8.16"
   - "9.11"
   - "10.16"
-  - "11.14"
+  - "11.15"
   - "12.2"
 sudo: false
 cache:

From fb498ace8946307decc5da5f564cc09ba8227fef Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 5 Jun 2019 00:05:58 -0400
Subject: [PATCH 052/272] build: Node.js@12.4

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 485800b5..8c857819 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -14,7 +14,7 @@ node_js:
   - "9.11"
   - "10.16"
   - "11.15"
-  - "12.2"
+  - "12.4"
 sudo: false
 cache:
   directories:

From bff097ef16ef02bebe0862ac1508c98e2da012e3 Mon Sep 17 00:00:00 2001
From: Ravi van Rooijen <ravivanrooijen@live.nl>
Date: Sat, 4 May 2019 02:14:12 +0200
Subject: [PATCH 053/272] docs: add connect-typeorm to the list of session
 stores

closes #658
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index f89453ae..97c9bd2f 100644
--- a/README.md
+++ b/README.md
@@ -624,6 +624,11 @@ and other multi-core embedded devices).
 [connect-sqlite3-url]: https://www.npmjs.com/package/connect-sqlite3
 [connect-sqlite3-image]: https://badgen.net/github/stars/rawberg/connect-sqlite3?label=%E2%98%85
 
+[![★][connect-typeorm-image] connect-typeorm][connect-typeorm-url] A [TypeORM](https://github.com/typeorm/typeorm)-based session store.
+
+[connect-typeorm-url]: https://www.npmjs.com/package/connect-typeorm
+[connect-typeorm-image]: https://badgen.net/github/stars/makepost/connect-typeorm?label=%E2%98%85
+
 [![★][couchdb-expression-image] couchdb-expression][couchdb-expression-url] A [CouchDB](https://couchdb.apache.org/)-based session store.
 
 [couchdb-expression-url]: https://www.npmjs.com/package/couchdb-expression

From 97fe63cd024e9227f05923d1f65d3c48f6bffdad Mon Sep 17 00:00:00 2001
From: "F. Hinkelmann" <franziska.hinkelmann@gmail.com>
Date: Thu, 30 May 2019 04:47:49 -0400
Subject: [PATCH 054/272] docs: add @google-cloud/connect-firestore to the list
 of session stores

closes #665
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 97c9bd2f..60163a70 100644
--- a/README.md
+++ b/README.md
@@ -546,6 +546,11 @@ and other multi-core embedded devices).
 [connect-dynamodb-url]: https://www.npmjs.com/package/connect-dynamodb
 [connect-dynamodb-image]: https://badgen.net/github/stars/ca98am79/connect-dynamodb?label=%E2%98%85
 
+[![★][@google-cloud/connect-firestore-image] @google-cloud/connect-firestore][@google-cloud/connect-firestore-url] A [Google Cloud Firestore](https://cloud.google.com/firestore/docs/overview)-based session store.
+
+[@google-cloud/connect-firestore-url]: https://www.npmjs.com/package/@google-cloud/connect-firestore
+[@google-cloud/connect-firestore-image]: https://badgen.net/github/stars/googleapis/nodejs-firestore-session?label=%E2%98%85
+
 [![★][connect-hazelcast-image] connect-hazelcast][connect-hazelcast-url] Hazelcast session store for Connect and Express.
 
 [connect-hazelcast-url]: https://www.npmjs.com/package/connect-hazelcast

From 479940afd22a0b939eaee3997f883408d2e41bec Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 12 Jun 2019 00:07:59 -0400
Subject: [PATCH 055/272] tests: add cookie.originalMaxAge tests

---
 test/session.js | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/test/session.js b/test/session.js
index 437baf0e..fe503c0a 100644
--- a/test/session.js
+++ b/test/session.js
@@ -1850,6 +1850,37 @@ describe('session()', function(){
         })
       })
 
+      describe('.originalMaxAge', function () {
+        before(function () {
+          this.server = createServer({ cookie: { maxAge: 2000 } }, function (req, res) {
+            req.session.hits = (req.session.hits || 0) + 1
+            res.end(JSON.stringify(req.session.cookie.originalMaxAge))
+          })
+        })
+
+        it('should equal original maxAge', function (done) {
+          request(this.server)
+            .get('/')
+            .expect(200, '2000', done)
+        })
+
+        it('should equal original maxAge for all requests', function (done) {
+          var server = this.server
+
+          request(server)
+            .get('/')
+            .expect(200, '2000', function (err, res) {
+              if (err) return done(err)
+              setTimeout(function () {
+                request(server)
+                  .get('/')
+                  .set('Cookie', cookie(res))
+                  .expect(200, '2000', done)
+              }, 100)
+            })
+        })
+      })
+
       describe('.secure', function(){
         var app
 

From 30e23f1343d3912bc3e3715792ee8ddca694e9b8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Janusz=20Bia=C5=82obrzewski?= <jbialobr@o2.pl>
Date: Thu, 30 May 2019 09:58:08 +0200
Subject: [PATCH 056/272] Fix restoring cookie.originalMaxAge when store
 returns Date

fixes #664
---
 HISTORY.md                  |  1 +
 session/store.js            |  7 ++---
 test/session.js             | 33 ++++++++++++++++++-----
 test/support/smart-store.js | 54 +++++++++++++++++++++++++++++++++++++
 4 files changed, 85 insertions(+), 10 deletions(-)
 create mode 100644 test/support/smart-store.js

diff --git a/HISTORY.md b/HISTORY.md
index a5cd3507..3d1533ee 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Fix restoring `cookie.originalMaxAge` when store returns `Date`
   * deps: parseurl@~1.3.3
 
 1.16.1 / 2019-04-11
diff --git a/session/store.js b/session/store.js
index baefbf8d..3793877e 100644
--- a/session/store.js
+++ b/session/store.js
@@ -90,12 +90,13 @@ Store.prototype.createSession = function(req, sess){
   sess.cookie = new Cookie(sess.cookie);
 
   if (typeof expires === 'string') {
-    // convert expires to a Date object,
-    // keeping originalMaxAge intact
+    // convert expires to a Date object
     sess.cookie.expires = new Date(expires)
-    sess.cookie.originalMaxAge = originalMaxAge
   }
 
+  // keep originalMaxAge intact
+  sess.cookie.originalMaxAge = originalMaxAge
+
   req.session = new Session(req, sess);
   return req.session;
 };
diff --git a/test/session.js b/test/session.js
index fe503c0a..1e3b7124 100644
--- a/test/session.js
+++ b/test/session.js
@@ -8,6 +8,7 @@ var http = require('http')
 var https = require('https')
 var request = require('supertest')
 var session = require('../')
+var SmartStore = require('./support/smart-store')
 var SyncStore = require('./support/sync-store')
 var utils = require('./support/utils')
 
@@ -1851,21 +1852,39 @@ describe('session()', function(){
       })
 
       describe('.originalMaxAge', function () {
-        before(function () {
-          this.server = createServer({ cookie: { maxAge: 2000 } }, function (req, res) {
-            req.session.hits = (req.session.hits || 0) + 1
+        it('should equal original maxAge', function (done) {
+          var server = createServer({ cookie: { maxAge: 2000 } }, function (req, res) {
             res.end(JSON.stringify(req.session.cookie.originalMaxAge))
           })
-        })
 
-        it('should equal original maxAge', function (done) {
-          request(this.server)
+          request(server)
             .get('/')
             .expect(200, '2000', done)
         })
 
         it('should equal original maxAge for all requests', function (done) {
-          var server = this.server
+          var server = createServer({ cookie: { maxAge: 2000 } }, function (req, res) {
+            res.end(JSON.stringify(req.session.cookie.originalMaxAge))
+          })
+
+          request(server)
+            .get('/')
+            .expect(200, '2000', function (err, res) {
+              if (err) return done(err)
+              setTimeout(function () {
+                request(server)
+                  .get('/')
+                  .set('Cookie', cookie(res))
+                  .expect(200, '2000', done)
+              }, 100)
+            })
+        })
+
+        it('should equal original maxAge for all requests', function (done) {
+          var store = new SmartStore()
+          var server = createServer({ cookie: { maxAge: 2000 }, store: store }, function (req, res) {
+            res.end(JSON.stringify(req.session.cookie.originalMaxAge))
+          })
 
           request(server)
             .get('/')
diff --git a/test/support/smart-store.js b/test/support/smart-store.js
new file mode 100644
index 00000000..8b224fdd
--- /dev/null
+++ b/test/support/smart-store.js
@@ -0,0 +1,54 @@
+'use strict'
+
+var session = require('../../')
+var util = require('util')
+
+/* istanbul ignore next */
+var defer = typeof setImmediate === 'function'
+  ? setImmediate
+  : function(fn){ process.nextTick(fn.bind.apply(fn, arguments)) }
+
+module.exports = SmartStore
+
+function SmartStore () {
+  session.Store.call(this)
+  this.sessions = Object.create(null)
+}
+
+util.inherits(SmartStore, session.Store)
+
+SmartStore.prototype.destroy = function destroy (sid, callback) {
+  delete this.sessions[sid]
+  defer(callback, null)
+}
+
+SmartStore.prototype.get = function get (sid, callback) {
+  var sess = this.sessions[sid]
+
+  if (!sess) {
+    return
+  }
+
+  // parse
+  sess = JSON.parse(sess)
+
+  if (sess.cookie) {
+    // expand expires into Date object
+    sess.cookie.expires = typeof sess.cookie.expires === 'string'
+      ? new Date(sess.cookie.expires)
+      : sess.cookie.expires
+
+    // destroy expired session
+    if (sess.cookie.expires && sess.cookie.expires <= Date.now()) {
+      delete this.sessions[sid]
+      sess = null
+    }
+  }
+
+  defer(callback, null, sess)
+}
+
+SmartStore.prototype.set = function set (sid, sess, callback) {
+  this.sessions[sid] = JSON.stringify(sess)
+  defer(callback, null)
+}

From 2d54f0dca1506883bebc634fcb7135c2f02c47cd Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 12 Jun 2019 01:01:41 -0400
Subject: [PATCH 057/272] 1.16.2

---
 HISTORY.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 3d1533ee..f12dc39f 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+1.16.2 / 2019-06-12
+===================
 
   * Fix restoring `cookie.originalMaxAge` when store returns `Date`
   * deps: parseurl@~1.3.3
diff --git a/package.json b/package.json
index 19488f15..fffbd49f 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.16.1",
+  "version": "1.16.2",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From 6db8e04b92e18107c59f6eaf4e162bdaabd64f6a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 12 Aug 2019 20:03:10 -0400
Subject: [PATCH 058/272] build: mocha@6.2.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index fffbd49f..6e2af8b8 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.0",
     "express": "4.17.1",
-    "mocha": "6.1.4",
+    "mocha": "6.2.0",
     "nyc": "14.1.1",
     "supertest": "4.0.2"
   },

From 2719bef016b4ab5e8013402a5c0c2b13b188c6a2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 12 Aug 2019 20:09:09 -0400
Subject: [PATCH 059/272] build: Node.js@12.8

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 8c857819..afa837b3 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -14,7 +14,7 @@ node_js:
   - "9.11"
   - "10.16"
   - "11.15"
-  - "12.4"
+  - "12.8"
 sudo: false
 cache:
   directories:

From f75ed7eb6ce16426162d53ae8b588a999d589758 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 12 Aug 2019 20:13:09 -0400
Subject: [PATCH 060/272] build: fix readme lint out of order message

---
 scripts/lint-readme.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/lint-readme.js b/scripts/lint-readme.js
index a93129e2..f4c50d76 100644
--- a/scripts/lint-readme.js
+++ b/scripts/lint-readme.js
@@ -31,7 +31,7 @@ README_CONTENTS.split(NEWLINE_REGEXP).forEach(function (line, lineidx) {
         if (!(header = STORE_HEADER_REGEXP.exec(line))) {
           expect(lineidx, 'session store header', line)
         } else if (prev && prev[2].replace(/^[^/]+\//, '').localeCompare(header[2].replace(/^[^/]+\//, '')) > 0) {
-          expect(lineidx, (header[2] + ' to be alphabetically after ' + prev[2]), line)
+          expect(lineidx, (header[2] + ' to be alphabetically before ' + prev[2]), line)
           state = 2
         } else {
           state = 2

From 8de786571771d465a607f1b421b27dbbf566bbd0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Simon=20Rig=C3=A9t?= <simon.riget@gmail.com>
Date: Wed, 26 Jun 2019 23:13:01 +0200
Subject: [PATCH 061/272] docs: add express-session-rsdb to the list of session
 stores

closes #670
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 60163a70..959287c9 100644
--- a/README.md
+++ b/README.md
@@ -688,6 +688,11 @@ a [variety of storage types](https://www.npmjs.com/package/cache-manager#store-e
 [express-session-level-url]: https://www.npmjs.com/package/express-session-level
 [express-session-level-image]: https://badgen.net/github/stars/tgohn/express-session-level?label=%E2%98%85
 
+[![★][express-session-rsdb-image] express-session-rsdb][express-session-rsdb-url] Session store based on Rocket-Store: A very simple, super fast and yet powerfull, flat file database.
+
+[express-session-rsdb-url]: https://www.npmjs.com/package/express-session-rsdb
+[express-session-rsdb-image]: https://badgen.net/github/stars/paragi/express-session-rsdb?label=%E2%98%85
+
 [![★][express-sessions-image] express-sessions][express-sessions-url] A session store supporting both MongoDB and Redis.
 
 [express-sessions-url]: https://www.npmjs.com/package/express-sessions

From 1684c548b2dcb54c8c38474eae729c7edc54866c Mon Sep 17 00:00:00 2001
From: Scott MacLellan <scott.maclellan@vidyard.com>
Date: Tue, 16 Jul 2019 10:15:53 -0400
Subject: [PATCH 062/272] deps: cookie@0.4.0

closes #674
---
 HISTORY.md   | 6 ++++++
 README.md    | 6 ++++--
 package.json | 2 +-
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index f12dc39f..1bcd0a17 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,9 @@
+unreleased
+==========
+
+  * deps: cookie@0.4.0
+    - Add `SameSite=None` support
+
 1.16.2 / 2019-06-12
 ===================
 
diff --git a/README.md b/README.md
index 959287c9..19047d58 100644
--- a/README.md
+++ b/README.md
@@ -101,10 +101,11 @@ Specifies the `boolean` or `string` to be the value for the `SameSite` `Set-Cook
   - `true` will set the `SameSite` attribute to `Strict` for strict same site enforcement.
   - `false` will not set the `SameSite` attribute.
   - `'lax'` will set the `SameSite` attribute to `Lax` for lax same site enforcement.
+  - `'none'` will set the `SameSite` attribute to `None` for an explicit cross-site cookie.
   - `'strict'` will set the `SameSite` attribute to `Strict` for strict same site enforcement.
 
-More information about the different enforcement levels can be found in the specification
-https://tools.ietf.org/html/draft-west-first-party-cookies-07#section-4.1.1
+More information about the different enforcement levels can be found in
+[the specification][rfc-6265bis-03-4.1.2.7].
 
 **Note** This is an attribute that has not yet been fully standardized, and may change in
 the future. This also means many clients may ignore this attribute until they understand it.
@@ -818,6 +819,7 @@ app.get('/bar', function (req, res, next) {
 
 [MIT](LICENSE)
 
+[rfc-6265bis-03-4.1.2.7]: https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-03#section-4.1.2.7
 [coveralls-image]: https://badgen.net/coveralls/c/github/expressjs/session/master
 [coveralls-url]: https://coveralls.io/r/expressjs/session?branch=master
 [node-url]: https://nodejs.org/en/download
diff --git a/package.json b/package.json
index 6e2af8b8..1fad0d98 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,7 @@
   "repository": "expressjs/session",
   "license": "MIT",
   "dependencies": {
-    "cookie": "0.3.1",
+    "cookie": "0.4.0",
     "cookie-signature": "1.0.6",
     "debug": "2.6.9",
     "depd": "~2.0.0",

From 10607bdb780204b91a8cf90e4ce27726619b8285 Mon Sep 17 00:00:00 2001
From: Justin Nahin <justin@indospace.io>
Date: Wed, 10 Jul 2019 03:56:45 -0700
Subject: [PATCH 063/272] deps: safe-buffer@5.2.0

closes #672
---
 HISTORY.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index 1bcd0a17..559e362c 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -3,6 +3,7 @@ unreleased
 
   * deps: cookie@0.4.0
     - Add `SameSite=None` support
+  * deps: safe-buffer@5.2.0
 
 1.16.2 / 2019-06-12
 ===================
diff --git a/package.json b/package.json
index 1fad0d98..a8f34e4e 100644
--- a/package.json
+++ b/package.json
@@ -16,7 +16,7 @@
     "depd": "~2.0.0",
     "on-headers": "~1.0.2",
     "parseurl": "~1.3.3",
-    "safe-buffer": "5.1.2",
+    "safe-buffer": "5.2.0",
     "uid-safe": "~2.1.5"
   },
   "devDependencies": {

From 8731d7bdd9c4f0e455bd594cd16c075d993e4401 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 7 Oct 2019 22:41:19 -0400
Subject: [PATCH 064/272] build: Node.js@12.11

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index afa837b3..6eec393b 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -14,7 +14,7 @@ node_js:
   - "9.11"
   - "10.16"
   - "11.15"
-  - "12.8"
+  - "12.11"
 sudo: false
 cache:
   directories:

From 9c065098eb51a2a540c2f3d744a84b0941b70a56 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 7 Oct 2019 22:43:57 -0400
Subject: [PATCH 065/272] build: mocha@6.2.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index a8f34e4e..6d173184 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.0",
     "express": "4.17.1",
-    "mocha": "6.2.0",
+    "mocha": "6.2.1",
     "nyc": "14.1.1",
     "supertest": "4.0.2"
   },

From 9a5e31349e4274487d7f75ebe53fa78b3462894b Mon Sep 17 00:00:00 2001
From: fhellwig <frank@hellwig.org>
Date: Tue, 17 Sep 2019 09:36:58 -0400
Subject: [PATCH 066/272] docs: add lowdb-session-store to the list of session
 stores

closes #690
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 19047d58..c9eb012b 100644
--- a/README.md
+++ b/README.md
@@ -720,6 +720,11 @@ based session store. Supports all backends supported by Fortune (MongoDB, Redis,
 [level-session-store-url]: https://www.npmjs.com/package/level-session-store
 [level-session-store-image]: https://badgen.net/github/stars/toddself/level-session-store?label=%E2%98%85
 
+[![★][lowdb-session-store-image] lowdb-session-store][lowdb-session-store-url] A [lowdb](https://www.npmjs.com/package/lowdb)-based session store.
+
+[lowdb-session-store-url]: https://www.npmjs.com/package/lowdb-session-store
+[lowdb-session-store-image]: https://badgen.net/github/stars/fhellwig/lowdb-session-store?label=%E2%98%85
+
 [![★][medea-session-store-image] medea-session-store][medea-session-store-url] A Medea-based session store.
 
 [medea-session-store-url]: https://www.npmjs.com/package/medea-session-store

From c32ad191da9abba58e539fe1ce164536c6d65f67 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc=20Borntr=C3=A4ger?= <marc.borntraeger@gmail.com>
Date: Tue, 6 Aug 2019 13:07:17 +0200
Subject: [PATCH 067/272] docs: expand description of the rolling option

closes #677
---
 README.md | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index c9eb012b..a1ed3fa1 100644
--- a/README.md
+++ b/README.md
@@ -228,15 +228,24 @@ likely need `resave: true`.
 
 ##### rolling
 
-Force a session identifier cookie to be set on every response. The expiration
+Force the session identifier cookie to be set on every response. The expiration
 is reset to the original [`maxAge`](#cookiemaxage), resetting the expiration
 countdown.
 
 The default value is `false`.
 
+With this enabled, the session identifier cookie will expire in
+[`maxAge`](#cookiemaxage) since the last response was sent instead of in
+[`maxAge`](#cookiemaxage) since the session was last modified by the server.
+
+This is typically used in conjuction with short, non-session-length
+[`maxAge`](#cookiemaxage) values to provide a quick timeout of the session data
+with reduced potentional of it occurring during on going server interactions.
+
 **Note** When this option is set to `true` but the `saveUninitialized` option is
 set to `false`, the cookie will not be set on a response with an uninitialized
-session.
+session. This option only modifies the behavior when an existing session was
+loaded for the request.
 
 ##### saveUninitialized
 

From 4d253405aca773e3e994c0259a3bc658c22430e0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 8 Oct 2019 17:56:31 -0400
Subject: [PATCH 068/272] build: fix coverage reporting

---
 .travis.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 6eec393b..08d2fea7 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -89,8 +89,8 @@ before_install:
 
 script:
   - |
-    # Run test script, depending on istanbul install
-    if npm_module_installed 'istanbul'; then npm run-script test-travis
+    # Run test script, depending on nyc install
+    if npm_module_installed 'nyc'; then npm run-script test-travis
     else npm test
     fi
   - |

From b22384b712fea118f1c3eb5b0d79312ebd25e97c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 10 Oct 2019 22:59:50 -0400
Subject: [PATCH 069/272] 1.17.0

---
 HISTORY.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 559e362c..ccc03991 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+1.17.0 / 2019-10-10
+===================
 
   * deps: cookie@0.4.0
     - Add `SameSite=None` support
diff --git a/package.json b/package.json
index 6d173184..82ca06f3 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.16.2",
+  "version": "1.17.0",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From 9e1943303b6f7cb2bf83b2d215036bfb12d48065 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 29 Oct 2019 20:03:58 -0400
Subject: [PATCH 070/272] build: eslint-plugin-markdown@1.0.1

---
 .travis.yml  | 2 +-
 package.json | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 08d2fea7..d092ada1 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -59,7 +59,7 @@ before_install:
   # Setup Node.js version-specific dependencies
   - |
     # Configure eslint for linting
-    if node_version_lt '4.0'; then npm_remove_module_re '^eslint(-|$)'
+    if node_version_lt '6.0'; then npm_remove_module_re '^eslint(-|$)'
     fi
   - |
     # Configure mocha for testing
diff --git a/package.json b/package.json
index 82ca06f3..a652e78f 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,7 @@
     "after": "0.8.2",
     "cookie-parser": "1.4.4",
     "eslint": "3.19.0",
-    "eslint-plugin-markdown": "1.0.0",
+    "eslint-plugin-markdown": "1.0.1",
     "express": "4.17.1",
     "mocha": "6.2.1",
     "nyc": "14.1.1",

From 3281442df86f6f26f5d2cf9d6038f2d845784585 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 29 Oct 2019 20:08:00 -0400
Subject: [PATCH 071/272] build: mocha@6.2.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index a652e78f..e41e71b1 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.1",
     "express": "4.17.1",
-    "mocha": "6.2.1",
+    "mocha": "6.2.2",
     "nyc": "14.1.1",
     "supertest": "4.0.2"
   },

From 77a3d192ba8303be57e0b5652ceb9516da92f772 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 30 Oct 2019 00:21:06 -0400
Subject: [PATCH 072/272] build: Node.js@10.17

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index d092ada1..078ab9a5 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -12,7 +12,7 @@ node_js:
   - "7.10"
   - "8.16"
   - "9.11"
-  - "10.16"
+  - "10.17"
   - "11.15"
   - "12.11"
 sudo: false

From 7d071562ee5db3e00a484b302af40873dbb8e22a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 30 Oct 2019 00:24:55 -0400
Subject: [PATCH 073/272] build: Node.js@12.13

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 078ab9a5..5b763e29 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -14,7 +14,7 @@ node_js:
   - "9.11"
   - "10.17"
   - "11.15"
-  - "12.11"
+  - "12.13"
 sudo: false
 cache:
   directories:

From e18fb51d2d403bf3b5bd4e498f621dee4a52db41 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 8 Jan 2020 22:10:48 -0500
Subject: [PATCH 074/272] build: nyc@15.0.0

---
 .travis.yml  | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 5b763e29..c1c97986 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -72,6 +72,7 @@ before_install:
     if   node_version_lt '0.10'; then npm_remove_module_re '^nyc$'
     elif node_version_lt '4.0' ; then npm_use_module 'nyc' '10.3.2'
     elif node_version_lt '6.0' ; then npm_use_module 'nyc' '11.9.0'
+    elif node_version_lt '8.0' ; then npm_use_module 'nyc' '14.1.1'
     fi
   - |
     # Configure supertest for http calls
diff --git a/package.json b/package.json
index e41e71b1..e650cdeb 100644
--- a/package.json
+++ b/package.json
@@ -26,7 +26,7 @@
     "eslint-plugin-markdown": "1.0.1",
     "express": "4.17.1",
     "mocha": "6.2.2",
-    "nyc": "14.1.1",
+    "nyc": "15.0.0",
     "supertest": "4.0.2"
   },
   "files": [

From 4ea1ba33bc29b159f03deece1c6489af28f6e901 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 28 Jan 2020 22:34:45 -0500
Subject: [PATCH 075/272] build: mocha@7.0.1

---
 .travis.yml  | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index c1c97986..947febeb 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -66,6 +66,7 @@ before_install:
     if   node_version_lt '0.10'; then npm_use_module 'mocha' '2.5.3'
     elif node_version_lt '4.0' ; then npm_use_module 'mocha' '3.5.3'
     elif node_version_lt '6.0' ; then npm_use_module 'mocha' '5.2.0'
+    elif node_version_lt '8.0' ; then npm_use_module 'mocha' '6.2.2'
     fi
   - |
     # Configure nyc for coverage
diff --git a/package.json b/package.json
index e650cdeb..44c692e9 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.1",
     "express": "4.17.1",
-    "mocha": "6.2.2",
+    "mocha": "7.0.1",
     "nyc": "15.0.0",
     "supertest": "4.0.2"
   },

From adb11406b7d292b38085879185878164ec201b58 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 28 Jan 2020 22:39:55 -0500
Subject: [PATCH 076/272] build: Node.js@8.17

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 947febeb..d60cfc1e 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -10,7 +10,7 @@ node_js:
   - "5.12"
   - "6.17"
   - "7.10"
-  - "8.16"
+  - "8.17"
   - "9.11"
   - "10.17"
   - "11.15"

From c7849bcc3b4827f7749d722c05fd2157b739ec39 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 28 Jan 2020 22:43:44 -0500
Subject: [PATCH 077/272] build: Node.js@10.18

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index d60cfc1e..6f5f0169 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -12,7 +12,7 @@ node_js:
   - "7.10"
   - "8.17"
   - "9.11"
-  - "10.17"
+  - "10.18"
   - "11.15"
   - "12.13"
 sudo: false

From dfee1fad24d7d837bd99fec181babc35d6b14ae7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 29 Jan 2020 00:03:57 -0500
Subject: [PATCH 078/272] build: Node.js@12.14

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 6f5f0169..69074cc7 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -14,7 +14,7 @@ node_js:
   - "9.11"
   - "10.18"
   - "11.15"
-  - "12.13"
+  - "12.14"
 sudo: false
 cache:
   directories:

From 40a64089f00330d8f3b2f3ca9c157df5b68f235b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 29 Jan 2020 00:09:26 -0500
Subject: [PATCH 079/272] build: remove deprecated Travis CI directive

---
 .travis.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 69074cc7..fff4bc40 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -15,7 +15,6 @@ node_js:
   - "10.18"
   - "11.15"
   - "12.14"
-sudo: false
 cache:
   directories:
     - node_modules

From 0461302973bce4aba82c44f5a15ab388584161a4 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 2 Feb 2020 21:49:02 -0500
Subject: [PATCH 080/272] build: support Node.js 13.x

---
 .travis.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.travis.yml b/.travis.yml
index fff4bc40..5ec6c661 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -15,6 +15,7 @@ node_js:
   - "10.18"
   - "11.15"
   - "12.14"
+  - "13.7"
 cache:
   directories:
     - node_modules

From 99d21d16c2b344a58b318a2190b2f68899e58c58 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 27 Feb 2020 19:20:24 -0500
Subject: [PATCH 081/272] build: mocha@7.1.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 44c692e9..6ca5d7da 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.1",
     "express": "4.17.1",
-    "mocha": "7.0.1",
+    "mocha": "7.1.0",
     "nyc": "15.0.0",
     "supertest": "4.0.2"
   },

From e3c04a2691595768b8925107458a158eafcdc2f1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 27 Feb 2020 19:24:44 -0500
Subject: [PATCH 082/272] build: Node.js@13.9

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 5ec6c661..b5855359 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -15,7 +15,7 @@ node_js:
   - "10.18"
   - "11.15"
   - "12.14"
-  - "13.7"
+  - "13.9"
 cache:
   directories:
     - node_modules

From a3c9dd39b96df5fd668403352a586b1b93e2d3ab Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 2 Mar 2020 20:04:24 -0500
Subject: [PATCH 083/272] build: eslint-plugin-markdown@1.0.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 6ca5d7da..c33d5f82 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,7 @@
     "after": "0.8.2",
     "cookie-parser": "1.4.4",
     "eslint": "3.19.0",
-    "eslint-plugin-markdown": "1.0.1",
+    "eslint-plugin-markdown": "1.0.2",
     "express": "4.17.1",
     "mocha": "7.1.0",
     "nyc": "15.0.0",

From f927fc13e7fda51082990cb1e26c27d0022a1b12 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 2 Mar 2020 20:09:50 -0500
Subject: [PATCH 084/272] build: Node.js@10.19

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index b5855359..70e4577f 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -12,7 +12,7 @@ node_js:
   - "7.10"
   - "8.17"
   - "9.11"
-  - "10.18"
+  - "10.19"
   - "11.15"
   - "12.14"
   - "13.9"

From a2b27958a498340dcf0f87f69735aadf9f7a9adc Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 5 Mar 2020 21:40:57 -0500
Subject: [PATCH 085/272] build: Node.js@12.16

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 70e4577f..427ff29f 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -14,7 +14,7 @@ node_js:
   - "9.11"
   - "10.19"
   - "11.15"
-  - "12.14"
+  - "12.16"
   - "13.9"
 cache:
   directories:

From 95946e320b32c6756b532128d737c97ab21d3e6c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 4 Apr 2020 19:34:36 -0400
Subject: [PATCH 086/272] build: nyc@15.0.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index c33d5f82..8bf91ddc 100644
--- a/package.json
+++ b/package.json
@@ -26,7 +26,7 @@
     "eslint-plugin-markdown": "1.0.2",
     "express": "4.17.1",
     "mocha": "7.1.0",
-    "nyc": "15.0.0",
+    "nyc": "15.0.1",
     "supertest": "4.0.2"
   },
   "files": [

From 82cc88217c49f0549f84414b90c192f30a2ba109 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 4 Apr 2020 19:38:49 -0400
Subject: [PATCH 087/272] build: mocha@7.1.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 8bf91ddc..8369f6b6 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.2",
     "express": "4.17.1",
-    "mocha": "7.1.0",
+    "mocha": "7.1.1",
     "nyc": "15.0.1",
     "supertest": "4.0.2"
   },

From 06e557911e22b748050db5b4cc9eb3e8b53b3979 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 4 Apr 2020 19:43:04 -0400
Subject: [PATCH 088/272] build: cookie-parser@1.4.5

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 8369f6b6..b8f44d24 100644
--- a/package.json
+++ b/package.json
@@ -21,7 +21,7 @@
   },
   "devDependencies": {
     "after": "0.8.2",
-    "cookie-parser": "1.4.4",
+    "cookie-parser": "1.4.5",
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.2",
     "express": "4.17.1",

From bcf1f071235ad4ddb22a24179c3d5151bb41c901 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 6 Apr 2020 23:01:31 -0400
Subject: [PATCH 089/272] build: Node.js@13.12

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 427ff29f..23e0c446 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -15,7 +15,7 @@ node_js:
   - "10.19"
   - "11.15"
   - "12.16"
-  - "13.9"
+  - "13.12"
 cache:
   directories:
     - node_modules

From 909d9e0a238795aa927fe45ded86669fd446f1fe Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 16 Apr 2020 20:24:14 -0400
Subject: [PATCH 090/272] docs: add debugging section

closes #707
---
 README.md | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/README.md b/README.md
index a1ed3fa1..fe5076d8 100644
--- a/README.md
+++ b/README.md
@@ -829,6 +829,24 @@ app.get('/bar', function (req, res, next) {
 })
 ```
 
+## Debugging
+
+This module uses the [debug](https://www.npmjs.com/package/debug) module
+internally to log information about session operations.
+
+To see all the internal logs, set the `DEBUG` environment variable to
+`express-session` when launching your app (`npm start`, in this example):
+
+```sh
+$ DEBUG=express-session npm start
+```
+
+On Windows, use the corresponding command;
+
+```sh
+> set DEBUG=express-session & npm start
+```
+
 ## License
 
 [MIT](LICENSE)

From ac3f0a256ba376f3e760c83cfde87adf3706cd2e Mon Sep 17 00:00:00 2001
From: Zirak <zirakertan@gmail.com>
Date: Sun, 17 Nov 2019 22:36:19 +0000
Subject: [PATCH 091/272] Fix internal method wrapping error on failed reloads

closes #715
---
 HISTORY.md      |  5 +++++
 index.js        | 15 +++++++++++----
 test/session.js | 43 +++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 59 insertions(+), 4 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index ccc03991..99d0636a 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Fix internal method wrapping error on failed reloads
+
 1.17.0 / 2019-10-10
 ===================
 
diff --git a/index.js b/index.js
index 24221b48..9615346c 100644
--- a/index.js
+++ b/index.js
@@ -376,6 +376,16 @@ function session(options) {
       wrapmethods(req.session)
     }
 
+    function rewrapmethods (sess, callback) {
+      return function () {
+        if (req.session !== sess) {
+          wrapmethods(req.session)
+        }
+
+        callback.apply(this, arguments)
+      }
+    }
+
     // wrap session methods
     function wrapmethods(sess) {
       var _reload = sess.reload
@@ -383,10 +393,7 @@ function session(options) {
 
       function reload(callback) {
         debug('reloading %s', this.id)
-        _reload.call(this, function () {
-          wrapmethods(req.session)
-          callback.apply(this, arguments)
-        })
+        _reload.call(this, rewrapmethods(this, callback))
       }
 
       function save() {
diff --git a/test/session.js b/test/session.js
index 1e3b7124..c0f1716d 100644
--- a/test/session.js
+++ b/test/session.js
@@ -1677,6 +1677,49 @@ describe('session()', function(){
           .expect(500, 'failed to load session', done)
         })
       })
+
+      it('should not override an overriden `reload` in case of errors',  function (done) {
+        var store = new session.MemoryStore()
+        var server = createServer({ store: store, resave: false }, function (req, res) {
+          if (req.url === '/') {
+            req.session.active = true
+            res.end('session created')
+            return
+          }
+
+          store.clear(function (err) {
+            if (err) return done(err)
+
+            // reload way too many times on top of each other,
+            // attempting to overflow the call stack
+            var iters = 20
+            reload()
+            function reload () {
+              if (!--iters) {
+                res.end('ok')
+                return
+              }
+
+              try {
+                req.session.reload(reload)
+              } catch (e) {
+                res.statusCode = 500
+                res.end(e.message)
+              }
+            }
+          })
+        })
+
+        request(server)
+          .get('/')
+          .expect(200, 'session created', function (err, res) {
+            if (err) return done(err)
+            request(server)
+              .get('/foo')
+              .set('Cookie', cookie(res))
+              .expect(200, 'ok', done)
+          })
+      })
     })
 
     describe('.save()', function () {

From 5d5b51ff220f0e0d2adca06b3fbffc3310e56975 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 16 Apr 2020 20:48:21 -0400
Subject: [PATCH 092/272] tests: resolve originalMaxAge flaky tests

fixes #719
---
 test/session.js | 40 +++++++++++++++++++++++++++++++++++-----
 1 file changed, 35 insertions(+), 5 deletions(-)

diff --git a/test/session.js b/test/session.js
index c0f1716d..929d7c74 100644
--- a/test/session.js
+++ b/test/session.js
@@ -1902,7 +1902,13 @@ describe('session()', function(){
 
           request(server)
             .get('/')
-            .expect(200, '2000', done)
+            .expect(200)
+            .expect(function (res) {
+              // account for 1ms latency
+              assert.ok(res.text === '2000' || res.text === '1999',
+                'expected 2000, got ' + res.text)
+            })
+            .end(done)
         })
 
         it('should equal original maxAge for all requests', function (done) {
@@ -1912,13 +1918,25 @@ describe('session()', function(){
 
           request(server)
             .get('/')
-            .expect(200, '2000', function (err, res) {
+            .expect(200)
+            .expect(function (res) {
+              // account for 1ms latency
+              assert.ok(res.text === '2000' || res.text === '1999',
+                'expected 2000, got ' + res.text)
+            })
+            .end(function (err, res) {
               if (err) return done(err)
               setTimeout(function () {
                 request(server)
                   .get('/')
                   .set('Cookie', cookie(res))
-                  .expect(200, '2000', done)
+                  .expect(200)
+                  .expect(function (res) {
+                    // account for 1ms latency
+                    assert.ok(res.text === '2000' || res.text === '1999',
+                      'expected 2000, got ' + res.text)
+                  })
+                  .end(done)
               }, 100)
             })
         })
@@ -1931,13 +1949,25 @@ describe('session()', function(){
 
           request(server)
             .get('/')
-            .expect(200, '2000', function (err, res) {
+            .expect(200)
+            .expect(function (res) {
+              // account for 1ms latency
+              assert.ok(res.text === '2000' || res.text === '1999',
+                'expected 2000, got ' + res.text)
+            })
+            .end(function (err, res) {
               if (err) return done(err)
               setTimeout(function () {
                 request(server)
                   .get('/')
                   .set('Cookie', cookie(res))
-                  .expect(200, '2000', done)
+                  .expect(200)
+                  .expect(function (res) {
+                    // account for 1ms latency
+                    assert.ok(res.text === '2000' || res.text === '1999',
+                      'expected 2000, got ' + res.text)
+                  })
+                  .end(done)
               }, 100)
             })
         })

From 4b40b2fb54cde1774e7810c42ca01fe5c971bcbf Mon Sep 17 00:00:00 2001
From: Gaby Baghdadi <gabybaghdadi@hotmail.com>
Date: Mon, 11 Nov 2019 15:31:14 -0500
Subject: [PATCH 093/272] tests: fix flaky cookie.maxAge test

closes #713
---
 test/cookie.js | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/test/cookie.js b/test/cookie.js
index b280dff1..36f0f5f5 100644
--- a/test/cookie.js
+++ b/test/cookie.js
@@ -91,7 +91,9 @@ describe('new Cookie()', function () {
         var maxAge = 60000
         var cookie = new Cookie({ maxAge: maxAge })
 
-        assert.strictEqual(cookie.maxAge, maxAge)
+        assert.strictEqual(typeof cookie.maxAge, 'number')
+        assert.ok(cookie.maxAge - 1000 <= maxAge)
+        assert.ok(cookie.maxAge + 1000 >= maxAge)
       })
 
       it('should accept Date object', function () {

From 80ae6a54107efd936c55bc4696fe8770cedbfd31 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 16 Apr 2020 22:43:02 -0400
Subject: [PATCH 094/272] 1.71.1

---
 HISTORY.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 99d0636a..c5a97fd2 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+1.17.1 / 2020-04-16
+===================
 
   * Fix internal method wrapping error on failed reloads
 
diff --git a/package.json b/package.json
index b8f44d24..ba2adb65 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.17.0",
+  "version": "1.17.1",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From 975924658fd94dd10a373272a5dc465622dc0e0b Mon Sep 17 00:00:00 2001
From: Glenn Hinks <ghinks@yahoo.com>
Date: Tue, 14 Apr 2020 15:35:04 -0400
Subject: [PATCH 095/272] tests: remove duplicate test

closes #741
---
 test/cookie.js | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/test/cookie.js b/test/cookie.js
index 36f0f5f5..65ae1fc3 100644
--- a/test/cookie.js
+++ b/test/cookie.js
@@ -12,11 +12,6 @@ describe('new Cookie()', function () {
     assert.strictEqual(cookie.expires, null)
   })
 
-  it('should default maxAge to null', function () {
-    var cookie = new Cookie()
-    assert.strictEqual(cookie.maxAge, null)
-  })
-
   it('should default httpOnly to true', function () {
     var cookie = new Cookie()
     assert.strictEqual(cookie.httpOnly, true)

From 3b08fc7a78fe7742d5a29c5a4ad999169adaf3cb Mon Sep 17 00:00:00 2001
From: Glenn Hinks <ghinks@yahoo.com>
Date: Tue, 14 Apr 2020 18:01:22 -0400
Subject: [PATCH 096/272] tests: fix test validation of session ID

closes #742
---
 test/session.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/session.js b/test/session.js
index 929d7c74..f0b60fdf 100644
--- a/test/session.js
+++ b/test/session.js
@@ -482,7 +482,7 @@ describe('session()', function(){
           .get('/')
           .set('Cookie', cookie(res))
           .expect(shouldSetCookie('connect.sid'))
-          .expect(shouldSetCookieToDifferentSessionId(res))
+          .expect(shouldSetCookieToDifferentSessionId(sid(res)))
           .expect(200, 'session 2', done)
         })
       })

From c3e784e1a736fb41fab3da682f63582c709d6da8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 26 Apr 2020 18:09:58 -0400
Subject: [PATCH 097/272] build: Node.js@10.20

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 23e0c446..347cf792 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -12,7 +12,7 @@ node_js:
   - "7.10"
   - "8.17"
   - "9.11"
-  - "10.19"
+  - "10.20"
   - "11.15"
   - "12.16"
   - "13.12"

From fa4e23405bc2dcabfac12a8436dcab1f3a830801 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 26 Apr 2020 18:11:34 -0400
Subject: [PATCH 098/272] build: Node.js@13.13

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 347cf792..6c647735 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -15,7 +15,7 @@ node_js:
   - "10.20"
   - "11.15"
   - "12.16"
-  - "13.12"
+  - "13.13"
 cache:
   directories:
     - node_modules

From fbf7059e565064ce1efc63a3b7b8995a9024ae2d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 1 May 2020 20:03:52 -0400
Subject: [PATCH 099/272] build: mocha@7.1.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index ba2adb65..209c6e46 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.2",
     "express": "4.17.1",
-    "mocha": "7.1.1",
+    "mocha": "7.1.2",
     "nyc": "15.0.1",
     "supertest": "4.0.2"
   },

From 4186dff8cdfa0a77005195697a0137f91082b073 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 18 May 2020 19:44:45 -0400
Subject: [PATCH 100/272] deps: safe-buffer@5.2.1

---
 HISTORY.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index c5a97fd2..60592140 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * deps: safe-buffer@5.2.1
+
 1.17.1 / 2020-04-16
 ===================
 
diff --git a/package.json b/package.json
index 209c6e46..d5eb6be2 100644
--- a/package.json
+++ b/package.json
@@ -16,7 +16,7 @@
     "depd": "~2.0.0",
     "on-headers": "~1.0.2",
     "parseurl": "~1.3.3",
-    "safe-buffer": "5.2.0",
+    "safe-buffer": "5.2.1",
     "uid-safe": "~2.1.5"
   },
   "devDependencies": {

From c5ec988ae982dfc00061fdb1571b2a88ada3aba5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 18 May 2020 19:49:08 -0400
Subject: [PATCH 101/272] build: Node.js@13.14

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 6c647735..ba846eac 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -15,7 +15,7 @@ node_js:
   - "10.20"
   - "11.15"
   - "12.16"
-  - "13.13"
+  - "13.14"
 cache:
   directories:
     - node_modules

From 40a6337a7e69346694091f66d55928c913299c56 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 9 Jun 2020 21:33:32 -0400
Subject: [PATCH 102/272] build: mocha@7.2.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index d5eb6be2..9ef314d2 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.2",
     "express": "4.17.1",
-    "mocha": "7.1.2",
+    "mocha": "7.2.0",
     "nyc": "15.0.1",
     "supertest": "4.0.2"
   },

From fa6ced353fb3eecb9305eefeec9ef02d1dd07f7f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 9 Jun 2020 21:36:35 -0400
Subject: [PATCH 103/272] build: Node.js@10.21

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index ba846eac..9ff2e6e9 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -12,7 +12,7 @@ node_js:
   - "7.10"
   - "8.17"
   - "9.11"
-  - "10.20"
+  - "10.21"
   - "11.15"
   - "12.16"
   - "13.14"

From 34a4db1c279aad87ca1b12e19574f9e307831a6c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 9 Jun 2020 21:40:20 -0400
Subject: [PATCH 104/272] build: Node.js@12.18

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 9ff2e6e9..db00f6ed 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -14,7 +14,7 @@ node_js:
   - "9.11"
   - "10.21"
   - "11.15"
-  - "12.16"
+  - "12.18"
   - "13.14"
 cache:
   directories:

From 357b98b4f9460173181a5e3dac84db126115b749 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 9 Jun 2020 21:54:22 -0400
Subject: [PATCH 105/272] build: support Node.js 14.x

---
 .travis.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.travis.yml b/.travis.yml
index db00f6ed..f62c5a5a 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -16,6 +16,7 @@ node_js:
   - "11.15"
   - "12.18"
   - "13.14"
+  - "14.4"
 cache:
   directories:
     - node_modules

From 67ccd90bedf155e249652df49714913297bfbc92 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 9 Jun 2020 22:01:55 -0400
Subject: [PATCH 106/272] build: nyc@15.1.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 9ef314d2..4c34510c 100644
--- a/package.json
+++ b/package.json
@@ -26,7 +26,7 @@
     "eslint-plugin-markdown": "1.0.2",
     "express": "4.17.1",
     "mocha": "7.2.0",
-    "nyc": "15.0.1",
+    "nyc": "15.1.0",
     "supertest": "4.0.2"
   },
   "files": [

From 75896a5525f7245278510b670c2e08a14ec10fc0 Mon Sep 17 00:00:00 2001
From: Glenn Hinks <ghinks@yahoo.com>
Date: Tue, 19 May 2020 08:10:26 -0400
Subject: [PATCH 107/272] docs: expand secret documentation with key advice

fixes #734
fixes #750
closes #752
---
 README.md | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index fe5076d8..14cad1e8 100644
--- a/README.md
+++ b/README.md
@@ -272,7 +272,22 @@ it to be saved. *This has been fixed in PassportJS 0.3.0*
 This is the secret used to sign the session ID cookie. This can be either a string
 for a single secret, or an array of multiple secrets. If an array of secrets is
 provided, only the first element will be used to sign the session ID cookie, while
-all the elements will be considered when verifying the signature in requests.
+all the elements will be considered when verifying the signature in requests. The
+secret itself should be not easily parsed by a human and would best be a random set
+of characters. A best practice may include:
+
+  - The use of environment variables to store the secret, ensuring the secret itself
+    does not exist in your repository.
+  - Periodic updates of the secret, while ensuring the previous secret is in the
+    array.
+
+Using a secret that cannot be guessed will reduce the ability to hijack a session to
+only guessing the session ID (as determined by the `genid` option).
+
+Changing the secret value will invalidate all existing sessions. In order to rotate
+the secret without invalidating sessions, provide an array of secrets, with the new
+secret as first element of the array, and including previous secrets as the later
+elements.
 
 ##### store
 

From 28d2691eaa6ff1796805eef3f9cf66ef6f6428cf Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 10 Jun 2020 21:18:03 -0400
Subject: [PATCH 108/272] deps: cookie@0.4.1

---
 HISTORY.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index 60592140..355c8021 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * deps: cookie@0.4.1
   * deps: safe-buffer@5.2.1
 
 1.17.1 / 2020-04-16
diff --git a/package.json b/package.json
index 4c34510c..adadb821 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,7 @@
   "repository": "expressjs/session",
   "license": "MIT",
   "dependencies": {
-    "cookie": "0.4.0",
+    "cookie": "0.4.1",
     "cookie-signature": "1.0.6",
     "debug": "2.6.9",
     "depd": "~2.0.0",

From 0f26a224ef03e7b251b5f92098258b47c02bc579 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 24 Jun 2020 19:03:56 -0400
Subject: [PATCH 109/272] build: mocha@8.0.1

---
 .travis.yml  | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index f62c5a5a..d7722207 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -68,6 +68,7 @@ before_install:
     elif node_version_lt '4.0' ; then npm_use_module 'mocha' '3.5.3'
     elif node_version_lt '6.0' ; then npm_use_module 'mocha' '5.2.0'
     elif node_version_lt '8.0' ; then npm_use_module 'mocha' '6.2.2'
+    elif node_version_lt '10.0'; then npm_use_module 'mocha' '7.2.0'
     fi
   - |
     # Configure nyc for coverage
diff --git a/package.json b/package.json
index adadb821..e5c7e480 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.2",
     "express": "4.17.1",
-    "mocha": "7.2.0",
+    "mocha": "8.0.1",
     "nyc": "15.1.0",
     "supertest": "4.0.2"
   },

From e485e11496f78b75f04ca58cde0d124f80f2b9e2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 6 Jul 2020 21:03:04 -0400
Subject: [PATCH 110/272] build: Node.js@14.5

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index d7722207..8fabbdf3 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -16,7 +16,7 @@ node_js:
   - "11.15"
   - "12.18"
   - "13.14"
-  - "14.4"
+  - "14.5"
 cache:
   directories:
     - node_modules

From 7d7f4f72dd28586d978009b0fde946c51202fb27 Mon Sep 17 00:00:00 2001
From: Glenn Hinks <ghinks@yahoo.com>
Date: Sun, 3 May 2020 09:15:33 -0400
Subject: [PATCH 111/272] tests: add res.writeHead set-cookie test

closes #746
---
 test/session.js | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/test/session.js b/test/session.js
index f0b60fdf..1455f0a6 100644
--- a/test/session.js
+++ b/test/session.js
@@ -1892,6 +1892,21 @@ describe('session()', function(){
           .expect(shouldSetCookieToValue('previous', 'cookieValue'))
           .expect(200, done)
         })
+
+        it('should preserve cookies set in writeHead', function (done) {
+          var server = createServer(null, function (req, res) {
+            var cookie = new Cookie()
+            res.writeHead(200, {
+              'Set-Cookie': cookie.serialize('previous', 'cookieValue')
+            })
+            res.end()
+          })
+
+          request(server)
+            .get('/')
+            .expect(shouldSetCookieToValue('previous', 'cookieValue'))
+            .expect(200, done)
+        })
       })
 
       describe('.originalMaxAge', function () {

From 09d41b9b82fb56e8d86c410d38c52139cd932eec Mon Sep 17 00:00:00 2001
From: Glenn Hinks <ghinks@yahoo.com>
Date: Fri, 3 Jul 2020 11:48:48 -0400
Subject: [PATCH 112/272] docs: remove deprecated store modules from readme

closes #765
---
 README.md | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/README.md b/README.md
index 14cad1e8..66c84da7 100644
--- a/README.md
+++ b/README.md
@@ -617,11 +617,6 @@ and other multi-core embedded devices).
 [connect-mongodb-session-url]: https://www.npmjs.com/package/connect-mongodb-session
 [connect-mongodb-session-image]: https://badgen.net/github/stars/mongodb-js/connect-mongodb-session?label=%E2%98%85
 
-[![★][connect-mssql-image] connect-mssql][connect-mssql-url] A SQL Server-based session store.
-
-[connect-mssql-url]: https://www.npmjs.com/package/connect-mssql
-[connect-mssql-image]: https://badgen.net/github/stars/patriksimek/connect-mssql?label=%E2%98%85
-
 [![★][connect-pg-simple-image] connect-pg-simple][connect-pg-simple-url] A PostgreSQL-based session store.
 
 [connect-pg-simple-url]: https://www.npmjs.com/package/connect-pg-simple
@@ -664,11 +659,6 @@ and other multi-core embedded devices).
 [couchdb-expression-url]: https://www.npmjs.com/package/couchdb-expression
 [couchdb-expression-image]: https://badgen.net/github/stars/tkshnwesper/couchdb-expression?label=%E2%98%85
 
-[![★][documentdb-session-image] documentdb-session][documentdb-session-url] A session store for Microsoft Azure's [DocumentDB](https://azure.microsoft.com/en-us/services/documentdb/) NoSQL database service.
-
-[documentdb-session-url]: https://www.npmjs.com/package/documentdb-session
-[documentdb-session-image]: https://badgen.net/github/stars/dwhieb/documentdb-session?label=%E2%98%85
-
 [![★][dynamodb-store-image] dynamodb-store][dynamodb-store-url] A DynamoDB-based session store.
 
 [dynamodb-store-url]: https://www.npmjs.com/package/dynamodb-store

From 6a128cc5941365d0416d92760328a8e11549eb5d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 7 Jul 2020 21:43:18 -0400
Subject: [PATCH 113/272] Fix res.end patch to always commit headers

fixes #766
closes #767
---
 HISTORY.md      |  1 +
 index.js        |  4 ++++
 test/session.js | 36 ++++++++++++++++++++++++++++++++++++
 3 files changed, 41 insertions(+)

diff --git a/HISTORY.md b/HISTORY.md
index 355c8021..4fa89ab4 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Fix `res.end` patch to always commit headers
   * deps: cookie@0.4.1
   * deps: safe-buffer@5.2.1
 
diff --git a/index.js b/index.js
index 9615346c..d7efeab9 100644
--- a/index.js
+++ b/index.js
@@ -272,6 +272,10 @@ function session(options) {
           return ret;
         }
 
+        if (!res._header) {
+          res._implicitHeader()
+        }
+
         if (chunk == null) {
           ret = true;
           return ret;
diff --git a/test/session.js b/test/session.js
index 1455f0a6..8d796f91 100644
--- a/test/session.js
+++ b/test/session.js
@@ -1449,6 +1449,42 @@ describe('session()', function(){
       .get('/')
       .expect(200, 'hello, world', done)
     })
+
+    it('should error when res.end is called twice', function (done) {
+      var error1 = null
+      var error2 = null
+      var server = http.createServer(function (req, res) {
+        res.end()
+
+        try {
+          res.setHeader('Content-Length', '3')
+          res.end('foo')
+        } catch (e) {
+          error1 = e
+        }
+      })
+
+      function respond (req, res) {
+        res.end()
+
+        try {
+          res.setHeader('Content-Length', '3')
+          res.end('foo')
+        } catch (e) {
+          error2 = e
+        }
+      }
+
+      request(server)
+        .get('/')
+        .end(function (err, res) {
+          if (err) return done(err)
+          request(createServer(null, respond))
+            .get('/')
+            .expect(function () { assert.strictEqual((error1 && error1.message), (error2 && error2.message)) })
+            .expect(res.statusCode, res.text, done)
+        })
+    })
   })
 
   describe('req.session', function(){

From c678436a0d2b62113ef5433acf45fe72d36e80ce Mon Sep 17 00:00:00 2001
From: Krispin Leydon <kleydon@users.noreply.github.com>
Date: Sat, 20 Jun 2020 09:44:56 -0700
Subject: [PATCH 114/272] docs: add @quixo3/prisma-session-store-url to the
 list of session stores

closes #760
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 66c84da7..3b2bcbf4 100644
--- a/README.md
+++ b/README.md
@@ -759,6 +759,11 @@ based session store. Supports all backends supported by Fortune (MongoDB, Redis,
 [nedb-session-store-url]: https://www.npmjs.com/package/nedb-session-store
 [nedb-session-store-image]: https://badgen.net/github/stars/JamesMGreene/nedb-session-store?label=%E2%98%85
 
+[![★][@quixo3/prisma-session-store-image] @quixo3/prisma-session-store][@quixo3/prisma-session-store-url] A session store for the [Prisma Framework](https://www.prisma.io).
+
+[@quixo3/prisma-session-store-url]: https://www.npmjs.com/package/@quixo3/prisma-session-store
+[@quixo3/prisma-session-store-image]: https://badgen.net/github/stars/kleydon/prisma-session-store?label=%E2%98%85
+
 [![★][restsession-image] restsession][restsession-url] Store sessions utilizing a RESTful API
 
 [restsession-url]: https://www.npmjs.com/package/restsession

From 4715f3b4ed75f7a3926137f6754cde42b9fb66b7 Mon Sep 17 00:00:00 2001
From: shree <sammmmmu123@gmail.com>
Date: Sat, 11 Jul 2020 18:03:24 +0530
Subject: [PATCH 115/272] docs: fix typo in readme

closes #768
---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 3b2bcbf4..94ec2743 100644
--- a/README.md
+++ b/README.md
@@ -240,7 +240,7 @@ With this enabled, the session identifier cookie will expire in
 
 This is typically used in conjuction with short, non-session-length
 [`maxAge`](#cookiemaxage) values to provide a quick timeout of the session data
-with reduced potentional of it occurring during on going server interactions.
+with reduced potential of it occurring during on going server interactions.
 
 **Note** When this option is set to `true` but the `saveUninitialized` option is
 set to `false`, the cookie will not be set on a response with an uninitialized

From 9face93ed0cdd4494a6513542ac12e15ad0a9848 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 27 Jul 2020 22:41:07 -0400
Subject: [PATCH 116/272] build: Node.js@10.22

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 8fabbdf3..4621c083 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -12,7 +12,7 @@ node_js:
   - "7.10"
   - "8.17"
   - "9.11"
-  - "10.21"
+  - "10.22"
   - "11.15"
   - "12.18"
   - "13.14"

From c37c46b0773ef3c415dc0aa8efc3f0f904d0772a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 5 Aug 2020 16:44:49 -0400
Subject: [PATCH 117/272] build: mocha@8.1.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index e5c7e480..e3f988f7 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.2",
     "express": "4.17.1",
-    "mocha": "8.0.1",
+    "mocha": "8.1.1",
     "nyc": "15.1.0",
     "supertest": "4.0.2"
   },

From 7d9ec2b7d531c943b65751ea60ca04b7080bf75e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 5 Aug 2020 16:49:27 -0400
Subject: [PATCH 118/272] build: Node.js@14.7

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 4621c083..d0615e91 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -16,7 +16,7 @@ node_js:
   - "11.15"
   - "12.18"
   - "13.14"
-  - "14.5"
+  - "14.7"
 cache:
   directories:
     - node_modules

From a8641429502fcc076c4b2dcbd6b2320891c1650c Mon Sep 17 00:00:00 2001
From: Jason Luboff <jluboff@gmail.com>
Date: Tue, 18 Aug 2020 15:02:47 -0700
Subject: [PATCH 119/272] docs: add connect-mssql-v2 to the list of session
 stores

closes #775
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 94ec2743..38b75c7c 100644
--- a/README.md
+++ b/README.md
@@ -617,6 +617,11 @@ and other multi-core embedded devices).
 [connect-mongodb-session-url]: https://www.npmjs.com/package/connect-mongodb-session
 [connect-mongodb-session-image]: https://badgen.net/github/stars/mongodb-js/connect-mongodb-session?label=%E2%98%85
 
+[![★][connect-mssql-v2-image] connect-mssql-v2][connect-mssql-v2-url] A Microsoft SQL Server-based session store based on [connect-mssql](https://www.npmjs.com/package/connect-mssql).
+
+[connect-mssql-v2-url]: https://www.npmjs.com/package/connect-mssql-v2
+[connect-mssql-v2-image]: https://badgen.net/github/stars/jluboff/connect-mssql-v2?label=%E2%98%85
+
 [![★][connect-pg-simple-image] connect-pg-simple][connect-pg-simple-url] A PostgreSQL-based session store.
 
 [connect-pg-simple-url]: https://www.npmjs.com/package/connect-pg-simple

From d9702ed2496fabcc5417f3103aaccd381b2084ac Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 31 Aug 2020 20:41:56 -0400
Subject: [PATCH 120/272] build: mocha@8.1.3

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index e3f988f7..cfbcb255 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.2",
     "express": "4.17.1",
-    "mocha": "8.1.1",
+    "mocha": "8.1.3",
     "nyc": "15.1.0",
     "supertest": "4.0.2"
   },

From c5cd79056384e661d131a0a4174f1448819b09ea Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 3 Sep 2020 20:43:27 -0400
Subject: [PATCH 121/272] tests: add helper for delay store set

---
 test/session.js | 103 ++++++++++++++++--------------------------------
 1 file changed, 33 insertions(+), 70 deletions(-)

diff --git a/test/session.js b/test/session.js
index 8d796f91..021b3251 100644
--- a/test/session.js
+++ b/test/session.js
@@ -290,34 +290,21 @@ describe('session()', function(){
 
   describe('when response ended', function () {
     it('should have saved session', function (done) {
-      var saved = false
       var store = new session.MemoryStore()
       var server = createServer({ store: store }, function (req, res) {
         req.session.hit = true
         res.end('session saved')
       })
 
-      var _set = store.set
-      store.set = function set(sid, sess, callback) {
-        setTimeout(function () {
-          _set.call(store, sid, sess, function (err) {
-            saved = true
-            callback(err)
-          })
-        }, 200)
-      }
-
       request(server)
-      .get('/')
-      .expect(200, 'session saved', function (err) {
-        if (err) return done(err)
-        assert.ok(saved)
-        done()
-      })
+        .get('/')
+        .expect(200)
+        .expect(shouldSetSessionInStore(store, 200))
+        .expect('session saved')
+        .end(done)
     })
 
     it('should have saved session even with empty response', function (done) {
-      var saved = false
       var store = new session.MemoryStore()
       var server = createServer({ store: store }, function (req, res) {
         req.session.hit = true
@@ -325,27 +312,14 @@ describe('session()', function(){
         res.end()
       })
 
-      var _set = store.set
-      store.set = function set(sid, sess, callback) {
-        setTimeout(function () {
-          _set.call(store, sid, sess, function (err) {
-            saved = true
-            callback(err)
-          })
-        }, 200)
-      }
-
       request(server)
-      .get('/')
-      .expect(200, '', function (err) {
-        if (err) return done(err)
-        assert.ok(saved)
-        done()
-      })
+        .get('/')
+        .expect(200)
+        .expect(shouldSetSessionInStore(store, 200))
+        .end(done)
     })
 
     it('should have saved session even with multi-write', function (done) {
-      var saved = false
       var store = new session.MemoryStore()
       var server = createServer({ store: store }, function (req, res) {
         req.session.hit = true
@@ -354,27 +328,15 @@ describe('session()', function(){
         res.end('world')
       })
 
-      var _set = store.set
-      store.set = function set(sid, sess, callback) {
-        setTimeout(function () {
-          _set.call(store, sid, sess, function (err) {
-            saved = true
-            callback(err)
-          })
-        }, 200)
-      }
-
       request(server)
-      .get('/')
-      .expect(200, 'hello, world', function (err) {
-        if (err) return done(err)
-        assert.ok(saved)
-        done()
-      })
+        .get('/')
+        .expect(200)
+        .expect(shouldSetSessionInStore(store, 200))
+        .expect('hello, world')
+        .end(done)
     })
 
     it('should have saved session even with non-chunked response', function (done) {
-      var saved = false
       var store = new session.MemoryStore()
       var server = createServer({ store: store }, function (req, res) {
         req.session.hit = true
@@ -382,23 +344,12 @@ describe('session()', function(){
         res.end('session saved')
       })
 
-      var _set = store.set
-      store.set = function set(sid, sess, callback) {
-        setTimeout(function () {
-          _set.call(store, sid, sess, function (err) {
-            saved = true
-            callback(err)
-          })
-        }, 200)
-      }
-
       request(server)
-      .get('/')
-      .expect(200, 'session saved', function (err) {
-        if (err) return done(err)
-        assert.ok(saved)
-        done()
-      })
+        .get('/')
+        .expect(200)
+        .expect(shouldSetSessionInStore(store, 200))
+        .expect('session saved')
+        .end(done)
     })
 
     it('should have saved session with updated cookie expiration', function (done) {
@@ -2485,13 +2436,25 @@ function shouldSetCookieWithoutAttribute (name, attrib) {
   }
 }
 
-function shouldSetSessionInStore(store) {
+function shouldSetSessionInStore (store, delay) {
   var _set = store.set
   var count = 0
 
   store.set = function set () {
     count++
-    return _set.apply(this, arguments)
+
+    if (!delay) {
+      return _set.apply(this, arguments)
+    }
+
+    var args = new Array(arguments.length + 1)
+
+    args[0] = this
+    for (var i = 1; i < args.length; i++) {
+      args[i] = arguments[i - 1]
+    }
+
+    setTimeout(_set.bind.apply(_set, args), delay)
   }
 
   return function () {

From 284a71a166b514dbb5b15afd0a99a66b1937b9d1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 Oct 2020 21:33:40 -0400
Subject: [PATCH 122/272] build: Node.js@12.19

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index d0615e91..5c6f7149 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -14,7 +14,7 @@ node_js:
   - "9.11"
   - "10.22"
   - "11.15"
-  - "12.18"
+  - "12.19"
   - "13.14"
   - "14.7"
 cache:

From 69ac483771e10cfb651f28379a07ca2e6f3ab613 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 Oct 2020 21:39:44 -0400
Subject: [PATCH 123/272] build: Node.js@14.13

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 5c6f7149..fe7c7c82 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -16,7 +16,7 @@ node_js:
   - "11.15"
   - "12.19"
   - "13.14"
-  - "14.7"
+  - "14.13"
 cache:
   directories:
     - node_modules

From 2637221c383805c49dd57287fb58df4b63bc7dbe Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 10 Nov 2020 00:31:28 -0500
Subject: [PATCH 124/272] build: supertest@6.0.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index cfbcb255..f395b686 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "express": "4.17.1",
     "mocha": "8.1.3",
     "nyc": "15.1.0",
-    "supertest": "4.0.2"
+    "supertest": "6.0.1"
   },
   "files": [
     "session/",

From 0d7f3d83a6309c1473199b6af768c1aa679c869f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 13 Nov 2020 21:30:32 -0500
Subject: [PATCH 125/272] build: mocha@8.2.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index f395b686..99eaffd6 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.2",
     "express": "4.17.1",
-    "mocha": "8.1.3",
+    "mocha": "8.2.1",
     "nyc": "15.1.0",
     "supertest": "6.0.1"
   },

From 1cfd994507daa6c32ad4edd836db7368c6a98af0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 14 Nov 2020 00:31:44 -0500
Subject: [PATCH 126/272] build: support Node.js 15.x

---
 .travis.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.travis.yml b/.travis.yml
index fe7c7c82..9c413128 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -17,6 +17,7 @@ node_js:
   - "12.19"
   - "13.14"
   - "14.13"
+  - "15.2"
 cache:
   directories:
     - node_modules

From 8914d60a0ef37ef81ffc8ddc361fc8f7d8290c7f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 29 Nov 2020 18:30:13 -0500
Subject: [PATCH 127/272] build: Node.js@12.20

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 9c413128..9404890b 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -14,7 +14,7 @@ node_js:
   - "9.11"
   - "10.22"
   - "11.15"
-  - "12.19"
+  - "12.20"
   - "13.14"
   - "14.13"
   - "15.2"

From 7452225b1a8b6768adca916ebdb141d1aac0a502 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 15 Dec 2020 16:30:21 -0500
Subject: [PATCH 128/272] build: Node.js@15.4

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 9404890b..d8ecf916 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -17,7 +17,7 @@ node_js:
   - "12.20"
   - "13.14"
   - "14.13"
-  - "15.2"
+  - "15.4"
 cache:
   directories:
     - node_modules

From 1813cd4d8035dd31670789dfd014d52752476eef Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 16 Dec 2020 00:18:50 -0500
Subject: [PATCH 129/272] build: Node.js@14.15

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index d8ecf916..c99c0b5e 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -16,7 +16,7 @@ node_js:
   - "11.15"
   - "12.20"
   - "13.14"
-  - "14.13"
+  - "14.15"
   - "15.4"
 cache:
   directories:

From a26b4d351eecae43c1ba6bbe9d3451db1adbaf6c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 16 Dec 2020 00:22:53 -0500
Subject: [PATCH 130/272] build: Node.js@10.23

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index c99c0b5e..772af3c3 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -12,7 +12,7 @@ node_js:
   - "7.10"
   - "8.17"
   - "9.11"
-  - "10.22"
+  - "10.23"
   - "11.15"
   - "12.20"
   - "13.14"

From 54e4193d7b0a11a61fdfcfdb24f2f2839a45923e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 16 Jan 2021 19:42:02 -0500
Subject: [PATCH 131/272] build: supertest@6.1.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 99eaffd6..cefc5c07 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "express": "4.17.1",
     "mocha": "8.2.1",
     "nyc": "15.1.0",
-    "supertest": "6.0.1"
+    "supertest": "6.1.1"
   },
   "files": [
     "session/",

From acca90868c4c00ba31e2d763dd98d8fbbaaa175b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 16 Jan 2021 19:49:16 -0500
Subject: [PATCH 132/272] build: Node.js@15.6

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 772af3c3..3e8c9128 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -17,7 +17,7 @@ node_js:
   - "12.20"
   - "13.14"
   - "14.15"
-  - "15.4"
+  - "15.6"
 cache:
   directories:
     - node_modules

From 7a6c4793602b9b048bd3c2d543bd4de1ea93df29 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 26 Feb 2021 21:39:33 -0500
Subject: [PATCH 133/272] build: Node.js@12.21

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 3e8c9128..68cc93d2 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -14,7 +14,7 @@ node_js:
   - "9.11"
   - "10.23"
   - "11.15"
-  - "12.20"
+  - "12.21"
   - "13.14"
   - "14.15"
   - "15.6"

From 3acbb8149de59581a1d78fbf17e6540f13cea4f1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 26 Feb 2021 21:44:49 -0500
Subject: [PATCH 134/272] build: Node.js@10.24

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 68cc93d2..6f010cd2 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -12,7 +12,7 @@ node_js:
   - "7.10"
   - "8.17"
   - "9.11"
-  - "10.23"
+  - "10.24"
   - "11.15"
   - "12.21"
   - "13.14"

From c1df7c54e89f84342acd03386e998ef54b766477 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 28 Feb 2021 19:43:04 -0500
Subject: [PATCH 135/272] build: Node.js@14.16

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 6f010cd2..c9fc0622 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -16,7 +16,7 @@ node_js:
   - "11.15"
   - "12.21"
   - "13.14"
-  - "14.15"
+  - "14.16"
   - "15.6"
 cache:
   directories:

From 6e4052d5b26f7e6809c84acc130b891b8370d0e0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 1 Mar 2021 20:31:00 -0500
Subject: [PATCH 136/272] build: Node.js@15.10

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index c9fc0622..e78c4851 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -17,7 +17,7 @@ node_js:
   - "12.21"
   - "13.14"
   - "14.16"
-  - "15.6"
+  - "15.10"
 cache:
   directories:
     - node_modules

From 373514d6607ce73fc3d0e33a1469c23a55757cff Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 8 Mar 2021 19:30:10 -0500
Subject: [PATCH 137/272] build: mocha@8.3.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index cefc5c07..f02d0e73 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.2",
     "express": "4.17.1",
-    "mocha": "8.2.1",
+    "mocha": "8.3.1",
     "nyc": "15.1.0",
     "supertest": "6.1.1"
   },

From e007c854f5de4e8455557eef14dae76706090dec Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 19 Mar 2021 21:30:10 -0400
Subject: [PATCH 138/272] build: Node.js@15.12

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index e78c4851..51f530d0 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -17,7 +17,7 @@ node_js:
   - "12.21"
   - "13.14"
   - "14.16"
-  - "15.10"
+  - "15.12"
 cache:
   directories:
     - node_modules

From f44f0e42df64e76dd6d5b943e23ab279c10358fc Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 12 May 2021 23:41:22 -0400
Subject: [PATCH 139/272] build: support Node.js 16.x

---
 .travis.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.travis.yml b/.travis.yml
index 51f530d0..11828a14 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -18,6 +18,7 @@ node_js:
   - "13.14"
   - "14.16"
   - "15.12"
+  - "16.1"
 cache:
   directories:
     - node_modules

From 657e3c086caf9a2f2167933e8205466bf74c4660 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 12 May 2021 23:48:38 -0400
Subject: [PATCH 140/272] build: mocha@8.4.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index f02d0e73..e58b1cec 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.2",
     "express": "4.17.1",
-    "mocha": "8.3.1",
+    "mocha": "8.4.0",
     "nyc": "15.1.0",
     "supertest": "6.1.1"
   },

From 579154ae6b7234fe385167a6534276420848b4ad Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 13 May 2021 21:31:51 -0400
Subject: [PATCH 141/272] build: Node.js@12.22

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 11828a14..2e7e2e23 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -14,7 +14,7 @@ node_js:
   - "9.11"
   - "10.24"
   - "11.15"
-  - "12.21"
+  - "12.22"
   - "13.14"
   - "14.16"
   - "15.12"

From 5cf60e2be83fcab4ae30d4447eb815ddab31ef47 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tim=20Daubensch=C3=BCtz?= <tim@daubenschuetz.de>
Date: Fri, 20 Nov 2020 15:34:49 +0100
Subject: [PATCH 142/272] docs: add better-sqlite3-session-store to the list of
 session stores

closes #795
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 38b75c7c..bd9ac856 100644
--- a/README.md
+++ b/README.md
@@ -519,6 +519,11 @@ module. Please make a PR to add additional modules :)
 [aerospike-session-store-url]: https://www.npmjs.com/package/aerospike-session-store
 [aerospike-session-store-image]: https://badgen.net/github/stars/aerospike/aerospike-session-store-expressjs?label=%E2%98%85
 
+[![★][better-sqlite3-session-store-image] better-sqlite3-session-store][better-sqlite3-session-store-url] A session store based on [better-sqlite3](https://github.com/JoshuaWise/better-sqlite3).
+
+[better-sqlite3-session-store-url]: https://www.npmjs.com/package/better-sqlite3-session-store
+[better-sqlite3-session-store-image]: https://badgen.net/github/stars/timdaub/better-sqlite3-session-store?label=%E2%98%85
+
 [![★][cassandra-store-image] cassandra-store][cassandra-store-url] An Apache Cassandra-based session store.
 
 [cassandra-store-url]: https://www.npmjs.com/package/cassandra-store

From a811b59da52031cc9594e8467cc79205711690f0 Mon Sep 17 00:00:00 2001
From: Yuli <stremovsky@gmail.com>
Date: Sat, 1 May 2021 21:53:01 +0300
Subject: [PATCH 143/272] docs: add @databunker/session-store to the list of
 session stores

closes #826
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index bd9ac856..bcccdbd8 100644
--- a/README.md
+++ b/README.md
@@ -799,6 +799,11 @@ based session store. Supports all backends supported by Fortune (MongoDB, Redis,
 [session-rethinkdb-url]: https://www.npmjs.com/package/session-rethinkdb
 [session-rethinkdb-image]: https://badgen.net/github/stars/llambda/session-rethinkdb?label=%E2%98%85
 
+[![★][@databunker/session-store-image] @databunker/session-store][@databunker/session-store-url] A [Databunker](https://databunker.org/)-based encrypted session store.
+
+[@databunker/session-store-url]: https://www.npmjs.com/package/@databunker/session-store
+[@databunker/session-store-image]: https://badgen.net/github/stars/securitybunker/databunker-session-store?label=%E2%98%85
+
 [![★][sessionstore-image] sessionstore][sessionstore-url] A session store that works with various databases.
 
 [sessionstore-url]: https://www.npmjs.com/package/sessionstore

From 034fd4e0bef8085431180258f329fe1168fb9e01 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 17 May 2021 16:33:52 -0400
Subject: [PATCH 144/272] build: supertest@6.1.3

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index e58b1cec..f216c9fb 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "express": "4.17.1",
     "mocha": "8.4.0",
     "nyc": "15.1.0",
-    "supertest": "6.1.1"
+    "supertest": "6.1.3"
   },
   "files": [
     "session/",

From b23ec4fa4553845138cbda823bb4e7bbd3d7242f Mon Sep 17 00:00:00 2001
From: john-redd <redd.web.development@gmail.com>
Date: Wed, 26 Aug 2020 09:45:16 -0600
Subject: [PATCH 145/272] docs: note about samesite attribute and secure
 requirements

closes #778
---
 README.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/README.md b/README.md
index bcccdbd8..77531505 100644
--- a/README.md
+++ b/README.md
@@ -110,6 +110,10 @@ More information about the different enforcement levels can be found in
 **Note** This is an attribute that has not yet been fully standardized, and may change in
 the future. This also means many clients may ignore this attribute until they understand it.
 
+**Note** There is a [draft spec](https://tools.ietf.org/html/draft-west-cookie-incrementalism-01)
+that requires that the `Secure` attribute be set to `true` when the `SameSite` attribute has been
+set to `'none'`. Some web browsers or other clients may be adopting this specification.
+
 ##### cookie.secure
 
 Specifies the `boolean` value for the `Secure` `Set-Cookie` attribute. When truthy,

From 7ff50af0d88e011e9830c14222df79d0b9e4ddc6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 17 May 2021 15:45:22 -0400
Subject: [PATCH 146/272] build: use GitHub Actions instead of Travis CI

---
 .github/workflows/ci.yml | 180 +++++++++++++++++++++++++++++++++++++++
 .travis.yml              | 112 ------------------------
 README.md                |   6 +-
 package.json             |   2 +-
 4 files changed, 184 insertions(+), 116 deletions(-)
 create mode 100644 .github/workflows/ci.yml
 delete mode 100644 .travis.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 00000000..2cba7fab
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,180 @@
+name: ci
+
+on:
+- pull_request
+- push
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        name:
+        - Node.js 0.8
+        - Node.js 0.10
+        - Node.js 0.12
+        - io.js 1.x
+        - io.js 2.x
+        - io.js 3.x
+        - Node.js 4.x
+        - Node.js 5.x
+        - Node.js 6.x
+        - Node.js 7.x
+        - Node.js 8.x
+        - Node.js 9.x
+        - Node.js 10.x
+        - Node.js 11.x
+        - Node.js 12.x
+        - Node.js 13.x
+        - Node.js 14.x
+        - Node.js 15.x
+        - Node.js 16.x
+
+        include:
+        - name: Node.js 0.8
+          node-version: "0.8"
+          npm-i: mocha@2.5.3 supertest@1.1.0
+          npm-rm: nyc
+
+        - name: Node.js 0.10
+          node-version: "0.10"
+          npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
+
+        - name: Node.js 0.12
+          node-version: "0.12"
+          npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
+
+        - name: io.js 1.x
+          node-version: "1.8"
+          npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
+
+        - name: io.js 2.x
+          node-version: "2.5"
+          npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
+
+        - name: io.js 3.x
+          node-version: "3.3"
+          npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
+
+        - name: Node.js 4.x
+          node-version: "4.9"
+          npm-i: mocha@5.2.0 nyc@11.9.0 supertest@3.4.2
+
+        - name: Node.js 5.x
+          node-version: "5.12"
+          npm-i: mocha@5.2.0 nyc@11.9.0 supertest@3.4.2
+
+        - name: Node.js 6.x
+          node-version: "6.17"
+          npm-i: mocha@6.2.2 nyc@14.1.1
+
+        - name: Node.js 7.x
+          node-version: "7.10"
+          npm-i: mocha@6.2.2 nyc@14.1.1
+
+        - name: Node.js 8.x
+          node-version: "8.17"
+          npm-i: mocha@7.2.0
+
+        - name: Node.js 9.x
+          node-version: "9.11"
+          npm-i: mocha@7.2.0
+
+        - name: Node.js 10.x
+          node-version: "10.24"
+
+        - name: Node.js 11.x
+          node-version: "11.15"
+
+        - name: Node.js 12.x
+          node-version: "12.22"
+
+        - name: Node.js 13.x
+          node-version: "13.14"
+
+        - name: Node.js 14.x
+          node-version: "14.17"
+
+        - name: Node.js 15.x
+          node-version: "15.14"
+
+        - name: Node.js 16.x
+          node-version: "16.1"
+
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Install Node.js ${{ matrix.node-version }}
+      shell: bash -eo pipefail -l {0}
+      run: |
+        nvm install --default ${{ matrix.node-version }}
+        if [[ "${{ matrix.node-version }}" == 0.* ]]; then
+          npm config set strict-ssl false
+        fi
+        dirname "$(nvm which ${{ matrix.node-version }})" >> "$GITHUB_PATH"
+
+    - name: Configure npm
+      run: npm config set shrinkwrap false
+
+    - name: Remove npm module(s) ${{ matrix.npm-rm }}
+      run: npm rm --silent --save-dev ${{ matrix.npm-rm }}
+      if: matrix.npm-rm != ''
+
+    - name: Install npm module(s) ${{ matrix.npm-i }}
+      run: npm install --save-dev ${{ matrix.npm-i }}
+      if: matrix.npm-i != ''
+
+    - name: Setup Node.js version-specific dependencies
+      shell: bash
+      run: |
+        # eslint for linting
+        # - remove on Node.js < 6
+        if [[ "$(cut -d. -f1 <<< "${{ matrix.node-version }}")" -lt 6 ]]; then
+          node -pe 'Object.keys(require("./package").devDependencies).join("\n")' | \
+            grep -E '^eslint(-|$)' | \
+            sort -r | \
+            xargs -n1 npm rm --silent --save-dev
+        fi
+
+    - name: Install Node.js dependencies
+      run: npm install
+
+    - name: List environment
+      id: list_env
+      shell: bash
+      run: |
+        echo "node@$(node -v)"
+        echo "npm@$(npm -v)"
+        npm -s ls ||:
+        (npm -s ls --depth=0 ||:) | awk -F'[ @]' 'NR>1 && $2 { print "::set-output name=" $2 "::" $3 }'
+
+    - name: Run tests
+      shell: bash
+      run: |
+        if npm -ps ls nyc | grep -q nyc; then
+          npm run test-ci
+        else
+          npm test
+        fi
+
+    - name: Lint code
+      if: steps.list_env.outputs.eslint != ''
+      run: npm run lint
+
+    - name: Collect code coverage
+      uses: coverallsapp/github-action@master
+      if: steps.list_env.outputs.nyc != ''
+      with:
+        github-token: ${{ secrets.GITHUB_TOKEN }}
+        flag-name: run-${{ matrix.test_number }}
+        parallel: true
+
+  coverage:
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+    - name: Upload code coverage
+      uses: coverallsapp/github-action@master
+      with:
+        github-token: ${{ secrets.github_token }}
+        parallel-finished: true
diff --git a/.travis.yml b/.travis.yml
deleted file mode 100644
index 2e7e2e23..00000000
--- a/.travis.yml
+++ /dev/null
@@ -1,112 +0,0 @@
-language: node_js
-node_js:
-  - "0.8"
-  - "0.10"
-  - "0.12"
-  - "1.8"
-  - "2.5"
-  - "3.3"
-  - "4.9"
-  - "5.12"
-  - "6.17"
-  - "7.10"
-  - "8.17"
-  - "9.11"
-  - "10.24"
-  - "11.15"
-  - "12.22"
-  - "13.14"
-  - "14.16"
-  - "15.12"
-  - "16.1"
-cache:
-  directories:
-    - node_modules
-before_install:
-  - |
-    # Setup utility functions
-    function node_version_lt () {
-      [[ "$(v "$TRAVIS_NODE_VERSION")" -lt "$(v "${1}")" ]]
-    }
-    function npm_module_installed () {
-      npm -lsp ls | grep -Fq "$(pwd)/node_modules/${1}:${1}@"
-    }
-    function npm_remove_module_re () {
-      node -e '
-        fs = require("fs");
-        p = JSON.parse(fs.readFileSync("package.json", "utf8"));
-        r = RegExp(process.argv[1]);
-        for (k in p.devDependencies) {
-          if (r.test(k)) delete p.devDependencies[k];
-        }
-        fs.writeFileSync("package.json", JSON.stringify(p, null, 2) + "\n");
-      ' "$@"
-    }
-    function npm_use_module () {
-      node -e '
-        fs = require("fs");
-        p = JSON.parse(fs.readFileSync("package.json", "utf8"));
-        p.devDependencies[process.argv[1]] = process.argv[2];
-        fs.writeFileSync("package.json", JSON.stringify(p, null, 2) + "\n");
-      ' "$@"
-    }
-    function v () {
-      tr '.' '\n' <<< "${1}" \
-        | awk '{ printf "%03d", $0 }' \
-        | sed 's/^0*//'
-    }
-  # Configure npm
-  - |
-    # Skip updating shrinkwrap / lock
-    npm config set shrinkwrap false
-  # Setup Node.js version-specific dependencies
-  - |
-    # Configure eslint for linting
-    if node_version_lt '6.0'; then npm_remove_module_re '^eslint(-|$)'
-    fi
-  - |
-    # Configure mocha for testing
-    if   node_version_lt '0.10'; then npm_use_module 'mocha' '2.5.3'
-    elif node_version_lt '4.0' ; then npm_use_module 'mocha' '3.5.3'
-    elif node_version_lt '6.0' ; then npm_use_module 'mocha' '5.2.0'
-    elif node_version_lt '8.0' ; then npm_use_module 'mocha' '6.2.2'
-    elif node_version_lt '10.0'; then npm_use_module 'mocha' '7.2.0'
-    fi
-  - |
-    # Configure nyc for coverage
-    if   node_version_lt '0.10'; then npm_remove_module_re '^nyc$'
-    elif node_version_lt '4.0' ; then npm_use_module 'nyc' '10.3.2'
-    elif node_version_lt '6.0' ; then npm_use_module 'nyc' '11.9.0'
-    elif node_version_lt '8.0' ; then npm_use_module 'nyc' '14.1.1'
-    fi
-  - |
-    # Configure supertest for http calls
-    if   node_version_lt '0.10'; then npm_use_module 'supertest' '1.1.0'
-    elif node_version_lt '4.0' ; then npm_use_module 'supertest' '2.0.0'
-    elif node_version_lt '6.0' ; then npm_use_module 'supertest' '3.4.2'
-    fi
-  # Update Node.js modules
-  - |
-    # Prune & rebuild node_modules
-    if [[ -d node_modules ]]; then
-      npm prune
-      npm rebuild
-    fi
-
-script:
-  - |
-    # Run test script, depending on nyc install
-    if npm_module_installed 'nyc'; then npm run-script test-travis
-    else npm test
-    fi
-  - |
-    # Run linting, depending on eslint install
-    if npm_module_installed 'eslint'; then npm run-script lint
-    fi
-after_script:
-  - |
-    # Upload coverage to coveralls, if exists
-    if [[ -d .nyc_output ]]; then
-      npm install --save-dev coveralls@2
-      nyc report --reporter=text-lcov | coveralls
-    fi
diff --git a/README.md b/README.md
index 77531505..01477c39 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@
 
 [![NPM Version][npm-version-image]][npm-url]
 [![NPM Downloads][npm-downloads-image]][node-url]
-[![Build Status][travis-image]][travis-url]
+[![Build Status][ci-image]][ci-url]
 [![Test Coverage][coveralls-image]][coveralls-url]
 
 ## Installation
@@ -881,11 +881,11 @@ On Windows, use the corresponding command;
 [MIT](LICENSE)
 
 [rfc-6265bis-03-4.1.2.7]: https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-03#section-4.1.2.7
+[ci-image]: https://badgen.net/github/checks/expressjs/session/master?label=ci
+[ci-url]: https://github.com/expressjs/session/actions?query=workflow%3Aci
 [coveralls-image]: https://badgen.net/coveralls/c/github/expressjs/session/master
 [coveralls-url]: https://coveralls.io/r/expressjs/session?branch=master
 [node-url]: https://nodejs.org/en/download
 [npm-downloads-image]: https://badgen.net/npm/dm/express-session
 [npm-url]: https://npmjs.org/package/express-session
 [npm-version-image]: https://badgen.net/npm/v/express-session
-[travis-image]: https://badgen.net/travis/expressjs/session/master
-[travis-url]: https://travis-ci.org/expressjs/session
diff --git a/package.json b/package.json
index f216c9fb..634b4f99 100644
--- a/package.json
+++ b/package.json
@@ -41,8 +41,8 @@
   "scripts": {
     "lint": "eslint --plugin markdown --ext js,md . && node ./scripts/lint-readme.js",
     "test": "mocha --require test/support/env --check-leaks --bail --no-exit --reporter spec test/",
+    "test-ci": "nyc --reporter=lcov --reporter=text npm test",
     "test-cov": "nyc npm test",
-    "test-travis": "nyc npm test -- --no-exit",
     "version": "node scripts/version-history.js && git add HISTORY.md"
   }
 }

From 9a1cc15efbc637a9d4503eb8f8f51a25461a51e3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 19 May 2021 08:10:33 -0400
Subject: [PATCH 147/272] build: eslint@7.26.0

---
 .eslintrc.yml            | 2 +-
 .github/workflows/ci.yml | 4 ++--
 package.json             | 2 +-
 test/session.js          | 8 ++++----
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.eslintrc.yml b/.eslintrc.yml
index 0740b11f..fe10d7ea 100644
--- a/.eslintrc.yml
+++ b/.eslintrc.yml
@@ -2,7 +2,7 @@ root: true
 rules:
   eol-last: error
   eqeqeq: ["error", "always", { "null": "ignore" }]
-  indent: ["error", 2, { "SwitchCase": 1 }]
+  indent: ["error", 2, { "MemberExpression": "off", "SwitchCase": 1 }]
   no-mixed-spaces-and-tabs: error
   no-trailing-spaces: error
   one-var: ["error", { "initialized": "never" }]
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2cba7fab..b52cfc9e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -128,8 +128,8 @@ jobs:
       shell: bash
       run: |
         # eslint for linting
-        # - remove on Node.js < 6
-        if [[ "$(cut -d. -f1 <<< "${{ matrix.node-version }}")" -lt 6 ]]; then
+        # - remove on Node.js < 10
+        if [[ "$(cut -d. -f1 <<< "${{ matrix.node-version }}")" -lt 10 ]]; then
           node -pe 'Object.keys(require("./package").devDependencies).join("\n")' | \
             grep -E '^eslint(-|$)' | \
             sort -r | \
diff --git a/package.json b/package.json
index 634b4f99..5185b37d 100644
--- a/package.json
+++ b/package.json
@@ -22,7 +22,7 @@
   "devDependencies": {
     "after": "0.8.2",
     "cookie-parser": "1.4.5",
-    "eslint": "3.19.0",
+    "eslint": "7.26.0",
     "eslint-plugin-markdown": "1.0.2",
     "express": "4.17.1",
     "mocha": "8.4.0",
diff --git a/test/session.js b/test/session.js
index 021b3251..7ce3c194 100644
--- a/test/session.js
+++ b/test/session.js
@@ -622,8 +622,8 @@ describe('session()', function(){
       before(function () {
         function setup (req) {
           req.secure = req.headers['x-secure']
-              ? JSON.parse(req.headers['x-secure'])
-              : undefined
+            ? JSON.parse(req.headers['x-secure'])
+            : undefined
         }
 
         function respond (req, res) {
@@ -655,8 +655,8 @@ describe('session()', function(){
       before(function () {
         function setup (req) {
           req.secure = req.headers['x-secure']
-              ? JSON.parse(req.headers['x-secure'])
-              : undefined
+            ? JSON.parse(req.headers['x-secure'])
+            : undefined
         }
 
         function respond (req, res) {

From 45cbbf4108ed9e05470d638ec0f6cb7be8b5f12a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 19 May 2021 08:13:08 -0400
Subject: [PATCH 148/272] bulid: eslint-plugin-markdown@2.1.0

---
 .eslintrc.yml | 7 +++++++
 package.json  | 4 ++--
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/.eslintrc.yml b/.eslintrc.yml
index fe10d7ea..b6b9f62f 100644
--- a/.eslintrc.yml
+++ b/.eslintrc.yml
@@ -1,4 +1,11 @@
 root: true
+extends:
+  - plugin:markdown/recommended
+plugins:
+  - markdown
+overrides:
+  - files: '**/*.md'
+    processor: 'markdown/markdown'
 rules:
   eol-last: error
   eqeqeq: ["error", "always", { "null": "ignore" }]
diff --git a/package.json b/package.json
index 5185b37d..c9e38fa9 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,7 @@
     "after": "0.8.2",
     "cookie-parser": "1.4.5",
     "eslint": "7.26.0",
-    "eslint-plugin-markdown": "1.0.2",
+    "eslint-plugin-markdown": "2.1.0",
     "express": "4.17.1",
     "mocha": "8.4.0",
     "nyc": "15.1.0",
@@ -39,7 +39,7 @@
     "node": ">= 0.8.0"
   },
   "scripts": {
-    "lint": "eslint --plugin markdown --ext js,md . && node ./scripts/lint-readme.js",
+    "lint": "eslint . && node ./scripts/lint-readme.js",
     "test": "mocha --require test/support/env --check-leaks --bail --no-exit --reporter spec test/",
     "test-ci": "nyc --reporter=lcov --reporter=text npm test",
     "test-cov": "nyc npm test",

From 4baea4a3750cfd933aba32d91dabfd494174ec86 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 19 May 2021 08:52:55 -0400
Subject: [PATCH 149/272] build: Node.js@16.2

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b52cfc9e..3c1182bd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -99,7 +99,7 @@ jobs:
           node-version: "15.14"
 
         - name: Node.js 16.x
-          node-version: "16.1"
+          node-version: "16.2"
 
     steps:
     - uses: actions/checkout@v2

From 0048bcac451ad867299d404aca94c79cc8bc751d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 19 May 2021 13:33:52 -0400
Subject: [PATCH 150/272] 1.17.2

---
 HISTORY.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 4fa89ab4..774607dc 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+1.17.2 / 2021-05-19
+===================
 
   * Fix `res.end` patch to always commit headers
   * deps: cookie@0.4.1
diff --git a/package.json b/package.json
index c9e38fa9..d085f292 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.17.1",
+  "version": "1.17.2",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From bccab373df5626a9e1635afcf3661d1e89b4ccae Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 12 Nov 2021 21:09:00 -0500
Subject: [PATCH 151/272] build: update CI for npm TLS upgrade

---
 .github/workflows/ci.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3c1182bd..fc4de3e9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -108,7 +108,10 @@ jobs:
       shell: bash -eo pipefail -l {0}
       run: |
         nvm install --default ${{ matrix.node-version }}
-        if [[ "${{ matrix.node-version }}" == 0.* ]]; then
+        if [[ "${{ matrix.node-version }}" == 0.* && "$(cut -d. -f2 <<< "${{ matrix.node-version }}")" -lt 10 ]]; then
+          nvm install --alias=npm 0.10
+          nvm use ${{ matrix.node-version }}
+          sed -i '1s;^.*$;'"$(printf '#!%q' "$(nvm which npm)")"';' "$(readlink -f "$(which npm)")"
           npm config set strict-ssl false
         fi
         dirname "$(nvm which ${{ matrix.node-version }})" >> "$GITHUB_PATH"

From ae3269e9733792bee584e58f03d907ad2a522352 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 12 Nov 2021 21:15:13 -0500
Subject: [PATCH 152/272] build: eslint-plugin-markdown@2.2.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index d085f292..e66b200f 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,7 @@
     "after": "0.8.2",
     "cookie-parser": "1.4.5",
     "eslint": "7.26.0",
-    "eslint-plugin-markdown": "2.1.0",
+    "eslint-plugin-markdown": "2.2.1",
     "express": "4.17.1",
     "mocha": "8.4.0",
     "nyc": "15.1.0",

From d6c5c19b9f2270e04a64732987bd27a41d2b8ff1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 12 Nov 2021 21:19:50 -0500
Subject: [PATCH 153/272] build: eslint@7.32.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index e66b200f..c590dfc2 100644
--- a/package.json
+++ b/package.json
@@ -22,7 +22,7 @@
   "devDependencies": {
     "after": "0.8.2",
     "cookie-parser": "1.4.5",
-    "eslint": "7.26.0",
+    "eslint": "7.32.0",
     "eslint-plugin-markdown": "2.2.1",
     "express": "4.17.1",
     "mocha": "8.4.0",

From 81a15883317f052b48c17ab9638dc2cdcdceb0fc Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 1 Dec 2021 23:41:13 -0500
Subject: [PATCH 154/272] build: mocha@9.1.3

---
 .github/workflows/ci.yml | 2 ++
 package.json             | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fc4de3e9..6340057c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -82,9 +82,11 @@ jobs:
 
         - name: Node.js 10.x
           node-version: "10.24"
+          npm-i: mocha@8.4.0
 
         - name: Node.js 11.x
           node-version: "11.15"
+          npm-i: mocha@8.4.0
 
         - name: Node.js 12.x
           node-version: "12.22"
diff --git a/package.json b/package.json
index c590dfc2..be6ccc7b 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "7.32.0",
     "eslint-plugin-markdown": "2.2.1",
     "express": "4.17.1",
-    "mocha": "8.4.0",
+    "mocha": "9.1.3",
     "nyc": "15.1.0",
     "supertest": "6.1.3"
   },

From 0a1534abce1bf4f115aa8c6171fc0db327ab89fa Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 1 Dec 2021 23:43:27 -0500
Subject: [PATCH 155/272] build: cookie-parser@1.4.6

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index be6ccc7b..3f1bd5f9 100644
--- a/package.json
+++ b/package.json
@@ -21,7 +21,7 @@
   },
   "devDependencies": {
     "after": "0.8.2",
-    "cookie-parser": "1.4.5",
+    "cookie-parser": "1.4.6",
     "eslint": "7.32.0",
     "eslint-plugin-markdown": "2.2.1",
     "express": "4.17.1",

From 2f6cc21a23a1393c0740c6f6bda3261fcabee077 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C3=ABl=20Zasso?= <targos@protonmail.com>
Date: Mon, 6 Sep 2021 13:32:29 +0200
Subject: [PATCH 156/272] build: Node.js@16.9

closes #844
---
 .github/workflows/ci.yml | 2 +-
 test/session.js          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6340057c..d06912fe 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -101,7 +101,7 @@ jobs:
           node-version: "15.14"
 
         - name: Node.js 16.x
-          node-version: "16.2"
+          node-version: "16.9"
 
     steps:
     - uses: actions/checkout@v2
diff --git a/test/session.js b/test/session.js
index 7ce3c194..425ed2bc 100644
--- a/test/session.js
+++ b/test/session.js
@@ -581,7 +581,7 @@ describe('session()', function(){
           request(server)
           .get('/')
           .set('Cookie', cookie(res))
-          .expect(500, /Cannot read property/, done)
+          .expect(500, /Cannot read prop/, done)
         })
       })
     })

From 9ab975338843d84a6c3fe8e52939f3a186f32df9 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 23 Dec 2021 21:57:34 -0500
Subject: [PATCH 157/272] build: supertest@6.1.6

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 3f1bd5f9..03078057 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "express": "4.17.1",
     "mocha": "9.1.3",
     "nyc": "15.1.0",
-    "supertest": "6.1.3"
+    "supertest": "6.1.6"
   },
   "files": [
     "session/",

From 6782719ebecc8a6fe2cd5d24b79501bc8cce9474 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 23 Dec 2021 21:58:27 -0500
Subject: [PATCH 158/272] build: express@4.17.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 03078057..f83da9c0 100644
--- a/package.json
+++ b/package.json
@@ -24,7 +24,7 @@
     "cookie-parser": "1.4.6",
     "eslint": "7.32.0",
     "eslint-plugin-markdown": "2.2.1",
-    "express": "4.17.1",
+    "express": "4.17.2",
     "mocha": "9.1.3",
     "nyc": "15.1.0",
     "supertest": "6.1.6"

From b40e624ae8824f1d44500b0ea774ce97dfaf91b6 Mon Sep 17 00:00:00 2001
From: Max Andersson <max.andersson@neotechnology.com>
Date: Wed, 20 Oct 2021 11:18:06 +0100
Subject: [PATCH 159/272] docs: add connect-neo4j to the list of session stores

closes #851
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 01477c39..2d1963b7 100644
--- a/README.md
+++ b/README.md
@@ -631,6 +631,11 @@ and other multi-core embedded devices).
 [connect-mssql-v2-url]: https://www.npmjs.com/package/connect-mssql-v2
 [connect-mssql-v2-image]: https://badgen.net/github/stars/jluboff/connect-mssql-v2?label=%E2%98%85
 
+[![★][connect-neo4j-image] connect-neo4j][connect-neo4j-url] A [Neo4j](https://neo4j.com)-based session store.
+
+[connect-neo4j-url]: https://www.npmjs.com/package/connect-neo4j
+[connect-neo4j-image]: https://badgen.net/github/stars/MaxAndersson/connect-neo4j?label=%E2%98%85
+
 [![★][connect-pg-simple-image] connect-pg-simple][connect-pg-simple-url] A PostgreSQL-based session store.
 
 [connect-pg-simple-url]: https://www.npmjs.com/package/connect-pg-simple

From 72ee3081a3577923dbfc739d2574d1938e15a07e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 23 Dec 2021 22:15:35 -0500
Subject: [PATCH 160/272] build: Node.js@16.13

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d06912fe..462696b1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -101,7 +101,7 @@ jobs:
           node-version: "15.14"
 
         - name: Node.js 16.x
-          node-version: "16.9"
+          node-version: "16.13"
 
     steps:
     - uses: actions/checkout@v2

From e2d3dfa5551a3506f0209fd482b0616d58d20784 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 23 Dec 2021 22:16:01 -0500
Subject: [PATCH 161/272] build: support Node.js 17.x

---
 .github/workflows/ci.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 462696b1..d3cf49ed 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,6 +29,7 @@ jobs:
         - Node.js 14.x
         - Node.js 15.x
         - Node.js 16.x
+        - Node.js 17.x
 
         include:
         - name: Node.js 0.8
@@ -103,6 +104,9 @@ jobs:
         - name: Node.js 16.x
           node-version: "16.13"
 
+        - name: Node.js 17.x
+          node-version: "17.3"
+
     steps:
     - uses: actions/checkout@v2
 

From 66634e9f77132a444dfda7e279a399054e3b28df Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 23 Dec 2021 22:19:48 -0500
Subject: [PATCH 162/272] build: Node.js@14.18

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d3cf49ed..1f69a643 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -96,7 +96,7 @@ jobs:
           node-version: "13.14"
 
         - name: Node.js 14.x
-          node-version: "14.17"
+          node-version: "14.18"
 
         - name: Node.js 15.x
           node-version: "15.14"

From c2eefb8572e8bf74789946886ec1dacebaeea368 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 6 Feb 2022 21:11:28 -0500
Subject: [PATCH 163/272] build: use mocha@2.5.3 for Node.js < 4

---
 .github/workflows/ci.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1f69a643..d1cc3499 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -39,23 +39,23 @@ jobs:
 
         - name: Node.js 0.10
           node-version: "0.10"
-          npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
+          npm-i: mocha@2.5.3 nyc@10.3.2 supertest@2.0.0
 
         - name: Node.js 0.12
           node-version: "0.12"
-          npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
+          npm-i: mocha@2.5.3 nyc@10.3.2 supertest@2.0.0
 
         - name: io.js 1.x
           node-version: "1.8"
-          npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
+          npm-i: mocha@2.5.3 nyc@10.3.2 supertest@2.0.0
 
         - name: io.js 2.x
           node-version: "2.5"
-          npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
+          npm-i: mocha@2.5.3 nyc@10.3.2 supertest@2.0.0
 
         - name: io.js 3.x
           node-version: "3.3"
-          npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
+          npm-i: mocha@2.5.3 nyc@10.3.2 supertest@2.0.0
 
         - name: Node.js 4.x
           node-version: "4.9"

From 3b91d4b2c733942713be2f6280be43e91ef36bc5 Mon Sep 17 00:00:00 2001
From: Travis Horn <travis@travishorn.com>
Date: Sun, 6 Feb 2022 14:08:07 -0600
Subject: [PATCH 164/272] docs: add connect-lowdb to the list of session stores

closes #873
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 2d1963b7..e2513c84 100644
--- a/README.md
+++ b/README.md
@@ -595,6 +595,11 @@ and other multi-core embedded devices).
 [connect-loki-url]: https://www.npmjs.com/package/connect-loki
 [connect-loki-image]: https://badgen.net/github/stars/Requarks/connect-loki?label=%E2%98%85
 
+[![★][connect-lowdb-image] connect-lowdb][connect-lowdb-url] A lowdb-based session store.
+
+[connect-lowdb-url]: https://www.npmjs.com/package/connect-lowdb
+[connect-lowdb-image]: https://badgen.net/github/stars/travishorn/connect-lowdb?label=%E2%98%85
+
 [![★][connect-memcached-image] connect-memcached][connect-memcached-url] A memcached-based session store.
 
 [connect-memcached-url]: https://www.npmjs.com/package/connect-memcached

From 99b93afd52b3de4234a79ee956d0e36ff6ca674b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 19 Feb 2022 20:03:00 -0500
Subject: [PATCH 165/272] build: Node.js@17.5

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d1cc3499..1136d442 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -105,7 +105,7 @@ jobs:
           node-version: "16.13"
 
         - name: Node.js 17.x
-          node-version: "17.3"
+          node-version: "17.5"
 
     steps:
     - uses: actions/checkout@v2

From 00dd7075f2d60f8c9f87e5a739a0739ba362e9c7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 19 Feb 2022 20:06:00 -0500
Subject: [PATCH 166/272] build: Node.js@16.14

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1136d442..7ed18da5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -102,7 +102,7 @@ jobs:
           node-version: "15.14"
 
         - name: Node.js 16.x
-          node-version: "16.13"
+          node-version: "16.14"
 
         - name: Node.js 17.x
           node-version: "17.5"

From 3b2406d00558dc6eaf42733579ec3f6af040f6cb Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 19 Feb 2022 20:09:37 -0500
Subject: [PATCH 167/272] build: Node.js@14.19

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7ed18da5..4018263c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -96,7 +96,7 @@ jobs:
           node-version: "13.14"
 
         - name: Node.js 14.x
-          node-version: "14.18"
+          node-version: "14.19"
 
         - name: Node.js 15.x
           node-version: "15.14"

From 8108059514c7e4ae420f2d4e86c6987518a4a2ff Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 22 Feb 2022 00:12:46 -0500
Subject: [PATCH 168/272] build: mocha@9.2.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index f83da9c0..f27aa2e2 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "7.32.0",
     "eslint-plugin-markdown": "2.2.1",
     "express": "4.17.2",
-    "mocha": "9.1.3",
+    "mocha": "9.2.1",
     "nyc": "15.1.0",
     "supertest": "6.1.6"
   },

From ca8e298823a8ebbc50de496c8f3bbc5909f78f16 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 22 Feb 2022 00:17:35 -0500
Subject: [PATCH 169/272] build: express@4.17.3

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index f27aa2e2..4744c9f7 100644
--- a/package.json
+++ b/package.json
@@ -24,7 +24,7 @@
     "cookie-parser": "1.4.6",
     "eslint": "7.32.0",
     "eslint-plugin-markdown": "2.2.1",
-    "express": "4.17.2",
+    "express": "4.17.3",
     "mocha": "9.2.1",
     "nyc": "15.1.0",
     "supertest": "6.1.6"

From 62d5df60f4d380a080d9a90b41ddb56b71446f35 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 3 Mar 2022 22:54:12 -0500
Subject: [PATCH 170/272] build: supertest@6.2.2

---
 .github/workflows/ci.yml | 4 ++--
 package.json             | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4018263c..1817a822 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -67,11 +67,11 @@ jobs:
 
         - name: Node.js 6.x
           node-version: "6.17"
-          npm-i: mocha@6.2.2 nyc@14.1.1
+          npm-i: mocha@6.2.2 nyc@14.1.1 supertest@6.1.6
 
         - name: Node.js 7.x
           node-version: "7.10"
-          npm-i: mocha@6.2.2 nyc@14.1.1
+          npm-i: mocha@6.2.2 nyc@14.1.1 supertest@6.1.6
 
         - name: Node.js 8.x
           node-version: "8.17"
diff --git a/package.json b/package.json
index 4744c9f7..5ae5f69a 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "express": "4.17.3",
     "mocha": "9.2.1",
     "nyc": "15.1.0",
-    "supertest": "6.1.6"
+    "supertest": "6.2.2"
   },
   "files": [
     "session/",

From 1c2a1d74f5e91948150af53eb406a89a218e0b09 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 3 Mar 2022 22:58:15 -0500
Subject: [PATCH 171/272] deps: cookie@0.4.2

---
 HISTORY.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index 774607dc..21cd8015 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * deps: cookie@0.4.2
+
 1.17.2 / 2021-05-19
 ===================
 
diff --git a/package.json b/package.json
index 5ae5f69a..ec8e8446 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,7 @@
   "repository": "expressjs/session",
   "license": "MIT",
   "dependencies": {
-    "cookie": "0.4.1",
+    "cookie": "0.4.2",
     "cookie-signature": "1.0.6",
     "debug": "2.6.9",
     "depd": "~2.0.0",

From 796cd0259a7c2122c80900332bc61f9eedc1fba7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 23 Mar 2022 18:55:23 -0400
Subject: [PATCH 172/272] build: Node.js@17.8

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1817a822..40e77f42 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -105,7 +105,7 @@ jobs:
           node-version: "16.14"
 
         - name: Node.js 17.x
-          node-version: "17.5"
+          node-version: "17.8"
 
     steps:
     - uses: actions/checkout@v2

From 9ea6d4a9e5614db8e667e7d8212b1f0e744f32d3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 23 Mar 2022 18:58:05 -0400
Subject: [PATCH 173/272] build: mocha@9.2.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index ec8e8446..965e7185 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "7.32.0",
     "eslint-plugin-markdown": "2.2.1",
     "express": "4.17.3",
-    "mocha": "9.2.1",
+    "mocha": "9.2.2",
     "nyc": "15.1.0",
     "supertest": "6.2.2"
   },

From 5df613c481bc7c5979aeaeac691b64ef0a5c4948 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 27 Mar 2022 14:10:03 -0400
Subject: [PATCH 174/272] docs: document default cookie.sameSite

closes #783
---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index e2513c84..0e2015d3 100644
--- a/README.md
+++ b/README.md
@@ -97,6 +97,7 @@ is the root path of the domain.
 ##### cookie.sameSite
 
 Specifies the `boolean` or `string` to be the value for the `SameSite` `Set-Cookie` attribute.
+By default, this is `false`.
 
   - `true` will set the `SameSite` attribute to `Strict` for strict same site enforcement.
   - `false` will not set the `SameSite` attribute.

From 070492992bd7a12b004b749d9215b344273b72ea Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 4 Apr 2022 19:43:16 -0400
Subject: [PATCH 175/272] docs: add user login example

---
 README.md | 85 ++++++++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 84 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 0e2015d3..45e68a98 100644
--- a/README.md
+++ b/README.md
@@ -829,7 +829,9 @@ based session store. Supports all backends supported by Fortune (MongoDB, Redis,
 [tch-nedb-session-url]: https://www.npmjs.com/package/tch-nedb-session
 [tch-nedb-session-image]: https://badgen.net/github/stars/tomaschyly/NeDBSession?label=%E2%98%85
 
-## Example
+## Examples
+
+### View counter
 
 A simple example using `express-session` to store page views for a user.
 
@@ -867,6 +869,87 @@ app.get('/foo', function (req, res, next) {
 app.get('/bar', function (req, res, next) {
   res.send('you viewed this page ' + req.session.views['/bar'] + ' times')
 })
+
+app.listen(3000)
+```
+
+### User login
+
+A simple example using `express-session` to keep a user log in session.
+
+```js
+var escapeHtml = require('escape-html')
+var express = require('express')
+var session = require('express-session')
+
+var app = express()
+
+app.use(session({
+  secret: 'keyboard cat',
+  resave: false,
+  saveUninitialized: true
+}))
+
+// middleware to test if authenticated
+function isAuthenticated (req, res, next) {
+  if (req.session.user) next()
+  else next('route')
+}
+
+app.get('/', isAuthenticated, function (req, res) {
+  // this is only called when there is an authentication user due to isAuthenticated
+  res.send('hello, ' + escapeHtml(req.session.user) + '!' +
+    ' <a href="/logout">Logout</a>')
+})
+
+app.get('/', function (req, res) {
+  res.send('<form action="/login" method="post">' +
+    'Username: <input name="user"><br>' +
+    'Password: <input name="pass" type="password"><br>' +
+    '<input type="submit" text="Login"></form>')
+})
+
+app.post('/login', express.urlencoded({ extended: false }), function (req, res) {
+  // login logic to validate req.body.user and req.body.pass
+  // would be implemented here. for this example any combo works
+
+  // regenerate the session, which is good practice to help
+  // guard against forms of session fixation
+  req.session.regenerate(function (err) {
+    if (err) next(err)
+
+    // store user information in session, typically a user id
+    req.session.user = req.body.user
+
+    // save the session before redirection to ensure page
+    // load does not happen before session is saved
+    req.session.save(function (err) {
+      if (err) return next(err)
+      res.redirect('/')
+    })
+  })
+})
+
+app.get('/logout', function (req, res, next) {
+  // logout logic
+
+  // clear the user from the session object and save.
+  // this will ensure that re-using the old session id
+  // does not have a logged in user
+  req.session.user = null
+  req.session.save(function (err) {
+    if (err) next(err)
+
+    // regenerate the session, which is good practice to help
+    // guard against forms of session fixation
+    req.session.regenerate(function (err) {
+      if (err) next(err)
+      res.redirect('/')
+    })
+  })
+})
+
+app.listen(3000)
 ```
 
 ## Debugging

From 78d1acd95ad07112c7bf4a5806730fb3f95ec792 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 12 Apr 2022 22:09:48 -0400
Subject: [PATCH 176/272] build: Node.js@17.9

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 40e77f42..ae4cd745 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -105,7 +105,7 @@ jobs:
           node-version: "16.14"
 
         - name: Node.js 17.x
-          node-version: "17.8"
+          node-version: "17.9"
 
     steps:
     - uses: actions/checkout@v2

From 18a10117962202ccc245a21590b0eef3a1e69fee Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 21 Apr 2022 21:54:27 -0400
Subject: [PATCH 177/272] build: support Node.js 18.x

---
 .github/workflows/ci.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ae4cd745..7847ca4a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -30,6 +30,7 @@ jobs:
         - Node.js 15.x
         - Node.js 16.x
         - Node.js 17.x
+        - Node.js 18.x
 
         include:
         - name: Node.js 0.8
@@ -107,6 +108,9 @@ jobs:
         - name: Node.js 17.x
           node-version: "17.9"
 
+        - name: Node.js 18.x
+          node-version: "18.0"
+
     steps:
     - uses: actions/checkout@v2
 

From 86ed9f3f6f3fed192ab85ea2c0db875c4942e3f0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 8 May 2022 20:41:49 -0400
Subject: [PATCH 178/272] build: supertest@6.2.3

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 965e7185..8cf683d6 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "express": "4.17.3",
     "mocha": "9.2.2",
     "nyc": "15.1.0",
-    "supertest": "6.2.2"
+    "supertest": "6.2.3"
   },
   "files": [
     "session/",

From 08f5dca7339517f59ca500b03b1da1deec996f66 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 8 May 2022 20:49:11 -0400
Subject: [PATCH 179/272] build: Node.js@16.15

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7847ca4a..bc591048 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -103,7 +103,7 @@ jobs:
           node-version: "15.14"
 
         - name: Node.js 16.x
-          node-version: "16.14"
+          node-version: "16.15"
 
         - name: Node.js 17.x
           node-version: "17.9"

From a1aebf29c8040a622631a60ad67f69a7815c0ceb Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 8 May 2022 20:55:19 -0400
Subject: [PATCH 180/272] build: mocha@10.0.0

---
 .github/workflows/ci.yml | 2 ++
 package.json             | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bc591048..7e662fb3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -92,9 +92,11 @@ jobs:
 
         - name: Node.js 12.x
           node-version: "12.22"
+          npm-i: mocha@9.2.2
 
         - name: Node.js 13.x
           node-version: "13.14"
+          npm-i: mocha@9.2.2
 
         - name: Node.js 14.x
           node-version: "14.19"
diff --git a/package.json b/package.json
index 8cf683d6..9723dfe5 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "7.32.0",
     "eslint-plugin-markdown": "2.2.1",
     "express": "4.17.3",
-    "mocha": "9.2.2",
+    "mocha": "10.0.0",
     "nyc": "15.1.0",
     "supertest": "6.2.3"
   },

From a06b0beda7e9686c19c2f3dd3d72114c80e8457d Mon Sep 17 00:00:00 2001
From: Noah Liechti <38284563+noahliechti@users.noreply.github.com>
Date: Fri, 14 Jan 2022 16:34:57 +0100
Subject: [PATCH 181/272] build: remove unnecessary entry from package files

closes #869
---
 package.json | 1 -
 1 file changed, 1 deletion(-)

diff --git a/package.json b/package.json
index 9723dfe5..15fec342 100644
--- a/package.json
+++ b/package.json
@@ -32,7 +32,6 @@
   "files": [
     "session/",
     "HISTORY.md",
-    "LICENSE",
     "index.js"
   ],
   "engines": {

From 99d6cdea3e04e6fb48c155c1e0ad507fde5d8702 Mon Sep 17 00:00:00 2001
From: Jeremy Neander <jeremy.neander@gmail.com>
Date: Mon, 18 Oct 2021 11:50:34 -0500
Subject: [PATCH 182/272] Fix resaving already-saved new session at end of
 request

closes #849
---
 HISTORY.md      |  1 +
 index.js        |  2 +-
 test/session.js | 25 +++++++++++++++++++++++++
 3 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index 21cd8015..64fee3c7 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Fix resaving already-saved new session at end of request
   * deps: cookie@0.4.2
 
 1.17.2 / 2021-05-19
diff --git a/index.js b/index.js
index d7efeab9..40a442ba 100644
--- a/index.js
+++ b/index.js
@@ -444,7 +444,7 @@ function session(options) {
         return false;
       }
 
-      return !saveUninitializedSession && cookieId !== req.sessionID
+      return !saveUninitializedSession && !savedHash && cookieId !== req.sessionID
         ? isModified(req.session)
         : !isSaved(req.session)
     }
diff --git a/test/session.js b/test/session.js
index 425ed2bc..7416b261 100644
--- a/test/session.js
+++ b/test/session.js
@@ -1775,6 +1775,31 @@ describe('session()', function(){
           .expect(200, 'saved', done)
         })
       })
+
+      describe('when saveUninitialized is false', function () {
+        it('should prevent end-of-request save', function (done) {
+          var store = new session.MemoryStore()
+          var server = createServer({ saveUninitialized: false, store: store }, function (req, res) {
+            req.session.hit = true
+            req.session.save(function (err) {
+              if (err) return res.end(err.message)
+              res.end('saved')
+            })
+          })
+
+          request(server)
+            .get('/')
+            .expect(shouldSetSessionInStore(store))
+            .expect(200, 'saved', function (err, res) {
+              if (err) return done(err)
+              request(server)
+                .get('/')
+                .set('Cookie', cookie(res))
+                .expect(shouldSetSessionInStore(store))
+                .expect(200, 'saved', done)
+            })
+        })
+      })
     })
 
     describe('.touch()', function () {

From 1010fadc2f071ddf2add94235d72224cf65159c6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 11 May 2022 14:51:00 -0400
Subject: [PATCH 183/272] 1.17.3

---
 HISTORY.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 64fee3c7..9fdd147f 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+1.17.3 / 2022-05-11
+===================
 
   * Fix resaving already-saved new session at end of request
   * deps: cookie@0.4.2
diff --git a/package.json b/package.json
index 15fec342..711e9866 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.17.2",
+  "version": "1.17.3",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From d06b73c3aaa08fda13e9834303d9556501f225b1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 12 Sep 2022 20:40:44 -0400
Subject: [PATCH 184/272] build: downgrade nyc on Node.js 8/9

---
 .github/workflows/ci.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7e662fb3..807849bc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -76,11 +76,11 @@ jobs:
 
         - name: Node.js 8.x
           node-version: "8.17"
-          npm-i: mocha@7.2.0
+          npm-i: mocha@7.2.0 nyc@14.1.1
 
         - name: Node.js 9.x
           node-version: "9.11"
-          npm-i: mocha@7.2.0
+          npm-i: mocha@7.2.0 nyc@14.1.1
 
         - name: Node.js 10.x
           node-version: "10.24"

From 1e992fd5794f15e9640d6d6e37b714ecb04f033b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 12 Sep 2022 20:47:06 -0400
Subject: [PATCH 185/272] build: Node.js@18.9

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 807849bc..b5af9c03 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -111,7 +111,7 @@ jobs:
           node-version: "17.9"
 
         - name: Node.js 18.x
-          node-version: "18.0"
+          node-version: "18.9"
 
     steps:
     - uses: actions/checkout@v2

From 4b38b12c4c156018392311d05db4a8fc6f31fb36 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 12 Dec 2022 20:38:38 -0500
Subject: [PATCH 186/272] build: mocha@10.2.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 711e9866..a2d2d119 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "7.32.0",
     "eslint-plugin-markdown": "2.2.1",
     "express": "4.17.3",
-    "mocha": "10.0.0",
+    "mocha": "10.2.0",
     "nyc": "15.1.0",
     "supertest": "6.2.3"
   },

From 4fafd15e5443f9d24d8dd12e59f5a5841c5a1de1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 12 Dec 2022 20:42:08 -0500
Subject: [PATCH 187/272] build: Node.js@16.19

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b5af9c03..98a8d85f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -105,7 +105,7 @@ jobs:
           node-version: "15.14"
 
         - name: Node.js 16.x
-          node-version: "16.15"
+          node-version: "16.19"
 
         - name: Node.js 17.x
           node-version: "17.9"

From a8968b80c6a19741d67458cf402aadfbf3fba7d7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 12 Dec 2022 20:43:49 -0500
Subject: [PATCH 188/272] build: Node.js@14.21

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 98a8d85f..4095d9b3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -99,7 +99,7 @@ jobs:
           npm-i: mocha@9.2.2
 
         - name: Node.js 14.x
-          node-version: "14.19"
+          node-version: "14.21"
 
         - name: Node.js 15.x
           node-version: "15.14"

From 474572597eac48ae2abd12b2df8741a13e6c2260 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 12 Dec 2022 20:45:17 -0500
Subject: [PATCH 189/272] build: Node.js@18.12

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4095d9b3..dcb37bed 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -111,7 +111,7 @@ jobs:
           node-version: "17.9"
 
         - name: Node.js 18.x
-          node-version: "18.9"
+          node-version: "18.12"
 
     steps:
     - uses: actions/checkout@v2

From a77973ba460aadd72afa8960ad01f463d23436ac Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 14 Jan 2023 22:53:53 -0500
Subject: [PATCH 190/272] build: support Node.js 19.x

---
 .github/workflows/ci.yml | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dcb37bed..33cd7fea 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -31,6 +31,7 @@ jobs:
         - Node.js 16.x
         - Node.js 17.x
         - Node.js 18.x
+        - Node.js 19.x
 
         include:
         - name: Node.js 0.8
@@ -113,6 +114,9 @@ jobs:
         - name: Node.js 18.x
           node-version: "18.12"
 
+        - name: Node.js 19.x
+          node-version: "19.4"
+
     steps:
     - uses: actions/checkout@v2
 
@@ -129,7 +133,12 @@ jobs:
         dirname "$(nvm which ${{ matrix.node-version }})" >> "$GITHUB_PATH"
 
     - name: Configure npm
-      run: npm config set shrinkwrap false
+      run: |
+        if [[ "$(npm config get package-lock)" == "true" ]]; then
+          npm config set package-lock false
+        else
+          npm config set shrinkwrap false
+        fi
 
     - name: Remove npm module(s) ${{ matrix.npm-rm }}
       run: npm rm --silent --save-dev ${{ matrix.npm-rm }}

From a1f7b0f6fa6c91ad9b0737f776ce273b7d8b64e8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 14 Jan 2023 22:58:49 -0500
Subject: [PATCH 191/272] build: supertest@6.3.3

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index a2d2d119..dbcf990b 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "express": "4.17.3",
     "mocha": "10.2.0",
     "nyc": "15.1.0",
-    "supertest": "6.2.3"
+    "supertest": "6.3.3"
   },
   "files": [
     "session/",

From d21a69faa8415c759f4464cb3890066351434e7c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 14 Jan 2023 23:02:12 -0500
Subject: [PATCH 192/272] build: eslint@8.31.0

---
 .github/workflows/ci.yml | 4 ++--
 package.json             | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 33cd7fea..7519f5cf 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -152,8 +152,8 @@ jobs:
       shell: bash
       run: |
         # eslint for linting
-        # - remove on Node.js < 10
-        if [[ "$(cut -d. -f1 <<< "${{ matrix.node-version }}")" -lt 10 ]]; then
+        # - remove on Node.js < 12
+        if [[ "$(cut -d. -f1 <<< "${{ matrix.node-version }}")" -lt 12 ]]; then
           node -pe 'Object.keys(require("./package").devDependencies).join("\n")' | \
             grep -E '^eslint(-|$)' | \
             sort -r | \
diff --git a/package.json b/package.json
index dbcf990b..ef7ad2dd 100644
--- a/package.json
+++ b/package.json
@@ -22,8 +22,8 @@
   "devDependencies": {
     "after": "0.8.2",
     "cookie-parser": "1.4.6",
-    "eslint": "7.32.0",
-    "eslint-plugin-markdown": "2.2.1",
+    "eslint": "8.31.0",
+    "eslint-plugin-markdown": "3.0.0",
     "express": "4.17.3",
     "mocha": "10.2.0",
     "nyc": "15.1.0",

From b57e1868b9ed38edc4703fbfef3261c364f57ea3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 3 May 2023 18:44:55 -0400
Subject: [PATCH 193/272] build: Node.js@18.16

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7519f5cf..c96b39e1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -112,7 +112,7 @@ jobs:
           node-version: "17.9"
 
         - name: Node.js 18.x
-          node-version: "18.12"
+          node-version: "18.16"
 
         - name: Node.js 19.x
           node-version: "19.4"

From 249ea7259abf25b4d396652b338359408e6db4b2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 3 May 2023 18:47:26 -0400
Subject: [PATCH 194/272] build: Node.js@19.9

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c96b39e1..7b8c7cf6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -115,7 +115,7 @@ jobs:
           node-version: "18.16"
 
         - name: Node.js 19.x
-          node-version: "19.4"
+          node-version: "19.9"
 
     steps:
     - uses: actions/checkout@v2

From bd69beef941a982013a21704fa8eb7214db13765 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 3 May 2023 18:49:08 -0400
Subject: [PATCH 195/272] build: support Node.js 20.x

---
 .github/workflows/ci.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7b8c7cf6..02605500 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,6 +32,7 @@ jobs:
         - Node.js 17.x
         - Node.js 18.x
         - Node.js 19.x
+        - Node.js 20.x
 
         include:
         - name: Node.js 0.8
@@ -117,6 +118,9 @@ jobs:
         - name: Node.js 19.x
           node-version: "19.9"
 
+        - name: Node.js 20.x
+          node-version: "20.1"
+
     steps:
     - uses: actions/checkout@v2
 

From 710ae0620eae293d765882fc7056f0511218e525 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 Jun 2023 22:49:45 -0400
Subject: [PATCH 196/272] build: eslint@8.42.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index ef7ad2dd..ee0252f0 100644
--- a/package.json
+++ b/package.json
@@ -22,7 +22,7 @@
   "devDependencies": {
     "after": "0.8.2",
     "cookie-parser": "1.4.6",
-    "eslint": "8.31.0",
+    "eslint": "8.42.0",
     "eslint-plugin-markdown": "3.0.0",
     "express": "4.17.3",
     "mocha": "10.2.0",

From d8a8fe23e78e65b81e6e1ab4bcaa13061fa4a89f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 Jun 2023 23:02:49 -0400
Subject: [PATCH 197/272] Support any type in "secret" that crypto.createHmac
 supports

---
 HISTORY.md      |  6 ++++++
 README.md       | 13 +++++++------
 package.json    |  2 +-
 test/session.js | 45 +++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 59 insertions(+), 7 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 9fdd147f..30facb56 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,9 @@
+unreleased
+==========
+
+  * Support any type in `secret` that `crypto.createHmac` supports
+  * deps: cookie-signature@1.0.7
+
 1.17.3 / 2022-05-11
 ===================
 
diff --git a/README.md b/README.md
index 45e68a98..b5dbcba5 100644
--- a/README.md
+++ b/README.md
@@ -274,12 +274,13 @@ it to be saved. *This has been fixed in PassportJS 0.3.0*
 
 **Required option**
 
-This is the secret used to sign the session ID cookie. This can be either a string
-for a single secret, or an array of multiple secrets. If an array of secrets is
-provided, only the first element will be used to sign the session ID cookie, while
-all the elements will be considered when verifying the signature in requests. The
-secret itself should be not easily parsed by a human and would best be a random set
-of characters. A best practice may include:
+This is the secret used to sign the session ID cookie. The secret can be any type
+of value that is supported by Node.js `crypto.createHmac` (like a string or a
+`Buffer`). This can be either a single secret, or an array of multiple secrets. If
+an array of secrets is provided, only the first element will be used to sign the
+session ID cookie, while all the elements will be considered when verifying the
+signature in requests. The secret itself should be not easily parsed by a human and
+would best be a random set of characters. A best practice may include:
 
   - The use of environment variables to store the secret, ensuring the secret itself
     does not exist in your repository.
diff --git a/package.json b/package.json
index ee0252f0..b58aea28 100644
--- a/package.json
+++ b/package.json
@@ -11,7 +11,7 @@
   "license": "MIT",
   "dependencies": {
     "cookie": "0.4.2",
-    "cookie-signature": "1.0.6",
+    "cookie-signature": "1.0.7",
     "debug": "2.6.9",
     "depd": "~2.0.0",
     "on-headers": "~1.0.2",
diff --git a/test/session.js b/test/session.js
index 7416b261..09893902 100644
--- a/test/session.js
+++ b/test/session.js
@@ -2,6 +2,7 @@
 var after = require('after')
 var assert = require('assert')
 var cookieParser = require('cookie-parser')
+var crypto = require('crypto')
 var express = require('express')
 var fs = require('fs')
 var http = require('http')
@@ -1197,6 +1198,50 @@ describe('session()', function(){
       assert.throws(createServer.bind(null, { secret: [] }), /secret option array/);
     })
 
+    it('should sign and unsign with a string', function (done) {
+      var server = createServer({ secret: 'awesome cat' }, function (req, res) {
+        if (!req.session.user) {
+          req.session.user = 'bob'
+          res.end('set')
+        } else {
+          res.end('get:' + JSON.stringify(req.session.user))
+        }
+      })
+
+      request(server)
+        .get('/')
+        .expect(shouldSetCookie('connect.sid'))
+        .expect(200, 'set', function (err, res) {
+          if (err) return done(err)
+          request(server)
+            .get('/')
+            .set('Cookie', cookie(res))
+            .expect(200, 'get:"bob"', done)
+        })
+    })
+
+    it('should sign and unsign with a Buffer', function (done) {
+      var server = createServer({ secret: crypto.randomBytes(32) }, function (req, res) {
+        if (!req.session.user) {
+          req.session.user = 'bob'
+          res.end('set')
+        } else {
+          res.end('get:' + JSON.stringify(req.session.user))
+        }
+      })
+
+      request(server)
+        .get('/')
+        .expect(shouldSetCookie('connect.sid'))
+        .expect(200, 'set', function (err, res) {
+          if (err) return done(err)
+          request(server)
+            .get('/')
+            .set('Cookie', cookie(res))
+            .expect(200, 'get:"bob"', done)
+        })
+    })
+
     describe('when an array', function () {
       it('should sign cookies', function (done) {
         var server = createServer({ secret: ['keyboard cat', 'nyan cat'] }, function (req, res) {

From b3530542ec675d6a9d913837f1a4853b550a3cff Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 16 Aug 2023 20:43:37 -0400
Subject: [PATCH 198/272] build: Node.js@20.5

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 02605500..9c841b72 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -119,7 +119,7 @@ jobs:
           node-version: "19.9"
 
         - name: Node.js 20.x
-          node-version: "20.1"
+          node-version: "20.5"
 
     steps:
     - uses: actions/checkout@v2

From 7adb9fec0ac0875a6cce73b6b4eade9b11b65d53 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 16 Aug 2023 20:46:22 -0400
Subject: [PATCH 199/272] build: Node.js@18.17

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9c841b72..dd6b1f25 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -113,7 +113,7 @@ jobs:
           node-version: "17.9"
 
         - name: Node.js 18.x
-          node-version: "18.16"
+          node-version: "18.17"
 
         - name: Node.js 19.x
           node-version: "19.9"

From addaa54541a285c6e725b05d5e81fc6542111dce Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 16 Aug 2023 20:47:14 -0400
Subject: [PATCH 200/272] build: Node.js@16.20

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dd6b1f25..502a3280 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -107,7 +107,7 @@ jobs:
           node-version: "15.14"
 
         - name: Node.js 16.x
-          node-version: "16.19"
+          node-version: "16.20"
 
         - name: Node.js 17.x
           node-version: "17.9"

From 49e5eb67b72dd8e5618f9f9317828d696520d960 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 12 Sep 2023 19:54:52 -0400
Subject: [PATCH 201/272] build: eslint@8.49.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index b58aea28..0aa03a97 100644
--- a/package.json
+++ b/package.json
@@ -22,7 +22,7 @@
   "devDependencies": {
     "after": "0.8.2",
     "cookie-parser": "1.4.6",
-    "eslint": "8.42.0",
+    "eslint": "8.49.0",
     "eslint-plugin-markdown": "3.0.0",
     "express": "4.17.3",
     "mocha": "10.2.0",

From 25cedf86553bf89c7ea81c8a12cc479d9bd8defd Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 12 Sep 2023 19:57:08 -0400
Subject: [PATCH 202/272] build: eslint-plugin-markdown@3.0.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 0aa03a97..597df1a9 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,7 @@
     "after": "0.8.2",
     "cookie-parser": "1.4.6",
     "eslint": "8.49.0",
-    "eslint-plugin-markdown": "3.0.0",
+    "eslint-plugin-markdown": "3.0.1",
     "express": "4.17.3",
     "mocha": "10.2.0",
     "nyc": "15.1.0",

From 54a8ee59e533639fbede38f00884e6ef0580e516 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 7 Nov 2023 23:10:58 -0500
Subject: [PATCH 203/272] build: support Node.js 21.x

---
 .github/workflows/ci.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 502a3280..ba089e20 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,6 +33,7 @@ jobs:
         - Node.js 18.x
         - Node.js 19.x
         - Node.js 20.x
+        - Node.js 21.x
 
         include:
         - name: Node.js 0.8
@@ -121,6 +122,9 @@ jobs:
         - name: Node.js 20.x
           node-version: "20.5"
 
+        - name: Node.js 21.x
+          node-version: "21.1"
+
     steps:
     - uses: actions/checkout@v2
 

From e942982391130adeea57d5555ebfc0b83f6bee1e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 7 Nov 2023 23:12:06 -0500
Subject: [PATCH 204/272] build: Node.js@20.9

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ba089e20..65a945cb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -120,7 +120,7 @@ jobs:
           node-version: "19.9"
 
         - name: Node.js 20.x
-          node-version: "20.5"
+          node-version: "20.9"
 
         - name: Node.js 21.x
           node-version: "21.1"

From fc24b2640abd9ebec295ff3b426c09691ef51e7a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 7 Nov 2023 23:14:32 -0500
Subject: [PATCH 205/272] build: Node.js@18.18

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 65a945cb..4c51044d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -114,7 +114,7 @@ jobs:
           node-version: "17.9"
 
         - name: Node.js 18.x
-          node-version: "18.17"
+          node-version: "18.18"
 
         - name: Node.js 19.x
           node-version: "19.9"

From 4bfc5baa0dc368352faf41e340fea812dee90fbd Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 10 Dec 2023 20:33:10 -0500
Subject: [PATCH 206/272] build: use $GITHUB_OUTPUT for environment list

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4c51044d..b0c097c9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -178,7 +178,7 @@ jobs:
         echo "node@$(node -v)"
         echo "npm@$(npm -v)"
         npm -s ls ||:
-        (npm -s ls --depth=0 ||:) | awk -F'[ @]' 'NR>1 && $2 { print "::set-output name=" $2 "::" $3 }'
+        (npm -s ls --depth=0 ||:) | awk -F'[ @]' 'NR>1 && $2 { print $2 "=" $3 }' >> "$GITHUB_OUTPUT"
 
     - name: Run tests
       shell: bash

From c1611ad8b3f9c7564d130040c2b188293727e155 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 10 Dec 2023 20:34:20 -0500
Subject: [PATCH 207/272] build: actions/checkout@v3

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b0c097c9..7c3ee7df 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -126,7 +126,7 @@ jobs:
           node-version: "21.1"
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
 
     - name: Install Node.js ${{ matrix.node-version }}
       shell: bash -eo pipefail -l {0}

From 825e6c00c13d472be8b08f202209668ad3a1769d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 10 Dec 2023 20:38:10 -0500
Subject: [PATCH 208/272] build: fix code coverage aggregate upload

---
 .github/workflows/ci.yml | 39 ++++++++++++++++++++++++++++++++-------
 1 file changed, 32 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7c3ee7df..2d4bfc2c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -185,6 +185,7 @@ jobs:
       run: |
         if npm -ps ls nyc | grep -q nyc; then
           npm run test-ci
+          cp coverage/lcov.info "coverage/${{ matrix.name }}.lcov"
         else
           npm test
         fi
@@ -194,19 +195,43 @@ jobs:
       run: npm run lint
 
     - name: Collect code coverage
-      uses: coverallsapp/github-action@master
+      if: steps.list_env.outputs.nyc != ''
+      run: |
+        if [[ -d ./coverage ]]; then
+          mv ./coverage "./${{ matrix.name }}"
+          mkdir ./coverage
+          mv "./${{ matrix.name }}" "./coverage/${{ matrix.name }}"
+        fi
+
+    - name: Upload code coverage
+      uses: actions/upload-artifact@v3
       if: steps.list_env.outputs.nyc != ''
       with:
-        github-token: ${{ secrets.GITHUB_TOKEN }}
-        flag-name: run-${{ matrix.test_number }}
-        parallel: true
+        name: coverage
+        path: ./coverage
+        retention-days: 1
 
   coverage:
     needs: test
     runs-on: ubuntu-latest
     steps:
-    - name: Upload code coverage
+    - uses: actions/checkout@v3
+
+    - name: Install lcov
+      shell: bash
+      run: sudo apt-get -y install lcov
+
+    - name: Collect coverage reports
+      uses: actions/download-artifact@v3
+      with:
+        name: coverage
+        path: ./coverage
+
+    - name: Merge coverage reports
+      shell: bash
+      run: find ./coverage -name lcov.info -exec printf '-a %q\n' {} \; | xargs lcov -o ./coverage/lcov.info
+
+    - name: Upload coverage report
       uses: coverallsapp/github-action@master
       with:
-        github-token: ${{ secrets.github_token }}
-        parallel-finished: true
+        github-token: ${{ secrets.GITHUB_TOKEN }}

From 6b7c9a0d29aa0dee84ffdffb5da2d88f53906832 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 3 Jan 2024 19:44:48 -0500
Subject: [PATCH 209/272] build: Node.js@21.5

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2d4bfc2c..e770d94a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -123,7 +123,7 @@ jobs:
           node-version: "20.9"
 
         - name: Node.js 21.x
-          node-version: "21.1"
+          node-version: "21.5"
 
     steps:
     - uses: actions/checkout@v3

From 8e9f7a4a701b77a8baff1ea3f7b568dc70bf6ecf Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 3 Jan 2024 19:45:09 -0500
Subject: [PATCH 210/272] build: Node.js@20.10

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e770d94a..cde69396 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -120,7 +120,7 @@ jobs:
           node-version: "19.9"
 
         - name: Node.js 20.x
-          node-version: "20.9"
+          node-version: "20.10"
 
         - name: Node.js 21.x
           node-version: "21.5"

From 7dec651403d4ce7b072c2992914a0a28b93922a0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 3 Jan 2024 19:46:01 -0500
Subject: [PATCH 211/272] build: Node.js@18.19

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cde69396..d4d66ca1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -114,7 +114,7 @@ jobs:
           node-version: "17.9"
 
         - name: Node.js 18.x
-          node-version: "18.18"
+          node-version: "18.19"
 
         - name: Node.js 19.x
           node-version: "19.9"

From a46e8578183efffe8fdc122375b53bd2c9ee51b1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 27 Jan 2024 21:40:27 -0500
Subject: [PATCH 212/272] supertest@6.3.4

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 597df1a9..2b12839e 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "express": "4.17.3",
     "mocha": "10.2.0",
     "nyc": "15.1.0",
-    "supertest": "6.3.3"
+    "supertest": "6.3.4"
   },
   "files": [
     "session/",

From 2a7a50bcbc2d5844c030d4d684108f09f60b460c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 27 Jan 2024 21:42:33 -0500
Subject: [PATCH 213/272] eslint@8.56.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 2b12839e..2f5190c8 100644
--- a/package.json
+++ b/package.json
@@ -22,7 +22,7 @@
   "devDependencies": {
     "after": "0.8.2",
     "cookie-parser": "1.4.6",
-    "eslint": "8.49.0",
+    "eslint": "8.56.0",
     "eslint-plugin-markdown": "3.0.1",
     "express": "4.17.3",
     "mocha": "10.2.0",

From e5f19cedac9edcc754dda7807f99e834614763d6 Mon Sep 17 00:00:00 2001
From: Lukas Elmer <lukas.elmer@gmail.com>
Date: Mon, 14 Nov 2022 17:45:37 +0100
Subject: [PATCH 214/272] docs: add note on length of secret

closes #919
---
 README.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/README.md b/README.md
index b5dbcba5..6ce6ae4a 100644
--- a/README.md
+++ b/README.md
@@ -295,6 +295,9 @@ the secret without invalidating sessions, provide an array of secrets, with the
 secret as first element of the array, and including previous secrets as the later
 elements.
 
+**Note** HMAC-256 is used to sign the session ID. For this reason, the secret should
+contain at least 32 bytes of entropy.
+
 ##### store
 
 The session store instance, defaults to a new `MemoryStore` instance.

From a1f884fb8f8937d7b1628bbe5349ee6aa375742f Mon Sep 17 00:00:00 2001
From: Kam Lasater <ckl@seekayel.com>
Date: Wed, 30 Nov 2022 15:08:10 -0500
Subject: [PATCH 215/272] docs: add @cyclic.sh/session-store to the list of
 session stores

closes #922
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 6ce6ae4a..39d14796 100644
--- a/README.md
+++ b/README.md
@@ -818,6 +818,11 @@ based session store. Supports all backends supported by Fortune (MongoDB, Redis,
 [session-rethinkdb-url]: https://www.npmjs.com/package/session-rethinkdb
 [session-rethinkdb-image]: https://badgen.net/github/stars/llambda/session-rethinkdb?label=%E2%98%85
 
+[![★][@cyclic.sh/session-store-image] @cyclic.sh/session-store][@cyclic.sh/session-store-url] A DynamoDB-based session store for [Cyclic.sh](https://www.cyclic.sh/) apps.
+
+[@cyclic.sh/session-store-url]: https://www.npmjs.com/package/@cyclic.sh/session-store
+[@cyclic.sh/session-store-image]: https://badgen.net/github/stars/cyclic-software/session-store?label=%E2%98%85
+
 [![★][@databunker/session-store-image] @databunker/session-store][@databunker/session-store-url] A [Databunker](https://databunker.org/)-based encrypted session store.
 
 [@databunker/session-store-url]: https://www.npmjs.com/package/@databunker/session-store

From 9d377c5a58295cdb77e6b85dc4c0a5ab63c78ddf Mon Sep 17 00:00:00 2001
From: Jordan Day <jordan@modernhawk.com>
Date: Mon, 27 Feb 2023 13:35:06 -0600
Subject: [PATCH 216/272] docs: add dynamodb-store-v3 to the list of session
 stores

closes #930
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 39d14796..21303c32 100644
--- a/README.md
+++ b/README.md
@@ -693,6 +693,11 @@ and other multi-core embedded devices).
 [dynamodb-store-url]: https://www.npmjs.com/package/dynamodb-store
 [dynamodb-store-image]: https://badgen.net/github/stars/rafaelrpinto/dynamodb-store?label=%E2%98%85
 
+[![★][dynamodb-store-v3-image] dynamodb-store-v3][dynamodb-store-v3-url] Implementation of a session store using DynamoDB backed by the [AWS SDK for JavaScript v3](https://github.com/aws/aws-sdk-js-v3).
+
+[dynamodb-store-v3-url]: https://www.npmjs.com/package/dynamodb-store-v3
+[dynamodb-store-v3-image]: https://badgen.net/github/stars/FryDay/dynamodb-store-v3?label=%E2%98%85
+
 [![★][express-etcd-image] express-etcd][express-etcd-url] An [etcd](https://github.com/stianeikeland/node-etcd) based session store.
 
 [express-etcd-url]: https://www.npmjs.com/package/express-etcd

From 71c3f741080703520f16bccf8ed455f193cb69bb Mon Sep 17 00:00:00 2001
From: Ajesh DS <iam@ajesh.dev>
Date: Mon, 24 Jul 2023 04:32:30 +0530
Subject: [PATCH 217/272] docs: add connect-cosmosdb to the list of session
 stores

closes #950
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 21303c32..ab2de080 100644
--- a/README.md
+++ b/README.md
@@ -560,6 +560,11 @@ and other multi-core embedded devices).
 [connect-cloudant-store-url]: https://www.npmjs.com/package/connect-cloudant-store
 [connect-cloudant-store-image]: https://badgen.net/github/stars/adriantanasa/connect-cloudant-store?label=%E2%98%85
 
+[![★][connect-cosmosdb-image] connect-cosmosdb][connect-cosmosdb-url] An Azure [Cosmos DB](https://azure.microsoft.com/en-us/products/cosmos-db/)-based session store.
+
+[connect-cosmosdb-url]: https://www.npmjs.com/package/connect-cosmosdb
+[connect-cosmosdb-image]: https://badgen.net/github/stars/thekillingspree/connect-cosmosdb?label=%E2%98%85
+
 [![★][connect-couchbase-image] connect-couchbase][connect-couchbase-url] A [couchbase](http://www.couchbase.com/)-based session store.
 
 [connect-couchbase-url]: https://www.npmjs.com/package/connect-couchbase

From 3ee08c466c37f2eb81d18ce13f0d3653416f79df Mon Sep 17 00:00:00 2001
From: Marc Udoff <marc.udoff@deshaw.com>
Date: Mon, 1 May 2023 11:36:09 -0400
Subject: [PATCH 218/272] Add "priority" to cookie options

closes #884
closes #939
---
 HISTORY.md        |  5 +++++
 README.md         | 15 +++++++++++++++
 package.json      |  2 +-
 session/cookie.js |  3 ++-
 test/cookie.js    |  8 ++++++++
 test/session.js   | 22 +++++++++++++++-------
 6 files changed, 46 insertions(+), 9 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 30facb56..29e5657a 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,7 +1,12 @@
 unreleased
 ==========
 
+  * Add `priority` to `cookie` options
   * Support any type in `secret` that `crypto.createHmac` supports
+  * deps: cookie@0.5.0
+    - Fix `expires` option to reject invalid dates
+    - perf: improve default decode speed
+    - perf: remove slow string split in parse
   * deps: cookie-signature@1.0.7
 
 1.17.3 / 2022-05-11
diff --git a/README.md b/README.md
index ab2de080..5096ac0f 100644
--- a/README.md
+++ b/README.md
@@ -94,6 +94,20 @@ defined in the object is what is used.
 Specifies the value for the `Path` `Set-Cookie`. By default, this is set to `'/'`, which
 is the root path of the domain.
 
+##### cookie.priority
+
+Specifies the `string` to be the value for the [`Priority` `Set-Cookie` attribute][rfc-west-cookie-priority-00-4.1].
+
+  - `'low'` will set the `Priority` attribute to `Low`.
+  - `'medium'` will set the `Priority` attribute to `Medium`, the default priority when not set.
+  - `'high'` will set the `Priority` attribute to `High`.
+
+More information about the different priority levels can be found in
+[the specification][rfc-west-cookie-priority-00-4.1].
+
+**Note** This is an attribute that has not yet been fully standardized, and may change in the future.
+This also means many clients may ignore this attribute until they understand it.
+
 ##### cookie.sameSite
 
 Specifies the `boolean` or `string` to be the value for the `SameSite` `Set-Cookie` attribute.
@@ -994,6 +1008,7 @@ On Windows, use the corresponding command;
 [MIT](LICENSE)
 
 [rfc-6265bis-03-4.1.2.7]: https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-03#section-4.1.2.7
+[rfc-west-cookie-priority-00-4.1]: https://tools.ietf.org/html/draft-west-cookie-priority-00#section-4.1
 [ci-image]: https://badgen.net/github/checks/expressjs/session/master?label=ci
 [ci-url]: https://github.com/expressjs/session/actions?query=workflow%3Aci
 [coveralls-image]: https://badgen.net/coveralls/c/github/expressjs/session/master
diff --git a/package.json b/package.json
index 2f5190c8..f3d663b4 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,7 @@
   "repository": "expressjs/session",
   "license": "MIT",
   "dependencies": {
-    "cookie": "0.4.2",
+    "cookie": "0.5.0",
     "cookie-signature": "1.0.7",
     "debug": "2.6.9",
     "depd": "~2.0.0",
diff --git a/session/cookie.js b/session/cookie.js
index a8b4e570..ff24d08b 100644
--- a/session/cookie.js
+++ b/session/cookie.js
@@ -116,7 +116,8 @@ Cookie.prototype = {
 
   get data() {
     return {
-      originalMaxAge: this.originalMaxAge
+      originalMaxAge: this.originalMaxAge,
+      priority: this.priority
       , expires: this._expires
       , secure: this.secure
       , httpOnly: this.httpOnly
diff --git a/test/cookie.js b/test/cookie.js
index 65ae1fc3..0869db9e 100644
--- a/test/cookie.js
+++ b/test/cookie.js
@@ -114,5 +114,13 @@ describe('new Cookie()', function () {
         assert.strictEqual(cookie.path, '/foo')
       })
     })
+
+    describe('priority', function () {
+      it('should set priority', function () {
+        var cookie = new Cookie({ priority: 'high' })
+
+        assert.strictEqual(cookie.priority, 'high')
+      })
+    })
   })
 })
diff --git a/test/session.js b/test/session.js
index 09893902..755017d1 100644
--- a/test/session.js
+++ b/test/session.js
@@ -1923,18 +1923,26 @@ describe('session()', function(){
         })
 
         it('should override defaults', function(done){
-          var server = createServer({ cookie: { path: '/admin', httpOnly: false, secure: true, maxAge: 5000 } }, function (req, res) {
+          var opts = {
+            httpOnly: false,
+            maxAge: 5000,
+            path: '/admin',
+            priority: 'high',
+            secure: true
+          }
+          var server = createServer({ cookie: opts }, function (req, res) {
             req.session.cookie.secure = false
             res.end()
           })
 
           request(server)
-          .get('/admin')
-          .expect(shouldSetCookieWithAttribute('connect.sid', 'Expires'))
-          .expect(shouldSetCookieWithoutAttribute('connect.sid', 'HttpOnly'))
-          .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'Path', '/admin'))
-          .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Secure'))
-          .expect(200, done)
+            .get('/admin')
+            .expect(shouldSetCookieWithAttribute('connect.sid', 'Expires'))
+            .expect(shouldSetCookieWithoutAttribute('connect.sid', 'HttpOnly'))
+            .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'Path', '/admin'))
+            .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Secure'))
+            .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'Priority', 'High'))
+            .expect(200, done)
         })
 
         it('should preserve cookies set before writeHead is called', function(done){

From f9f2318615bd12ad47342fd8cd88a1e0b52686f1 Mon Sep 17 00:00:00 2001
From: Alexandre ZANNI <16578570+noraj@users.noreply.github.com>
Date: Fri, 13 Oct 2023 10:22:16 +0200
Subject: [PATCH 219/272] docs: remove session-rethinkdb to the list of session
 stores

closes #960
---
 README.md | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/README.md b/README.md
index 5096ac0f..2ee2385e 100644
--- a/README.md
+++ b/README.md
@@ -837,11 +837,6 @@ based session store. Supports all backends supported by Fortune (MongoDB, Redis,
 [session-pouchdb-store-url]: https://www.npmjs.com/package/session-pouchdb-store
 [session-pouchdb-store-image]: https://badgen.net/github/stars/solzimer/session-pouchdb-store?label=%E2%98%85
 
-[![★][session-rethinkdb-image] session-rethinkdb][session-rethinkdb-url] A [RethinkDB](http://rethinkdb.com/)-based session store.
-
-[session-rethinkdb-url]: https://www.npmjs.com/package/session-rethinkdb
-[session-rethinkdb-image]: https://badgen.net/github/stars/llambda/session-rethinkdb?label=%E2%98%85
-
 [![★][@cyclic.sh/session-store-image] @cyclic.sh/session-store][@cyclic.sh/session-store-url] A DynamoDB-based session store for [Cyclic.sh](https://www.cyclic.sh/) apps.
 
 [@cyclic.sh/session-store-url]: https://www.npmjs.com/package/@cyclic.sh/session-store

From d9354ef09ffb1b750b7cd3eb0ddd3f0cdfd4bfab Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 28 Jan 2024 14:44:24 -0500
Subject: [PATCH 220/272] Fix handling errors from setting cookie

---
 HISTORY.md      |  1 +
 index.js        |  6 +++++-
 test/session.js | 17 +++++++++++++++++
 3 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index 29e5657a..c0f46aa2 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
   * Add `priority` to `cookie` options
+  * Fix handling errors from setting cookie
   * Support any type in `secret` that `crypto.createHmac` supports
   * deps: cookie@0.5.0
     - Fix `expires` option to reject invalid dates
diff --git a/index.js b/index.js
index 40a442ba..981262cc 100644
--- a/index.js
+++ b/index.js
@@ -240,7 +240,11 @@ function session(options) {
       }
 
       // set cookie
-      setcookie(res, name, req.sessionID, secrets[0], req.session.cookie.data);
+      try {
+        setcookie(res, name, req.sessionID, secrets[0], req.session.cookie.data)
+      } catch (err) {
+        defer(next, err)
+      }
     });
 
     // proxy end() to commit the session
diff --git a/test/session.js b/test/session.js
index 755017d1..e1b6419b 100644
--- a/test/session.js
+++ b/test/session.js
@@ -1945,6 +1945,23 @@ describe('session()', function(){
             .expect(200, done)
         })
 
+        it('should forward errors setting cookie', function (done) {
+          var cb = after(2, done)
+          var server = createServer({ cookie: { expires: new Date(NaN) } }, function (req, res) {
+            res.end()
+          })
+
+          server.on('error', function onerror (err) {
+            assert.ok(err)
+            assert.strictEqual(err.message, 'option expires is invalid')
+            cb()
+          })
+
+          request(server)
+            .get('/admin')
+            .expect(200, cb)
+        })
+
         it('should preserve cookies set before writeHead is called', function(done){
           var server = createServer(null, function (req, res) {
             var cookie = new Cookie()

From 88e0f2eff2a9b2456d70c1d5edac3c45b1552581 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 28 Jan 2024 14:46:52 -0500
Subject: [PATCH 221/272] build: actions/checkout@v4

---
 .github/workflows/ci.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d4d66ca1..a27948bd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -126,7 +126,7 @@ jobs:
           node-version: "21.5"
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
 
     - name: Install Node.js ${{ matrix.node-version }}
       shell: bash -eo pipefail -l {0}
@@ -215,7 +215,7 @@ jobs:
     needs: test
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
 
     - name: Install lcov
       shell: bash

From 6153b3f52ddad6d975c40b851694602a5be3d35b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 28 Jan 2024 14:57:28 -0500
Subject: [PATCH 222/272] build: Node.js@21.6

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a27948bd..66f1f09c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -123,7 +123,7 @@ jobs:
           node-version: "20.10"
 
         - name: Node.js 21.x
-          node-version: "21.5"
+          node-version: "21.6"
 
     steps:
     - uses: actions/checkout@v4

From 50e1429314e3b08b3680a3805a849e68414afc4b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 28 Jan 2024 14:57:37 -0500
Subject: [PATCH 223/272] build: Node.js@20.11

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 66f1f09c..38dc4da7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -120,7 +120,7 @@ jobs:
           node-version: "19.9"
 
         - name: Node.js 20.x
-          node-version: "20.10"
+          node-version: "20.11"
 
         - name: Node.js 21.x
           node-version: "21.6"

From 408229ea3373097732875315d6f63c45e39fd3b6 Mon Sep 17 00:00:00 2001
From: Alex Op <alexop1000@gmail.com>
Date: Tue, 26 Dec 2023 11:09:58 +0100
Subject: [PATCH 224/272] Add "partitioned" to cookie options

fixes #961
closes #966
---
 HISTORY.md        |  3 ++-
 README.md         | 13 +++++++++++++
 package.json      |  2 +-
 session/cookie.js |  1 +
 test/cookie.js    |  8 ++++++++
 test/session.js   | 35 +++++++++++++++++++++++++++++++++++
 6 files changed, 60 insertions(+), 2 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index c0f46aa2..ef77098b 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,10 +1,11 @@
 unreleased
 ==========
 
+  * Add `partitioned` to `cookie` options
   * Add `priority` to `cookie` options
   * Fix handling errors from setting cookie
   * Support any type in `secret` that `crypto.createHmac` supports
-  * deps: cookie@0.5.0
+  * deps: cookie@0.6.0
     - Fix `expires` option to reject invalid dates
     - perf: improve default decode speed
     - perf: remove slow string split in parse
diff --git a/README.md b/README.md
index 2ee2385e..e8d6db55 100644
--- a/README.md
+++ b/README.md
@@ -89,6 +89,18 @@ no maximum age is set.
 **Note** If both `expires` and `maxAge` are set in the options, then the last one
 defined in the object is what is used.
 
+##### cookie.partitioned
+
+Specifies the `boolean` value for the [`Partitioned` `Set-Cookie`](rfc-cutler-httpbis-partitioned-cookies)
+attribute. When truthy, the `Partitioned` attribute is set, otherwise it is not.
+By default, the `Partitioned` attribute is not set.
+
+**Note** This is an attribute that has not yet been fully standardized, and may
+change in the future. This also means many clients may ignore this attribute until
+they understand it.
+
+More information about can be found in [the proposal](https://github.com/privacycg/CHIPS).
+
 ##### cookie.path
 
 Specifies the value for the `Path` `Set-Cookie`. By default, this is set to `'/'`, which
@@ -1003,6 +1015,7 @@ On Windows, use the corresponding command;
 [MIT](LICENSE)
 
 [rfc-6265bis-03-4.1.2.7]: https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-03#section-4.1.2.7
+[rfc-cutler-httpbis-partitioned-cookies]: https://tools.ietf.org/html/draft-cutler-httpbis-partitioned-cookies/
 [rfc-west-cookie-priority-00-4.1]: https://tools.ietf.org/html/draft-west-cookie-priority-00#section-4.1
 [ci-image]: https://badgen.net/github/checks/expressjs/session/master?label=ci
 [ci-url]: https://github.com/expressjs/session/actions?query=workflow%3Aci
diff --git a/package.json b/package.json
index f3d663b4..52cd1d00 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,7 @@
   "repository": "expressjs/session",
   "license": "MIT",
   "dependencies": {
-    "cookie": "0.5.0",
+    "cookie": "0.6.0",
     "cookie-signature": "1.0.7",
     "debug": "2.6.9",
     "depd": "~2.0.0",
diff --git a/session/cookie.js b/session/cookie.js
index ff24d08b..8bb5907b 100644
--- a/session/cookie.js
+++ b/session/cookie.js
@@ -117,6 +117,7 @@ Cookie.prototype = {
   get data() {
     return {
       originalMaxAge: this.originalMaxAge,
+      partitioned: this.partitioned,
       priority: this.priority
       , expires: this._expires
       , secure: this.secure
diff --git a/test/cookie.js b/test/cookie.js
index 0869db9e..ea676e35 100644
--- a/test/cookie.js
+++ b/test/cookie.js
@@ -107,6 +107,14 @@ describe('new Cookie()', function () {
       })
     })
 
+    describe('partitioned', function () {
+      it('should set partitioned', function () {
+        var cookie = new Cookie({ partitioned: true })
+
+        assert.strictEqual(cookie.partitioned, true)
+      })
+    })
+
     describe('path', function () {
       it('should set path', function () {
         var cookie = new Cookie({ path: '/foo' })
diff --git a/test/session.js b/test/session.js
index e1b6419b..7bf3e51f 100644
--- a/test/session.js
+++ b/test/session.js
@@ -2233,6 +2233,41 @@ describe('session()', function(){
           })
         })
       })
+
+      describe('.partitioned', function () {
+        describe('by default', function () {
+          it('should not set partitioned attribute', function (done) {
+            var server = createServer()
+
+            request(server)
+              .get('/')
+              .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Partitioned'))
+              .expect(200, done)
+          })
+        })
+
+        describe('when "false"', function () {
+          it('should not set partitioned attribute', function (done) {
+            var server = createServer({ cookie: { partitioned: false } })
+
+            request(server)
+              .get('/')
+              .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Partitioned'))
+              .expect(200, done)
+          })
+        })
+
+        describe('when "true"', function () {
+          it('should set partitioned attribute', function (done) {
+            var server = createServer({ cookie: { partitioned: true } })
+
+            request(server)
+              .get('/')
+              .expect(shouldSetCookieWithAttribute('connect.sid', 'Partitioned'))
+              .expect(200, done)
+          })
+        })
+      })
     })
   })
 

From 991b7ee815d32cb7e17ce51904d007596e8ec862 Mon Sep 17 00:00:00 2001
From: Kenneth Tan Xin You <kennethtxytqw@users.noreply.github.com>
Date: Wed, 18 Aug 2021 16:27:40 +0800
Subject: [PATCH 225/272] Add debug log for pathname mismatch

closes #840
---
 HISTORY.md | 1 +
 index.js   | 6 +++++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index ef77098b..ea175bdb 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Add debug log for pathname mismatch
   * Add `partitioned` to `cookie` options
   * Add `priority` to `cookie` options
   * Fix handling errors from setting cookie
diff --git a/index.js b/index.js
index 981262cc..d41b2378 100644
--- a/index.js
+++ b/index.js
@@ -193,7 +193,11 @@ function session(options) {
 
     // pathname mismatch
     var originalPath = parseUrl.original(req).pathname || '/'
-    if (originalPath.indexOf(cookieOptions.path || '/') !== 0) return next();
+    if (originalPath.indexOf(cookieOptions.path || '/') !== 0) {
+      debug('pathname mismatch')
+      next()
+      return
+    }
 
     // ensure a secret is available or bail
     if (!secret && !req.secret) {

From 855f21ab9325b6be1b857c582b7ba810595d3bf5 Mon Sep 17 00:00:00 2001
From: noiissyboy <vigneshwaran.india@gmail.com>
Date: Wed, 18 May 2022 10:49:07 +0530
Subject: [PATCH 226/272] docs: add connect-ottoman to the list of session
 stores

closes #895
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index e8d6db55..65a37e63 100644
--- a/README.md
+++ b/README.md
@@ -677,6 +677,11 @@ and other multi-core embedded devices).
 [connect-neo4j-url]: https://www.npmjs.com/package/connect-neo4j
 [connect-neo4j-image]: https://badgen.net/github/stars/MaxAndersson/connect-neo4j?label=%E2%98%85
 
+[![★][connect-ottoman-image] connect-ottoman][connect-ottoman-url] A [couchbase ottoman](http://www.couchbase.com/)-based session store.
+
+[connect-ottoman-url]: https://www.npmjs.com/package/connect-ottoman
+[connect-ottoman-image]: https://badgen.net/github/stars/noiissyboy/connect-ottoman?label=%E2%98%85
+
 [![★][connect-pg-simple-image] connect-pg-simple][connect-pg-simple-url] A PostgreSQL-based session store.
 
 [connect-pg-simple-url]: https://www.npmjs.com/package/connect-pg-simple

From 24d4972764d2c962f806c38357f257cf97081009 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 28 Jan 2024 16:20:57 -0500
Subject: [PATCH 227/272] 1.18.0

---
 HISTORY.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index ea175bdb..a9903c03 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+1.18.0 / 2024-01-28
+===================
 
   * Add debug log for pathname mismatch
   * Add `partitioned` to `cookie` options
diff --git a/package.json b/package.json
index 52cd1d00..597a6994 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.17.3",
+  "version": "1.18.0",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From 8f0a1c4a35d80293eb51633e90916bdbdaa09ec4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=8D=C3=B1igo=20Marqu=C3=ADnez=20Prado?=
 <25435858+inigomarquinez@users.noreply.github.com>
Date: Tue, 14 May 2024 18:19:12 +0200
Subject: [PATCH 228/272] ci: add support for OSSF scorecard reporting (#984)

PR-URL: https://github.com/expressjs/session/pull/984
---
 .github/workflows/scorecard.yml | 73 +++++++++++++++++++++++++++++++++
 1 file changed, 73 insertions(+)
 create mode 100644 .github/workflows/scorecard.yml

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
new file mode 100644
index 00000000..0e064f47
--- /dev/null
+++ b/.github/workflows/scorecard.yml
@@ -0,0 +1,73 @@
+# This workflow uses actions that are not certified by GitHub. They are provided
+# by a third-party and are governed by separate terms of service, privacy
+# policy, and support documentation.
+
+name: Scorecard supply-chain security
+
+on:
+  # For Branch-Protection check. Only the default branch is supported. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+  branch_protection_rule:
+  # To guarantee Maintained check is occasionally updated. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+  schedule:
+    - cron: '16 21 * * 1'
+  push:
+    branches: [ "master" ]
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+      # Uncomment the permissions below if installing in a private repository.
+      # contents: read
+      # actions: read
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.2
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
+          # - you want to enable the Branch-Protection check on a *public* repository, or
+          # - you are installing Scorecard on a *private* repository
+          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
+          # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+
+          # Public repositories:
+          #   - Publish results to OpenSSF REST API for easy access by consumers
+          #   - Allows the repository to include the Scorecard badge.
+          #   - See https://github.com/ossf/scorecard-action#publishing-results.
+          # For private repositories:
+          #   - `publish_results` will always be set to `false`, regardless
+          #     of the value entered here.
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard.
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@2f93e4319b2f04a2efc38fa7f78bd681bc3f7b2f # v2.23.2
+        with:
+          sarif_file: results.sarif

From 341b179ec67c85c751ba0f5cfee8e514a139f630 Mon Sep 17 00:00:00 2001
From: Nick O'Leary <nick.oleary@gmail.com>
Date: Tue, 8 Oct 2024 18:50:29 +0100
Subject: [PATCH 229/272] dep: cookie@0.7.2 (#997)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Ulises Gascón <ulisesgascongonzalez@gmail.com>
---
 HISTORY.md   | 15 +++++++++++++++
 package.json |  2 +-
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index a9903c03..256606b7 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,18 @@
+unreleased
+==========
+
+
+  * deps: cookie@0.7.2
+    - Fix object assignment of `hasOwnProperty`
+  * deps: cookie@0.7.1
+    - Allow leading dot for domain
+      - Although not permitted in the spec, some users expect this to work and user agents ignore the leading dot according to spec
+    - Add fast path for `serialize` without options, use `obj.hasOwnProperty` when parsing
+  * deps: cookie@0.7.0
+    - perf: parse cookies ~10% faster
+    - fix: narrow the validation of cookies to match RFC6265
+    - fix: add `main` to `package.json` for rspack
+
 1.18.0 / 2024-01-28
 ===================
 
diff --git a/package.json b/package.json
index 597a6994..910f8b6a 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,7 @@
   "repository": "expressjs/session",
   "license": "MIT",
   "dependencies": {
-    "cookie": "0.6.0",
+    "cookie": "0.7.2",
     "cookie-signature": "1.0.7",
     "debug": "2.6.9",
     "depd": "~2.0.0",

From bbeca94e69b93d437c4ca300b111bd59169de925 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= <ulisesgascongonzalez@gmail.com>
Date: Tue, 8 Oct 2024 21:52:45 +0200
Subject: [PATCH 230/272] 1.18.1

PR-URL: https://github.com/expressjs/session/pull/998
---
 HISTORY.md   | 3 +--
 package.json | 2 +-
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 256606b7..57c68d3a 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,7 +1,6 @@
-unreleased
+1.18.1 / 2024-10-08
 ==========
 
-
   * deps: cookie@0.7.2
     - Fix object assignment of `hasOwnProperty`
   * deps: cookie@0.7.1
diff --git a/package.json b/package.json
index 910f8b6a..e3322438 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.18.0",
+  "version": "1.18.1",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From 460e18c8f3b0cc21a437e984f0ea04b9c0138193 Mon Sep 17 00:00:00 2001
From: BaileyFirman <bailey.firman@nintex.com>
Date: Thu, 21 Nov 2024 16:29:59 +1300
Subject: [PATCH 231/272] Refresh server.crt with existing key extending expiry
 to Nov 21 03:28:10 2024 GMT

---
 test/fixtures/server.crt | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/test/fixtures/server.crt b/test/fixtures/server.crt
index c019198a..3f68e2f2 100644
--- a/test/fixtures/server.crt
+++ b/test/fixtures/server.crt
@@ -1,14 +1,15 @@
 -----BEGIN CERTIFICATE-----
-MIICMzCCAZwCCQCJTms0qcIZgDANBgkqhkiG9w0BAQUFADBeMQswCQYDVQQGEwJV
-UzEQMA4GA1UECBMHSW5kaWFuYTEdMBsGA1UEChMUbm9kZS1leHByZXNzLXNlc3Np
-b24xHjAcBgNVBAMTFWV4cHJlc3Mtc2Vzc2lvbi5sb2NhbDAeFw0xNDExMjMwNTQ3
-MzlaFw0yNDExMjAwNTQ3MzlaMF4xCzAJBgNVBAYTAlVTMRAwDgYDVQQIEwdJbmRp
-YW5hMR0wGwYDVQQKExRub2RlLWV4cHJlc3Mtc2Vzc2lvbjEeMBwGA1UEAxMVZXhw
-cmVzcy1zZXNzaW9uLmxvY2FsMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDY
-G398zqN6Yv/FAx77eoLLje4VNCYDXUciWBzceaZ5u/rtP/XshTQWDKFfUbb/kmni
-DazsCasSoNsUCrcqQPJF1jF3F9XjsZxcggDab8MAbAMhnhJax2l3yPJsWnB/8mrY
-cdsdQNPXJxQW9MMZgUxz73gIY5/rEeayU9owgcnVcQIDAQABMA0GCSqGSIb3DQEB
-BQUAA4GBADi0XXsZlQAKxOyD4qvdJNWJXlfqhr1q53dZmfF7nikDaMDiMspczTS/
-pxNbq2UaMc7g+6qmXPaPQoN3laQQtMdyVfSh6EIJHbzXXzdcCT4fDBYX7iwvh0Gg
-DUpjmxmCzFCaob9+hZzwbJi5MFQ4Qq12LW1aYHMs8wgLboHml1WL
+MIICWzCCAcSgAwIBAgIJAIlOazSpwhmAMA0GCSqGSIb3DQEBCwUAMF4xCzAJBgNV
+BAYTAlVTMRAwDgYDVQQIEwdJbmRpYW5hMR0wGwYDVQQKExRub2RlLWV4cHJlc3Mt
+c2Vzc2lvbjEeMBwGA1UEAxMVZXhwcmVzcy1zZXNzaW9uLmxvY2FsMB4XDTI0MTEy
+MTAzMjgxMFoXDTM0MTExOTAzMjgxMFowXjELMAkGA1UEBhMCVVMxEDAOBgNVBAgT
+B0luZGlhbmExHTAbBgNVBAoTFG5vZGUtZXhwcmVzcy1zZXNzaW9uMR4wHAYDVQQD
+ExVleHByZXNzLXNlc3Npb24ubG9jYWwwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
+AoGBANgbf3zOo3pi/8UDHvt6gsuN7hU0JgNdRyJYHNx5pnm7+u0/9eyFNBYMoV9R
+tv+SaeINrOwJqxKg2xQKtypA8kXWMXcX1eOxnFyCANpvwwBsAyGeElrHaXfI8mxa
+cH/yathx2x1A09cnFBb0wxmBTHPveAhjn+sR5rJT2jCBydVxAgMBAAGjITAfMB0G
+A1UdDgQWBBTqXycJwRboThk0uB3Cd3+oSLz1fjANBgkqhkiG9w0BAQsFAAOBgQCT
+/E1rZGxemZZ5F8qX9SoTsc04ELEwT3PwA0cgU5fGmWmajPfjw339y53EQAb/H/sM
+hugSreKMLVSAHRhMNGXb+dR0MzJiR4GbKRvYyHul4zjWen9uQrDHdgsqD4RnUcq8
+7HB+i49oFLN59qoI9MOoOKBfAKGKlXd+IL9+jyR/jA==
 -----END CERTIFICATE-----

From c9d0572701a1bd2714b82ce03cf225e60a3f41a9 Mon Sep 17 00:00:00 2001
From: ctcpip <ctcpip@users.noreply.github.com>
Date: Wed, 22 Jan 2025 09:10:19 -0600
Subject: [PATCH 232/272] =?UTF-8?q?=F0=9F=94=92=EF=B8=8F=20use=202048=20bi?=
 =?UTF-8?q?t=20key?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

cd test/fixtures

openssl genpkey -algorithm RSA -out new_server.key -pkeyopt rsa_keygen_bits:2048

openssl x509 -in server.crt -signkey new_server.key -days 3650 -out new_server.crt

openssl x509 -in new_server.crt -text -noout

mv new_server.crt server.crt

mv new_server.key server.key
---
 test/fixtures/server.crt | 28 ++++++++++++++++----------
 test/fixtures/server.key | 43 ++++++++++++++++++++++++++--------------
 2 files changed, 45 insertions(+), 26 deletions(-)

diff --git a/test/fixtures/server.crt b/test/fixtures/server.crt
index 3f68e2f2..3bee94f1 100644
--- a/test/fixtures/server.crt
+++ b/test/fixtures/server.crt
@@ -1,15 +1,21 @@
 -----BEGIN CERTIFICATE-----
-MIICWzCCAcSgAwIBAgIJAIlOazSpwhmAMA0GCSqGSIb3DQEBCwUAMF4xCzAJBgNV
+MIIDYDCCAkigAwIBAgIJAIlOazSpwhmAMA0GCSqGSIb3DQEBCwUAMF4xCzAJBgNV
 BAYTAlVTMRAwDgYDVQQIEwdJbmRpYW5hMR0wGwYDVQQKExRub2RlLWV4cHJlc3Mt
-c2Vzc2lvbjEeMBwGA1UEAxMVZXhwcmVzcy1zZXNzaW9uLmxvY2FsMB4XDTI0MTEy
-MTAzMjgxMFoXDTM0MTExOTAzMjgxMFowXjELMAkGA1UEBhMCVVMxEDAOBgNVBAgT
+c2Vzc2lvbjEeMBwGA1UEAxMVZXhwcmVzcy1zZXNzaW9uLmxvY2FsMB4XDTI1MDEy
+MjE1MTMyMFoXDTM1MDEyMDE1MTMyMFowXjELMAkGA1UEBhMCVVMxEDAOBgNVBAgT
 B0luZGlhbmExHTAbBgNVBAoTFG5vZGUtZXhwcmVzcy1zZXNzaW9uMR4wHAYDVQQD
-ExVleHByZXNzLXNlc3Npb24ubG9jYWwwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBANgbf3zOo3pi/8UDHvt6gsuN7hU0JgNdRyJYHNx5pnm7+u0/9eyFNBYMoV9R
-tv+SaeINrOwJqxKg2xQKtypA8kXWMXcX1eOxnFyCANpvwwBsAyGeElrHaXfI8mxa
-cH/yathx2x1A09cnFBb0wxmBTHPveAhjn+sR5rJT2jCBydVxAgMBAAGjITAfMB0G
-A1UdDgQWBBTqXycJwRboThk0uB3Cd3+oSLz1fjANBgkqhkiG9w0BAQsFAAOBgQCT
-/E1rZGxemZZ5F8qX9SoTsc04ELEwT3PwA0cgU5fGmWmajPfjw339y53EQAb/H/sM
-hugSreKMLVSAHRhMNGXb+dR0MzJiR4GbKRvYyHul4zjWen9uQrDHdgsqD4RnUcq8
-7HB+i49oFLN59qoI9MOoOKBfAKGKlXd+IL9+jyR/jA==
+ExVleHByZXNzLXNlc3Npb24ubG9jYWwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
+ggEKAoIBAQCy4w/9Wa85PGpdkzuZeU2qel+jlQd5L8b0RoKwlQ5k8NS/zIRd2fiF
+8XIQMi5m7sGaYT3xUUItuksQF3XnOGQddppLCnfshjqUeSrMAoSZPnqHsZYsbRhS
+3HiJFLWvBRDndVpmvdyg7BZicqEFmVBYNqsbsGH0Nrx6Xcb3iEZL8Z1mg3y+5f7c
+0s0buXJmX9usc8g7CRiLfuqArAJM8NUSyBonsIlzQvudmNiyqb5UZIYqK8YvCpkZ
+3QcHpzVCZ1uYIKa8MY878PhaiVqwDWGEtXO9xi3rtHXkvm5Y3wwbXYFDoOvA1YvM
+/CtLXNCpHU23WhiIErBb3dvGxZZroCTtAgMBAAGjITAfMB0GA1UdDgQWBBSJqiKJ
+f66iraVLqI3oZsgVeFA14jANBgkqhkiG9w0BAQsFAAOCAQEAP2VZidUCQptk4BiU
+Fi390fR5wrgnqhBRmoE+iL5ok05ToLsg2DyvCefPyZgNp//NIRp6QUIHmPVXWHXx
+fVDPLUC1CuOXy+o6TDWWjbtFW/PG5uPA6uhW4XpaBR5EGlptOBrGIRKIqneUwsMk
+5fpDo7pbU4GSMToDDnhJxijrHIQFTs+PJLAGjCBQn/FRcDR1AJlxW/AyO0bIBSLE
+fnZP+feQG6koDK8rgyT4t4z+hynAuf7y1ToFckNfTkdLdbXG5ceGu21qJCY/8uje
+Nf01ik1p8gL5dZcW3qucTP5p45t3bnUDOjPFmrs87Ooeix9UjZG2hwW258FN86r6
+3PDrTw==
 -----END CERTIFICATE-----
diff --git a/test/fixtures/server.key b/test/fixtures/server.key
index dabf2b83..51b6a7b1 100644
--- a/test/fixtures/server.key
+++ b/test/fixtures/server.key
@@ -1,15 +1,28 @@
------BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQDYG398zqN6Yv/FAx77eoLLje4VNCYDXUciWBzceaZ5u/rtP/Xs
-hTQWDKFfUbb/kmniDazsCasSoNsUCrcqQPJF1jF3F9XjsZxcggDab8MAbAMhnhJa
-x2l3yPJsWnB/8mrYcdsdQNPXJxQW9MMZgUxz73gIY5/rEeayU9owgcnVcQIDAQAB
-AoGBALB8HGw/kPA1Ay3Qc6/qCADWYvW8BcM/nQUmMkO3sUW/R5gTYPIMglHzdKIU
-aL9kwcXTZ0HIT4ZCCUffzF/cdD0lqCZjwGl0aM4xUZcPbaM/KmZOUcP92ymsN+rF
-uuJXks6hxrmJ5hh5D6FXdlQjTCdG3u9w0+KD4n1BkBkEaqflAkEA9q4TBt1bLOvV
-bbwz7bunI6bwS5eD7sVn1qUqrm6hcirhF1xCv75pO/uqAyccbguxjp8y2LNuN+cO
-IgSwr+Jq1wJBAOBFuKSMAcg2WmJ4IAT7143yhoHKMgA8Nl4sfLFwFl2/hw+fdEBe
-gndRfKHT4IV/YLcnS7d/H6mEMSAusWx5QPcCQQDTYaF+TWrW2JRAf3jEK/xyiZf6
-PrDYh6KOhWRIqxZ/fYz69p1gL6t/sg0ivH4ZMr4JKBRrK360OrOapQg+/7drAkB6
-3pfPRok/aE/SfN+F+3fX49Q/TUhhipt6ssLJ74/BYsobDBADqAOwXSt7+XmbifKx
-xUydRn9RPwQvDoXT2QZ3AkAdnwR9PMEHAsaibrPyzBztKjPL2rWBRk1QAmcdrTpt
-XL99XfmkERWtiBA/Lz2K332qYOa/zo5c/SADx9fm7+HP
------END RSA PRIVATE KEY-----
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCy4w/9Wa85PGpd
+kzuZeU2qel+jlQd5L8b0RoKwlQ5k8NS/zIRd2fiF8XIQMi5m7sGaYT3xUUItuksQ
+F3XnOGQddppLCnfshjqUeSrMAoSZPnqHsZYsbRhS3HiJFLWvBRDndVpmvdyg7BZi
+cqEFmVBYNqsbsGH0Nrx6Xcb3iEZL8Z1mg3y+5f7c0s0buXJmX9usc8g7CRiLfuqA
+rAJM8NUSyBonsIlzQvudmNiyqb5UZIYqK8YvCpkZ3QcHpzVCZ1uYIKa8MY878Pha
+iVqwDWGEtXO9xi3rtHXkvm5Y3wwbXYFDoOvA1YvM/CtLXNCpHU23WhiIErBb3dvG
+xZZroCTtAgMBAAECggEAA8BHqE4eYsKdz18EP6xfwMymn0FDghrKnvowiN/jSKIV
+L/1rpCUrNTHSLL1EpFNq22AhIqOL0fYnV0vKpOHVlZmUVDEAwUSyS0U8LMF7wtPg
+0WIbrkxOV4R4gZVd1vDyAQyArAlcrEIvGPri3gFwQh1JWsAI2cxhCObZAn1IzhRW
+sMecAmtNzzYWeXentSfkfWr0niKDbSAAuYzgVIEWbIfE+kgqBckrWnyM9IgSdy1g
+0b3NRRD/gvykszX7j9fzXGj8RAcCTbN1miaFcHRg3moa1Pu50KjokINsr5xxYqTk
+ltPYU35gMYzNPvu5clvj067j6ikCFMiE4XOXf58qwQKBgQDpQJ2l6b1LrvGAV4Q6
+qieTYPTnGhnm/rSn7jK+AUIF+UmK3mtASuc14keelXeiI42MzvO1P6LLwkFIzVx0
+2X/BrTDZUvU5P5nsgBkoyiC71bkbCzoiSxIQtRurenmkD7EqM+4zBYMvCvrPFmOr
+twuWk+4XLA+nl5Vl+FUgjehCQQKBgQDEVShtn68Pkq22GXR5kzgFu+GaXuVPJKu8
+z45K4mbG+WrnwuMmnIRbMfN9oGF5JXWAe5AtFqlQEcUQLElllRkdUe76WX15M2Jm
+UeqFFARWjToNs7NXmxjsQZFOe0TyfAsdaX++lUhEpeCcv2MnEoNQS9n8yTwhuJM4
+8Zr9KUWfrQKBgQCFkNK1ZxtWc18nNvYpAbaX1jVnALNEayXX47Z6xw2fjhhmxOZ1
+cm7jlCeez8gpuGId94PmjgIS27G2lqIS51kY9qu6Rp7VoW3q14+Qo+4KoV/V9J/d
+c09s8checUumfrXcjNAht05fadIlM5Tvh2nDWAJGkpyEQ3DxazqT4a7WAQKBgFok
+Zz191Zim1c8H/Oxc5ZnsW3bPHyWpRpiYC1LihCHTHnxuhHCT6EketBb37gj7Y+mr
+0dSB1RcIMZxtWP2k6TUHC1wyfmOJbiJgdfbH6/35NbBY03zjnxvKNvb7rfpPbaMB
+bz+Htvid2HTfgpzL6TKSwPFJS6yH3ECG3YxiyK65AoGAHIYaLIP53pszdd1ruCO6
+0rI6/He6hKwG8SmtbXKCKYSAeNwZJkUI+B0xD8ZTq5h3geJD7CEoVPPsv9xauliG
+fspe/KyTX5DqTBx9xNVYj9C2MSozQNs8ObCsUOMKzRaJtHl64US1VzweWA7Whkwf
+1r8MiT2ty4eCk7V3qW1W88A=
+-----END PRIVATE KEY-----

From d5baeeca833a6370936a844654f0d7147dc234aa Mon Sep 17 00:00:00 2001
From: Wes Todd <wes@wesleytodd.com>
Date: Wed, 22 Jan 2025 17:06:47 -0600
Subject: [PATCH 233/272] feat: gencert script to regenerate the test ssl certs

---
 package.json            |  3 ++-
 test/support/gencert.sh | 12 ++++++++++++
 2 files changed, 14 insertions(+), 1 deletion(-)
 create mode 100755 test/support/gencert.sh

diff --git a/package.json b/package.json
index e3322438..87b31098 100644
--- a/package.json
+++ b/package.json
@@ -42,6 +42,7 @@
     "test": "mocha --require test/support/env --check-leaks --bail --no-exit --reporter spec test/",
     "test-ci": "nyc --reporter=lcov --reporter=text npm test",
     "test-cov": "nyc npm test",
-    "version": "node scripts/version-history.js && git add HISTORY.md"
+    "version": "node scripts/version-history.js && git add HISTORY.md",
+    "gencert": "./test/support/gencert.sh"
   }
 }
diff --git a/test/support/gencert.sh b/test/support/gencert.sh
new file mode 100755
index 00000000..114bf70f
--- /dev/null
+++ b/test/support/gencert.sh
@@ -0,0 +1,12 @@
+#! /bin/sh
+set -ex
+
+openssl genpkey -algorithm RSA -out new_server.key -pkeyopt rsa_keygen_bits:2048
+
+openssl x509 -in ./test/fixtures/server.crt -signkey new_server.key -days 3650 -out new_server.crt
+
+openssl x509 -in new_server.crt -text -noout
+
+mv new_server.crt ./test/fixtures/server.crt
+
+mv new_server.key ./test/fixtures/server.key

From 67d61ee1799a8070dff4a5b759189be2023c7a62 Mon Sep 17 00:00:00 2001
From: ctcpip <ctcpip@users.noreply.github.com>
Date: Thu, 23 Jan 2025 11:01:24 -0600
Subject: [PATCH 234/272] =?UTF-8?q?=E2=9C=85=20always=20generate=20fresh?=
 =?UTF-8?q?=20cert?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitignore               |  2 ++
 package.json             |  5 ++---
 test/fixtures/.gitkeep   |  0
 test/fixtures/server.crt | 21 ---------------------
 test/fixtures/server.key | 28 ----------------------------
 test/support/gencert.sh  | 11 ++---------
 6 files changed, 6 insertions(+), 61 deletions(-)
 create mode 100644 test/fixtures/.gitkeep
 delete mode 100644 test/fixtures/server.crt
 delete mode 100644 test/fixtures/server.key

diff --git a/.gitignore b/.gitignore
index 207febba..1b6fef23 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,5 @@ coverage
 node_modules
 npm-debug.log
 package-lock.json
+/test/fixtures/server.crt
+/test/fixtures/server.key
diff --git a/package.json b/package.json
index 87b31098..79cb1b4c 100644
--- a/package.json
+++ b/package.json
@@ -39,10 +39,9 @@
   },
   "scripts": {
     "lint": "eslint . && node ./scripts/lint-readme.js",
-    "test": "mocha --require test/support/env --check-leaks --bail --no-exit --reporter spec test/",
+    "test": "./test/support/gencert.sh && mocha --require test/support/env --check-leaks --bail --no-exit --reporter spec test/",
     "test-ci": "nyc --reporter=lcov --reporter=text npm test",
     "test-cov": "nyc npm test",
-    "version": "node scripts/version-history.js && git add HISTORY.md",
-    "gencert": "./test/support/gencert.sh"
+    "version": "node scripts/version-history.js && git add HISTORY.md"
   }
 }
diff --git a/test/fixtures/.gitkeep b/test/fixtures/.gitkeep
new file mode 100644
index 00000000..e69de29b
diff --git a/test/fixtures/server.crt b/test/fixtures/server.crt
deleted file mode 100644
index 3bee94f1..00000000
--- a/test/fixtures/server.crt
+++ /dev/null
@@ -1,21 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDYDCCAkigAwIBAgIJAIlOazSpwhmAMA0GCSqGSIb3DQEBCwUAMF4xCzAJBgNV
-BAYTAlVTMRAwDgYDVQQIEwdJbmRpYW5hMR0wGwYDVQQKExRub2RlLWV4cHJlc3Mt
-c2Vzc2lvbjEeMBwGA1UEAxMVZXhwcmVzcy1zZXNzaW9uLmxvY2FsMB4XDTI1MDEy
-MjE1MTMyMFoXDTM1MDEyMDE1MTMyMFowXjELMAkGA1UEBhMCVVMxEDAOBgNVBAgT
-B0luZGlhbmExHTAbBgNVBAoTFG5vZGUtZXhwcmVzcy1zZXNzaW9uMR4wHAYDVQQD
-ExVleHByZXNzLXNlc3Npb24ubG9jYWwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
-ggEKAoIBAQCy4w/9Wa85PGpdkzuZeU2qel+jlQd5L8b0RoKwlQ5k8NS/zIRd2fiF
-8XIQMi5m7sGaYT3xUUItuksQF3XnOGQddppLCnfshjqUeSrMAoSZPnqHsZYsbRhS
-3HiJFLWvBRDndVpmvdyg7BZicqEFmVBYNqsbsGH0Nrx6Xcb3iEZL8Z1mg3y+5f7c
-0s0buXJmX9usc8g7CRiLfuqArAJM8NUSyBonsIlzQvudmNiyqb5UZIYqK8YvCpkZ
-3QcHpzVCZ1uYIKa8MY878PhaiVqwDWGEtXO9xi3rtHXkvm5Y3wwbXYFDoOvA1YvM
-/CtLXNCpHU23WhiIErBb3dvGxZZroCTtAgMBAAGjITAfMB0GA1UdDgQWBBSJqiKJ
-f66iraVLqI3oZsgVeFA14jANBgkqhkiG9w0BAQsFAAOCAQEAP2VZidUCQptk4BiU
-Fi390fR5wrgnqhBRmoE+iL5ok05ToLsg2DyvCefPyZgNp//NIRp6QUIHmPVXWHXx
-fVDPLUC1CuOXy+o6TDWWjbtFW/PG5uPA6uhW4XpaBR5EGlptOBrGIRKIqneUwsMk
-5fpDo7pbU4GSMToDDnhJxijrHIQFTs+PJLAGjCBQn/FRcDR1AJlxW/AyO0bIBSLE
-fnZP+feQG6koDK8rgyT4t4z+hynAuf7y1ToFckNfTkdLdbXG5ceGu21qJCY/8uje
-Nf01ik1p8gL5dZcW3qucTP5p45t3bnUDOjPFmrs87Ooeix9UjZG2hwW258FN86r6
-3PDrTw==
------END CERTIFICATE-----
diff --git a/test/fixtures/server.key b/test/fixtures/server.key
deleted file mode 100644
index 51b6a7b1..00000000
--- a/test/fixtures/server.key
+++ /dev/null
@@ -1,28 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCy4w/9Wa85PGpd
-kzuZeU2qel+jlQd5L8b0RoKwlQ5k8NS/zIRd2fiF8XIQMi5m7sGaYT3xUUItuksQ
-F3XnOGQddppLCnfshjqUeSrMAoSZPnqHsZYsbRhS3HiJFLWvBRDndVpmvdyg7BZi
-cqEFmVBYNqsbsGH0Nrx6Xcb3iEZL8Z1mg3y+5f7c0s0buXJmX9usc8g7CRiLfuqA
-rAJM8NUSyBonsIlzQvudmNiyqb5UZIYqK8YvCpkZ3QcHpzVCZ1uYIKa8MY878Pha
-iVqwDWGEtXO9xi3rtHXkvm5Y3wwbXYFDoOvA1YvM/CtLXNCpHU23WhiIErBb3dvG
-xZZroCTtAgMBAAECggEAA8BHqE4eYsKdz18EP6xfwMymn0FDghrKnvowiN/jSKIV
-L/1rpCUrNTHSLL1EpFNq22AhIqOL0fYnV0vKpOHVlZmUVDEAwUSyS0U8LMF7wtPg
-0WIbrkxOV4R4gZVd1vDyAQyArAlcrEIvGPri3gFwQh1JWsAI2cxhCObZAn1IzhRW
-sMecAmtNzzYWeXentSfkfWr0niKDbSAAuYzgVIEWbIfE+kgqBckrWnyM9IgSdy1g
-0b3NRRD/gvykszX7j9fzXGj8RAcCTbN1miaFcHRg3moa1Pu50KjokINsr5xxYqTk
-ltPYU35gMYzNPvu5clvj067j6ikCFMiE4XOXf58qwQKBgQDpQJ2l6b1LrvGAV4Q6
-qieTYPTnGhnm/rSn7jK+AUIF+UmK3mtASuc14keelXeiI42MzvO1P6LLwkFIzVx0
-2X/BrTDZUvU5P5nsgBkoyiC71bkbCzoiSxIQtRurenmkD7EqM+4zBYMvCvrPFmOr
-twuWk+4XLA+nl5Vl+FUgjehCQQKBgQDEVShtn68Pkq22GXR5kzgFu+GaXuVPJKu8
-z45K4mbG+WrnwuMmnIRbMfN9oGF5JXWAe5AtFqlQEcUQLElllRkdUe76WX15M2Jm
-UeqFFARWjToNs7NXmxjsQZFOe0TyfAsdaX++lUhEpeCcv2MnEoNQS9n8yTwhuJM4
-8Zr9KUWfrQKBgQCFkNK1ZxtWc18nNvYpAbaX1jVnALNEayXX47Z6xw2fjhhmxOZ1
-cm7jlCeez8gpuGId94PmjgIS27G2lqIS51kY9qu6Rp7VoW3q14+Qo+4KoV/V9J/d
-c09s8checUumfrXcjNAht05fadIlM5Tvh2nDWAJGkpyEQ3DxazqT4a7WAQKBgFok
-Zz191Zim1c8H/Oxc5ZnsW3bPHyWpRpiYC1LihCHTHnxuhHCT6EketBb37gj7Y+mr
-0dSB1RcIMZxtWP2k6TUHC1wyfmOJbiJgdfbH6/35NbBY03zjnxvKNvb7rfpPbaMB
-bz+Htvid2HTfgpzL6TKSwPFJS6yH3ECG3YxiyK65AoGAHIYaLIP53pszdd1ruCO6
-0rI6/He6hKwG8SmtbXKCKYSAeNwZJkUI+B0xD8ZTq5h3geJD7CEoVPPsv9xauliG
-fspe/KyTX5DqTBx9xNVYj9C2MSozQNs8ObCsUOMKzRaJtHl64US1VzweWA7Whkwf
-1r8MiT2ty4eCk7V3qW1W88A=
------END PRIVATE KEY-----
diff --git a/test/support/gencert.sh b/test/support/gencert.sh
index 114bf70f..cfdda070 100755
--- a/test/support/gencert.sh
+++ b/test/support/gencert.sh
@@ -1,12 +1,5 @@
 #! /bin/sh
 set -ex
 
-openssl genpkey -algorithm RSA -out new_server.key -pkeyopt rsa_keygen_bits:2048
-
-openssl x509 -in ./test/fixtures/server.crt -signkey new_server.key -days 3650 -out new_server.crt
-
-openssl x509 -in new_server.crt -text -noout
-
-mv new_server.crt ./test/fixtures/server.crt
-
-mv new_server.key ./test/fixtures/server.key
+openssl req -x509 -nodes -newkey rsa:2048 -keyout ./test/fixtures/server.key -out ./test/fixtures/server.crt -days 3650 \
+-subj "/C=US/ST=Illinois/L=Chicago/O=node-express-session/CN=express-session.local"

From 4930de729107448e4b34b5bd39f138f71f1561f6 Mon Sep 17 00:00:00 2001
From: ctcpip <ctcpip@users.noreply.github.com>
Date: Thu, 23 Jan 2025 11:04:34 -0600
Subject: [PATCH 235/272] =?UTF-8?q?=E2=AC=86=EF=B8=8F=20bump=20actions?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/ci.yml | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 38dc4da7..ff3bce76 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -185,7 +185,7 @@ jobs:
       run: |
         if npm -ps ls nyc | grep -q nyc; then
           npm run test-ci
-          cp coverage/lcov.info "coverage/${{ matrix.name }}.lcov"
+          cp coverage/lcov.info "coverage/${{ matrix.node-version }}.lcov"
         else
           npm test
         fi
@@ -198,17 +198,17 @@ jobs:
       if: steps.list_env.outputs.nyc != ''
       run: |
         if [[ -d ./coverage ]]; then
-          mv ./coverage "./${{ matrix.name }}"
+          mv ./coverage "./${{ matrix.node-version }}"
           mkdir ./coverage
-          mv "./${{ matrix.name }}" "./coverage/${{ matrix.name }}"
+          mv "./${{ matrix.node-version }}" "./coverage/${{ matrix.node-version }}"
         fi
 
     - name: Upload code coverage
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       if: steps.list_env.outputs.nyc != ''
       with:
-        name: coverage
-        path: ./coverage
+        name: coverage-${{ matrix.node-version }}
+        path: "./coverage/${{ matrix.node-version }}"
         retention-days: 1
 
   coverage:
@@ -222,9 +222,8 @@ jobs:
       run: sudo apt-get -y install lcov
 
     - name: Collect coverage reports
-      uses: actions/download-artifact@v3
+      uses: actions/download-artifact@v4
       with:
-        name: coverage
         path: ./coverage
 
     - name: Merge coverage reports

From b99e6c6fba30996069c9122e9e041a26f13d1d5e Mon Sep 17 00:00:00 2001
From: Carlos Serrano <carlos.pastor@mailonline.co.uk>
Date: Thu, 17 Apr 2025 16:18:22 +0200
Subject: [PATCH 236/272] chore: upgrade scorecard workflow pinned action
 versions (#1008)

---
 .github/workflows/scorecard.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 0e064f47..d23de00e 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -33,12 +33,12 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
+        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
         with:
           results_file: results.sarif
           results_format: sarif
@@ -60,7 +60,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
+        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
         with:
           name: SARIF file
           path: results.sarif
@@ -68,6 +68,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@2f93e4319b2f04a2efc38fa7f78bd681bc3f7b2f # v2.23.2
+        uses: github/codeql-action/upload-sarif@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9
         with:
-          sarif_file: results.sarif
+          sarif_file: results.sarif
\ No newline at end of file

From 6edf5eeab25c1b89ecd2676ce119d600c741b5f6 Mon Sep 17 00:00:00 2001
From: Sebastian Beltran <bjohansebas@gmail.com>
Date: Sat, 26 Apr 2025 22:09:29 -0500
Subject: [PATCH 237/272] ci: add CodeQL (SAST) (#1005)

---
 .github/workflows/codeql.yml | 66 ++++++++++++++++++++++++++++++++++++
 1 file changed, 66 insertions(+)
 create mode 100644 .github/workflows/codeql.yml

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 00000000..9d1b3041
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,66 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL"
+
+on:
+  push:
+    branches: ["master"]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: ["master"]
+  schedule:
+    - cron: "0 0 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@3ab4101902695724f9365a384f86c1074d94e18c # v3.24.7
+        with:
+          languages: javascript
+          # If you wish to specify custom queries, you can do so here or in a config file.
+          # By default, queries listed here will override any specified in a config file.
+          # Prefix the list here with "+" to use these queries and those in the config file.
+
+      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+      # If this step fails, then you should remove it and run the build manually (see below)
+      # - name: Autobuild
+      #   uses: github/codeql-action/autobuild@3ab4101902695724f9365a384f86c1074d94e18c # v3.24.7
+
+      # ℹ️ Command-line programs to run using the OS shell.
+      # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+
+      #   If the Autobuild fails above, remove it and uncomment the following three lines.
+      #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
+
+      # - run: |
+      #   echo "Run, Build Application using script"
+      #   ./location_of_script_within_repo/buildscript.sh
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@3ab4101902695724f9365a384f86c1074d94e18c # v3.24.7
+        with:
+          category: "/language:javascript"
\ No newline at end of file

From 122714cbdab4aee732d9e43a90865c73ec9819af Mon Sep 17 00:00:00 2001
From: StepSecurity Bot <bot@stepsecurity.io>
Date: Sat, 17 May 2025 10:33:44 -0700
Subject: [PATCH 238/272] [StepSecurity] Apply security best practices (#1047)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* [StepSecurity] Apply security best practices

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>

* Update dependabot.yml

* ping supertest versions in CI

Signed-off-by: Sebastian Beltran <bjohansebas@gmail.com>

---------

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
Signed-off-by: Sebastian Beltran <bjohansebas@gmail.com>
Co-authored-by: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Co-authored-by: Sebastian Beltran <bjohansebas@gmail.com>
---
 .github/dependabot.yml   | 11 +++++++++++
 .github/workflows/ci.yml | 31 +++++++++++++++++++------------
 2 files changed, 30 insertions(+), 12 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..69f2040f
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: monthly
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ff3bce76..746b29e1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,6 +4,9 @@ on:
 - pull_request
 - push
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -79,33 +82,34 @@ jobs:
 
         - name: Node.js 8.x
           node-version: "8.17"
-          npm-i: mocha@7.2.0 nyc@14.1.1
+          npm-i: mocha@7.2.0 nyc@14.1.1 supertest@6.1.6
 
         - name: Node.js 9.x
           node-version: "9.11"
-          npm-i: mocha@7.2.0 nyc@14.1.1
+          npm-i: mocha@7.2.0 nyc@14.1.1 supertest@6.1.6
 
         - name: Node.js 10.x
           node-version: "10.24"
-          npm-i: mocha@8.4.0
+          npm-i: mocha@8.4.0 supertest@6.1.6
 
         - name: Node.js 11.x
           node-version: "11.15"
-          npm-i: mocha@8.4.0
+          npm-i: mocha@8.4.0 supertest@6.1.6
 
         - name: Node.js 12.x
           node-version: "12.22"
-          npm-i: mocha@9.2.2
+          npm-i: mocha@9.2.2 supertest@6.1.6
 
         - name: Node.js 13.x
           node-version: "13.14"
-          npm-i: mocha@9.2.2
+          npm-i: mocha@9.2.2 supertest@6.1.6
 
         - name: Node.js 14.x
           node-version: "14.21"
 
         - name: Node.js 15.x
-          node-version: "15.14"
+          node-version: "15.14" 
+          npm-i: supertest@6.1.6
 
         - name: Node.js 16.x
           node-version: "16.20"
@@ -126,7 +130,7 @@ jobs:
           node-version: "21.6"
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
     - name: Install Node.js ${{ matrix.node-version }}
       shell: bash -eo pipefail -l {0}
@@ -204,7 +208,7 @@ jobs:
         fi
 
     - name: Upload code coverage
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       if: steps.list_env.outputs.nyc != ''
       with:
         name: coverage-${{ matrix.node-version }}
@@ -212,17 +216,20 @@ jobs:
         retention-days: 1
 
   coverage:
+    permissions:
+      checks: write  # for coverallsapp/github-action to create new checks
+      contents: read  # for actions/checkout to fetch code
     needs: test
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
     - name: Install lcov
       shell: bash
       run: sudo apt-get -y install lcov
 
     - name: Collect coverage reports
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
       with:
         path: ./coverage
 
@@ -231,6 +238,6 @@ jobs:
       run: find ./coverage -name lcov.info -exec printf '-a %q\n' {} \; | xargs lcov -o ./coverage/lcov.info
 
     - name: Upload coverage report
-      uses: coverallsapp/github-action@master
+      uses: coverallsapp/github-action@09b709cf6a16e30b0808ba050c7a6e8a5ef13f8d # master
       with:
         github-token: ${{ secrets.GITHUB_TOKEN }}

From 168271c665519d7d9164f97873bd0eee88d9e6fb Mon Sep 17 00:00:00 2001
From: Sebastian Beltran <bjohansebas@gmail.com>
Date: Sat, 17 May 2025 13:02:43 -0500
Subject: [PATCH 239/272] fix(dependabot): do not update major versions

Signed-off-by: Sebastian Beltran <bjohansebas@gmail.com>
---
 .github/dependabot.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 69f2040f..492d67d0 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -9,3 +9,6 @@ updates:
     directory: /
     schedule:
       interval: monthly
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]

From 92dd3008e334eaa8466a431ae3c032b827b5816d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 18 May 2025 11:19:32 +0200
Subject: [PATCH 240/272] build(deps-dev): bump mocha from 10.2.0 to 10.8.2
 (#1061)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Ulises Gascón <ulisesgascongonzalez@gmail.com>
---
 HISTORY.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index 57c68d3a..cc879c63 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,8 @@
+unpublished
+==========
+  * deps: mocha@10.8.2
+
+
 1.18.1 / 2024-10-08
 ==========
 
diff --git a/package.json b/package.json
index 79cb1b4c..b4978a27 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "8.56.0",
     "eslint-plugin-markdown": "3.0.1",
     "express": "4.17.3",
-    "mocha": "10.2.0",
+    "mocha": "10.8.2",
     "nyc": "15.1.0",
     "supertest": "6.3.4"
   },

From 7e2c6964263b66d7fbdbd75d1c603413880fef64 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 31 May 2025 19:32:09 -0500
Subject: [PATCH 241/272] build(deps): bump ossf/scorecard-action from 2.4.0 to
 2.4.1 (#1048)

Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.0 to 2.4.1.
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](https://github.com/ossf/scorecard-action/compare/62b2cac7ed8198b15735ed49ab1e5cf35480ba46...f49aabe0b5af0936a0987cfb85d86b75731b0186)

---
updated-dependencies:
- dependency-name: ossf/scorecard-action
  dependency-version: 2.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index d23de00e..3d4b1114 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -38,7 +38,7 @@ jobs:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
+        uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
         with:
           results_file: results.sarif
           results_format: sarif

From 2633e88780e5655db44d11f917629942cb92628d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 31 May 2025 19:32:43 -0500
Subject: [PATCH 242/272] build(deps): bump github/codeql-action from 3.24.7 to
 3.28.18 (#1050)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.24.7 to 3.28.18.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/v3.24.7...ff0a06e83cb2de871e5a09832bc6a81e7276941f)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 3.28.18
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/codeql.yml    | 4 ++--
 .github/workflows/scorecard.yml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 9d1b3041..894e99aa 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -38,7 +38,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@3ab4101902695724f9365a384f86c1074d94e18c # v3.24.7
+        uses: github/codeql-action/init@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
         with:
           languages: javascript
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -61,6 +61,6 @@ jobs:
       #   ./location_of_script_within_repo/buildscript.sh
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@3ab4101902695724f9365a384f86c1074d94e18c # v3.24.7
+        uses: github/codeql-action/analyze@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
         with:
           category: "/language:javascript"
\ No newline at end of file
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 3d4b1114..5ad5ef6a 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -68,6 +68,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9
+        uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
         with:
           sarif_file: results.sarif
\ No newline at end of file

From 2caff6ae8976763841abbc8ed7b560cc5ebdf6cf Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 31 May 2025 19:33:21 -0500
Subject: [PATCH 243/272] build(deps): bump actions/checkout from 4.1.1 to
 4.2.2 (#1049)

Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.1 to 4.2.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v4.1.1...11bd71901bbe5b1630ceea73d27597364c9af683)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 4.2.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/codeql.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 894e99aa..1a41f87b 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -34,7 +34,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL

From ec1957b9bd169c582a00d83f5966f4c5fed9017d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 31 May 2025 19:33:55 -0500
Subject: [PATCH 244/272] build(deps): bump actions/upload-artifact from 4.5.0
 to 4.6.2 (#1052)

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.5.0 to 4.6.2.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v4.5.0...ea165f8d65b6e75b540449e92b4886f43607fa02)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 4.6.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 5ad5ef6a..d53e5871 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -60,7 +60,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: SARIF file
           path: results.sarif

From a698c81f2ab950188cdbd7f30bb3a89fd68e2046 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 31 May 2025 19:34:41 -0500
Subject: [PATCH 245/272] build(deps): bump coverallsapp/github-action from
 1.2.5 to 2.3.6 (#1051)

Bumps [coverallsapp/github-action](https://github.com/coverallsapp/github-action) from 1.2.5 to 2.3.6.
- [Release notes](https://github.com/coverallsapp/github-action/releases)
- [Upgrade guide](https://github.com/coverallsapp/github-action/blob/main/UPGRADE.md)
- [Commits](https://github.com/coverallsapp/github-action/compare/09b709cf6a16e30b0808ba050c7a6e8a5ef13f8d...648a8eb78e6d50909eff900e4ec85cab4524a45b)

---
updated-dependencies:
- dependency-name: coverallsapp/github-action
  dependency-version: 2.3.6
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 746b29e1..210657e2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -238,6 +238,6 @@ jobs:
       run: find ./coverage -name lcov.info -exec printf '-a %q\n' {} \; | xargs lcov -o ./coverage/lcov.info
 
     - name: Upload coverage report
-      uses: coverallsapp/github-action@09b709cf6a16e30b0808ba050c7a6e8a5ef13f8d # master
+      uses: coverallsapp/github-action@648a8eb78e6d50909eff900e4ec85cab4524a45b # master
       with:
         github-token: ${{ secrets.GITHUB_TOKEN }}

From b9fcad8a8bc8f1ac84809d81c569ffbcc6f9ef99 Mon Sep 17 00:00:00 2001
From: Noritaka Kobayashi <arukimedesu1166777@gmail.com>
Date: Sat, 12 Jul 2025 02:21:20 +0900
Subject: [PATCH 246/272] chore: fix typos (#1066)

---
 HISTORY.md                 | 2 +-
 README.md                  | 4 ++--
 scripts/version-history.js | 2 +-
 test/session.js            | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index cc879c63..1dcedcc5 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -171,7 +171,7 @@ unpublished
     - Improve error message when `expires` is not a `Date`
     - perf: enable strict mode
     - perf: use for loop in parse
-    - perf: use string concatination for serialization
+    - perf: use string concatenation for serialization
   * deps: parseurl@~1.3.1
     - perf: enable strict mode
   * deps: uid-safe@~2.1.1
diff --git a/README.md b/README.md
index 65a37e63..b880e6b4 100644
--- a/README.md
+++ b/README.md
@@ -269,7 +269,7 @@ With this enabled, the session identifier cookie will expire in
 [`maxAge`](#cookiemaxage) since the last response was sent instead of in
 [`maxAge`](#cookiemaxage) since the session was last modified by the server.
 
-This is typically used in conjuction with short, non-session-length
+This is typically used in conjunction with short, non-session-length
 [`maxAge`](#cookiemaxage) values to provide a quick timeout of the session data
 with reduced potential of it occurring during on going server interactions.
 
@@ -773,7 +773,7 @@ a [variety of storage types](https://www.npmjs.com/package/cache-manager#store-e
 [express-session-level-url]: https://www.npmjs.com/package/express-session-level
 [express-session-level-image]: https://badgen.net/github/stars/tgohn/express-session-level?label=%E2%98%85
 
-[![★][express-session-rsdb-image] express-session-rsdb][express-session-rsdb-url] Session store based on Rocket-Store: A very simple, super fast and yet powerfull, flat file database.
+[![★][express-session-rsdb-image] express-session-rsdb][express-session-rsdb-url] Session store based on Rocket-Store: A very simple, super fast and yet powerful, flat file database.
 
 [express-session-rsdb-url]: https://www.npmjs.com/package/express-session-rsdb
 [express-session-rsdb-image]: https://badgen.net/github/stars/paragi/express-session-rsdb?label=%E2%98%85
diff --git a/scripts/version-history.js b/scripts/version-history.js
index b8a2b0e8..c58268ad 100644
--- a/scripts/version-history.js
+++ b/scripts/version-history.js
@@ -16,7 +16,7 @@ if (!MD_HEADER_REGEXP.test(historyFileLines[1])) {
 }
 
 if (!VERSION_PLACEHOLDER_REGEXP.test(historyFileLines[0])) {
-  console.error('Missing placegolder version in HISTORY.md')
+  console.error('Missing placeholder version in HISTORY.md')
   process.exit(1)
 }
 
diff --git a/test/session.js b/test/session.js
index 7bf3e51f..a7d79b70 100644
--- a/test/session.js
+++ b/test/session.js
@@ -1710,7 +1710,7 @@ describe('session()', function(){
         })
       })
 
-      it('should not override an overriden `reload` in case of errors',  function (done) {
+      it('should not override an overridden `reload` in case of errors',  function (done) {
         var store = new session.MemoryStore()
         var server = createServer({ store: store, resave: false }, function (req, res) {
           if (req.url === '/') {

From 58087831a68787fb3c1ef8b821efb965225dc725 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= <ulisesgascongonzalez@gmail.com>
Date: Thu, 17 Jul 2025 19:25:18 +0200
Subject: [PATCH 247/272] deps: on-headers@1.1.0 (#1069)

---
 HISTORY.md   | 3 ++-
 package.json | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 1dcedcc5..401ffbd5 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,7 +1,8 @@
 unpublished
 ==========
   * deps: mocha@10.8.2
-
+  * deps: on-headers@~1.1.0
+    - Fix [CVE-2025-7339](https://www.cve.org/CVERecord?id=CVE-2025-7339) ([GHSA-76c9-3jph-rj3q](https://github.com/expressjs/on-headers/security/advisories/GHSA-76c9-3jph-rj3q))
 
 1.18.1 / 2024-10-08
 ==========
diff --git a/package.json b/package.json
index b4978a27..f03896af 100644
--- a/package.json
+++ b/package.json
@@ -14,7 +14,7 @@
     "cookie-signature": "1.0.7",
     "debug": "2.6.9",
     "depd": "~2.0.0",
-    "on-headers": "~1.0.2",
+    "on-headers": "~1.1.0",
     "parseurl": "~1.3.3",
     "safe-buffer": "5.2.1",
     "uid-safe": "~2.1.5"

From d10709f319d1ff4069e1e552fc7f3ca27989e981 Mon Sep 17 00:00:00 2001
From: Chris de Almeida <ctcpip@users.noreply.github.com>
Date: Thu, 17 Jul 2025 12:51:20 -0500
Subject: [PATCH 248/272] =?UTF-8?q?=F0=9F=94=96=20v1.18.2=20(#1070)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 HISTORY.md   | 2 +-
 package.json | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 401ffbd5..9aacf124 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,4 +1,4 @@
-unpublished
+1.18.2 / 2025-07-17
 ==========
   * deps: mocha@10.8.2
   * deps: on-headers@~1.1.0
diff --git a/package.json b/package.json
index f03896af..7039d1d4 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.18.1",
+  "version": "1.18.2",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From 1aa756d20a1af2b922e9897ca0010fa466ce17e7 Mon Sep 17 00:00:00 2001
From: Sebastian Beltran <bjohansebas@gmail.com>
Date: Wed, 23 Jul 2025 07:42:19 -0500
Subject: [PATCH 249/272] chore: add funding to package.json (#1071)

---
 package.json | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/package.json b/package.json
index 7039d1d4..3bc6ac59 100644
--- a/package.json
+++ b/package.json
@@ -8,6 +8,10 @@
     "Joe Wagner <njwjs722@gmail.com>"
   ],
   "repository": "expressjs/session",
+  "funding": {
+    "type": "opencollective",
+    "url": "https://opencollective.com/express"
+  },
   "license": "MIT",
   "dependencies": {
     "cookie": "0.7.2",

From 488102d3d79ee394c90e0b051bf0dbe137956400 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 2 Nov 2025 09:29:37 +0100
Subject: [PATCH 250/272] build(deps): bump actions/download-artifact from
 4.3.0 to 6.0.0 (#1086)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 210657e2..167e2e38 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -229,7 +229,7 @@ jobs:
       run: sudo apt-get -y install lcov
 
     - name: Collect coverage reports
-      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
       with:
         path: ./coverage
 

From b6f79be32f4afd88b92eda9a3448b7136cecac1e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 2 Nov 2025 09:30:20 +0100
Subject: [PATCH 251/272] build(deps): bump github/codeql-action from 3.28.18
 to 4.31.2 (#1085)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/codeql.yml    | 4 ++--
 .github/workflows/scorecard.yml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 1a41f87b..bdff87f4 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -38,7 +38,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
+        uses: github/codeql-action/init@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
         with:
           languages: javascript
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -61,6 +61,6 @@ jobs:
       #   ./location_of_script_within_repo/buildscript.sh
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
+        uses: github/codeql-action/analyze@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
         with:
           category: "/language:javascript"
\ No newline at end of file
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index d53e5871..a6a29448 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -68,6 +68,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
+        uses: github/codeql-action/upload-sarif@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
         with:
           sarif_file: results.sarif
\ No newline at end of file

From c83c8e28d586c3f86f9844356590b2e704843f57 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 2 Dec 2025 09:15:55 +0100
Subject: [PATCH 252/272] build(deps): bump coverallsapp/github-action from
 2.3.6 to 2.3.7 (#1091)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 167e2e38..f7078328 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -238,6 +238,6 @@ jobs:
       run: find ./coverage -name lcov.info -exec printf '-a %q\n' {} \; | xargs lcov -o ./coverage/lcov.info
 
     - name: Upload coverage report
-      uses: coverallsapp/github-action@648a8eb78e6d50909eff900e4ec85cab4524a45b # master
+      uses: coverallsapp/github-action@5cbfd81b66ca5d10c19b062c04de0199c215fb6e # master
       with:
         github-token: ${{ secrets.GITHUB_TOKEN }}

From a095a9a17c862746af8c2d8671825e4743d38169 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 2 Dec 2025 09:16:45 +0100
Subject: [PATCH 253/272] build(deps): bump actions/upload-artifact from 4.6.2
 to 5.0.0 (#1090)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/ci.yml        | 2 +-
 .github/workflows/scorecard.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f7078328..30a606f2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -208,7 +208,7 @@ jobs:
         fi
 
     - name: Upload code coverage
-      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
       if: steps.list_env.outputs.nyc != ''
       with:
         name: coverage-${{ matrix.node-version }}
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index a6a29448..a6efdc9e 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -60,7 +60,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: SARIF file
           path: results.sarif

From 0e7a438512fa584c617d681cf7fca8fb5c42da5d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 2 Dec 2025 09:17:30 +0100
Subject: [PATCH 254/272] build(deps): bump github/codeql-action from 4.31.2 to
 4.31.6 (#1089)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/codeql.yml    | 4 ++--
 .github/workflows/scorecard.yml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index bdff87f4..31ffb64a 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -38,7 +38,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
+        uses: github/codeql-action/init@fe4161a26a8629af62121b670040955b330f9af2 # v4.31.6
         with:
           languages: javascript
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -61,6 +61,6 @@ jobs:
       #   ./location_of_script_within_repo/buildscript.sh
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
+        uses: github/codeql-action/analyze@fe4161a26a8629af62121b670040955b330f9af2 # v4.31.6
         with:
           category: "/language:javascript"
\ No newline at end of file
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index a6efdc9e..51230d44 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -68,6 +68,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
+        uses: github/codeql-action/upload-sarif@fe4161a26a8629af62121b670040955b330f9af2 # v4.31.6
         with:
           sarif_file: results.sarif
\ No newline at end of file

From 1307f30a62d10cf33f7abd59b8ecf3aae428ff3b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 2 Dec 2025 09:18:56 +0100
Subject: [PATCH 255/272] build(deps): bump actions/checkout from 4.2.2 to
 6.0.0 (#1088)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/ci.yml        | 4 ++--
 .github/workflows/codeql.yml    | 2 +-
 .github/workflows/scorecard.yml | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 30a606f2..13336155 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -130,7 +130,7 @@ jobs:
           node-version: "21.6"
 
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
     - name: Install Node.js ${{ matrix.node-version }}
       shell: bash -eo pipefail -l {0}
@@ -222,7 +222,7 @@ jobs:
     needs: test
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
     - name: Install lcov
       shell: bash
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 31ffb64a..8534ee51 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -34,7 +34,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 51230d44..30f54d2b 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -33,7 +33,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           persist-credentials: false
 

From 2cd6561f64cb9e0b847237885802351606d4029d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 17 Dec 2025 16:04:48 -0500
Subject: [PATCH 256/272] build(deps): bump ossf/scorecard-action from 2.4.1 to
 2.4.3 (#1082)

Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.1 to 2.4.3.
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](https://github.com/ossf/scorecard-action/compare/f49aabe0b5af0936a0987cfb85d86b75731b0186...4eaacf0543bb3f2c246792bd56e8cdeffafb205a)

---
updated-dependencies:
- dependency-name: ossf/scorecard-action
  dependency-version: 2.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 30f54d2b..169262af 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -38,7 +38,7 @@ jobs:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
         with:
           results_file: results.sarif
           results_format: sarif

From 00b8a5ff111bba1a0ca9bb3d84947446c198a9a3 Mon Sep 17 00:00:00 2001
From: Ayoub Mabrouk <77799760+Ayoub-Mabrouk@users.noreply.github.com>
Date: Thu, 18 Dec 2025 02:53:00 +0100
Subject: [PATCH 257/272] refactor: remove unused `sess` parameter from
 `generateSessionId` function (#1001)

The `sess` parameter was not used in `generateSessionId`, so it was removed to improve code clarity and reduce potential confusion.

Co-authored-by: Sebastian Beltran <bjohansebas@gmail.com>
---
 index.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/index.js b/index.js
index d41b2378..85a0330c 100644
--- a/index.js
+++ b/index.js
@@ -523,7 +523,7 @@ function session(options) {
  * @private
  */
 
-function generateSessionId(sess) {
+function generateSessionId() {
   return uid(24);
 }
 

From 6d69f090d6239394e008cf39a2be2d5f60bdde97 Mon Sep 17 00:00:00 2001
From: Sebastian Beltran <bjohansebas@gmail.com>
Date: Thu, 18 Dec 2025 06:45:22 -0500
Subject: [PATCH 258/272] chore: remove history.md from being packaged on
 publish (#1097)

---
 package.json | 1 -
 1 file changed, 1 deletion(-)

diff --git a/package.json b/package.json
index 3bc6ac59..6d04c9c1 100644
--- a/package.json
+++ b/package.json
@@ -35,7 +35,6 @@
   },
   "files": [
     "session/",
-    "HISTORY.md",
     "index.js"
   ],
   "engines": {

From 264b6a0360a1d4b34955c27948bf1b1cfad74d66 Mon Sep 17 00:00:00 2001
From: Sebastian Beltran <bjohansebas@gmail.com>
Date: Thu, 18 Dec 2025 06:46:00 -0500
Subject: [PATCH 259/272] deps: use tilde notation for dependencies (#1096)

---
 HISTORY.md   | 6 ++++++
 package.json | 8 ++++----
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 9aacf124..e12d0a00 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,9 @@
+# Unreleased changes
+
+### 🚀 Improvements
+
+* deps: use tilde notation for dependencies
+
 1.18.2 / 2025-07-17
 ==========
   * deps: mocha@10.8.2
diff --git a/package.json b/package.json
index 6d04c9c1..42d244b9 100644
--- a/package.json
+++ b/package.json
@@ -14,13 +14,13 @@
   },
   "license": "MIT",
   "dependencies": {
-    "cookie": "0.7.2",
-    "cookie-signature": "1.0.7",
-    "debug": "2.6.9",
+    "cookie": "~0.7.2",
+    "cookie-signature": "~1.0.7",
+    "debug": "~2.6.9",
     "depd": "~2.0.0",
     "on-headers": "~1.1.0",
     "parseurl": "~1.3.3",
-    "safe-buffer": "5.2.1",
+    "safe-buffer": "~5.2.1",
     "uid-safe": "~2.1.5"
   },
   "devDependencies": {

From 73e0193afbee24bca8744e4fc8a67b92810301e8 Mon Sep 17 00:00:00 2001
From: Zacchaeus Bolaji <djunehor@gmail.com>
Date: Sat, 17 Jan 2026 23:20:37 +0100
Subject: [PATCH 260/272] Add sameSite 'auto' support to match secure 'auto'
 pattern (#1087)

* feat: add sameSite 'auto' support for automatic cross-site cookie configuration

* test: enhance session tests for secure and SameSite cookie attributes

* test: update session tests for SameSite cookie handling and logging

* docs: add history entry

* refactor: cache issecure result to avoid duplicate calls

* Apply suggestion from @bjohansebas

---------

Co-authored-by: Sebastian Beltran <bjohansebas@gmail.com>
---
 HISTORY.md      |   4 ++
 README.md       |   9 +++
 index.js        |   8 ++-
 package.json    |   2 +-
 test/session.js | 167 ++++++++++++++++++++++++++++++++++++++++++++++++
 5 files changed, 188 insertions(+), 2 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index e12d0a00..60cf6db4 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -2,6 +2,10 @@
 
 ### 🚀 Improvements
 
+* Add sameSite 'auto' support for automatic SameSite attribute configuration
+
+    Added `sameSite: 'auto'` option for cookie configuration that automatically sets `SameSite=None` for HTTPS and `SameSite=Lax` for HTTP connections, simplifying cookie handling across different environments.
+
 * deps: use tilde notation for dependencies
 
 1.18.2 / 2025-07-17
diff --git a/README.md b/README.md
index b880e6b4..4f19ce59 100644
--- a/README.md
+++ b/README.md
@@ -130,6 +130,7 @@ By default, this is `false`.
   - `'lax'` will set the `SameSite` attribute to `Lax` for lax same site enforcement.
   - `'none'` will set the `SameSite` attribute to `None` for an explicit cross-site cookie.
   - `'strict'` will set the `SameSite` attribute to `Strict` for strict same site enforcement.
+  - `'auto'` will set the `SameSite` attribute to `None` for secure connections and `Lax` for non-secure connections.
 
 More information about the different enforcement levels can be found in
 [the specification][rfc-6265bis-03-4.1.2.7].
@@ -141,6 +142,14 @@ the future. This also means many clients may ignore this attribute until they un
 that requires that the `Secure` attribute be set to `true` when the `SameSite` attribute has been
 set to `'none'`. Some web browsers or other clients may be adopting this specification.
 
+The `cookie.sameSite` option can also be set to the special value `'auto'` to have
+this setting automatically match the determined security of the connection. When the connection
+is secure (HTTPS), the `SameSite` attribute will be set to `None` to enable cross-site usage.
+When the connection is not secure (HTTP), the `SameSite` attribute will be set to `Lax` for
+better security while maintaining functionality. This is useful when the Express `"trust proxy"`
+setting is properly setup to simplify development vs production configuration, particularly
+for SAML authentication scenarios.
+
 ##### cookie.secure
 
 Specifies the `boolean` value for the `Secure` `Set-Cookie` attribute. When truthy,
diff --git a/index.js b/index.js
index 85a0330c..1ee99eb5 100644
--- a/index.js
+++ b/index.js
@@ -160,8 +160,14 @@ function session(options) {
     req.session = new Session(req);
     req.session.cookie = new Cookie(cookieOptions);
 
+    var isSecure = issecure(req, trustProxy);
+
     if (cookieOptions.secure === 'auto') {
-      req.session.cookie.secure = issecure(req, trustProxy);
+      req.session.cookie.secure = isSecure;
+    }
+
+    if (cookieOptions.sameSite === 'auto') {
+      req.session.cookie.sameSite = isSecure ? 'none' : 'lax';
     }
   };
 
diff --git a/package.json b/package.json
index 42d244b9..0f7d92e7 100644
--- a/package.json
+++ b/package.json
@@ -42,7 +42,7 @@
   },
   "scripts": {
     "lint": "eslint . && node ./scripts/lint-readme.js",
-    "test": "./test/support/gencert.sh && mocha --require test/support/env --check-leaks --bail --no-exit --reporter spec test/",
+    "test": "./test/support/gencert.sh && mocha --require test/support/env --check-leaks --no-exit --reporter spec test/",
     "test-ci": "nyc --reporter=lcov --reporter=text npm test",
     "test-cov": "nyc npm test",
     "version": "node scripts/version-history.js && git add HISTORY.md"
diff --git a/test/session.js b/test/session.js
index a7d79b70..31f4707b 100644
--- a/test/session.js
+++ b/test/session.js
@@ -801,6 +801,173 @@ describe('session()', function(){
         })
       })
     })
+
+    describe('when "sameSite" set to "auto"', function () {
+      describe('basic functionality', function () {
+        before(function () {
+          function setup (req) {
+            req.secure = JSON.parse(req.headers['x-secure'])
+          }
+
+          function respond (req, res) {
+            res.end(String(req.secure))
+          }
+
+          this.server = createServer(setup, { cookie: { sameSite: 'auto' } }, respond)
+        })
+
+        it('should set SameSite=None for secure connections', function (done) {
+          request(this.server)
+          .get('/')
+          .set('X-Secure', 'true')
+          .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'None'))
+          .expect(200, 'true', done)
+        })
+
+        it('should set SameSite=Lax for insecure connections', function (done) {
+          request(this.server)
+          .get('/')
+          .set('X-Secure', 'false')
+          .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'Lax'))
+          .expect(200, 'false', done)
+        })
+      })
+
+      describe('with proxy settings', function () {
+        describe('when "proxy" is "true"', function () {
+          before(function () {
+            this.server = createServer({ proxy: true, cookie: { sameSite: 'auto' }})
+          })
+
+          it('should set SameSite=None when X-Forwarded-Proto is https', function (done) {
+            request(this.server)
+            .get('/')
+            .set('X-Forwarded-Proto', 'https')
+            .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'None'))
+            .expect(200, done)
+          })
+
+          it('should set SameSite=Lax when X-Forwarded-Proto is http', function (done) {
+            request(this.server)
+            .get('/')
+            .set('X-Forwarded-Proto', 'http')
+            .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'Lax'))
+            .expect(200, done)
+          })
+        })
+
+        describe('when "proxy" is "false"', function () {
+          before(function () {
+            this.server = createServer({ proxy: false, cookie: { sameSite: 'auto' }})
+          })
+
+          it('should set SameSite=Lax when X-Forwarded-Proto is https', function (done) {
+            request(this.server)
+            .get('/')
+            .set('X-Forwarded-Proto', 'https')
+            .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'Lax'))
+            .expect(200, done)
+          })
+        })
+      })
+
+      describe('combined with secure auto', function() {
+        describe('when "secure" is "auto"', function () {
+          before(function () {
+            function setup (req) {
+              req.secure = JSON.parse(req.headers['x-secure'])
+            }
+
+            function respond (req, res) {
+              res.end(String(req.secure))
+            }
+
+            this.server = createServer(setup, { cookie: { secure: 'auto', sameSite: 'auto' } }, respond)
+          })
+
+          it('should set both Secure and SameSite=None when secure', function (done) {
+            request(this.server)
+              .get('/')
+              .set('X-Secure', 'true')
+              .expect(shouldSetCookieWithAttribute('connect.sid', 'Secure'))
+              .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'None'))
+              .expect(200, 'true', done)
+          })
+
+          it('should set neither Secure nor SameSite=None when insecure', function (done) {
+            request(this.server)
+              .get('/')
+              .set('X-Secure', 'false')
+              .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Secure'))
+              .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'Lax'))
+              .expect(200, 'false', done)
+          })
+        })
+
+        describe('when "secure" is "false"', function () {
+          before(function () {
+            function setup (req) {
+              req.secure = JSON.parse(req.headers['x-secure'])
+            }
+
+            function respond (req, res) {
+              res.end(String(req.secure))
+            }
+
+            this.server = createServer(setup, { cookie: { secure: false, sameSite: 'auto' } }, respond)
+          })
+
+          it('should set SameSite=None without Secure when secure', function (done) {
+            request(this.server)
+              .get('/')
+              .set('X-Secure', 'true')
+              .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Secure'))
+              .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'None'))
+              .expect(200, 'true', done)
+          })
+
+          it('should set SameSite=Lax without Secure when insecure', function (done) {
+            request(this.server)
+              .get('/')
+              .set('X-Secure', 'false')
+              .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Secure'))
+              .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'Lax'))
+              .expect(200, 'false', done)
+          })
+        })
+
+        describe('when "secure" is "true"', function () {
+          before(function () {
+            function setup (req) {
+              req.secure = JSON.parse(req.headers['x-secure'])
+            }
+
+            function respond (req, res) {
+              res.end(String(req.secure))
+            }
+
+            this.server = createServer(setup, { cookie: { secure: true, sameSite: 'auto' } }, respond)
+          })
+
+          it('should set both Secure and SameSite=None when secure', function (done) {
+            request(this.server)
+              .get('/')
+              .set('X-Secure', 'true')
+              .expect(shouldSetCookieWithAttribute('connect.sid', 'Secure'))
+              .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'None'))
+              .expect(200, 'true', done)
+          })
+
+          it('should not set cookie when insecure', function (done) {
+            request(this.server)
+              .get('/')
+              .set('X-Secure', 'false')
+              .expect(shouldNotHaveHeader('Set-Cookie'))
+              .expect(200, 'false', done)
+          })
+        })
+      })
+    })
   })
 
   describe('genid option', function(){

From 2673736548304359d3d3fb8f8d3019b4ea5b61a7 Mon Sep 17 00:00:00 2001
From: Lincon <lincond@protonmail.com>
Date: Mon, 19 Jan 2026 11:44:13 -0300
Subject: [PATCH 261/272] feat: add support to dynamic cookie options (#1027)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Sebastian Beltran <bjohansebas@gmail.com>
Co-authored-by: Ulises Gascón <ulisesgascongonzalez@gmail.com>
---
 HISTORY.md      | 21 ++++++++++++++++++++
 README.md       | 20 +++++++++++++++++++
 index.js        |  7 ++++---
 test/session.js | 52 +++++++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 97 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 60cf6db4..e28c5427 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -2,6 +2,27 @@
 
 ### 🚀 Improvements
 
+* Add dynamic cookie options support
+
+    Cookie options can now be dynamic, allowing for more flexible and context-aware configuration based on each request.  This feature enables programmatic modification of cookie attributes like `secure`, `httpOnly`, `sameSite`, `maxAge`, `domain`, and `path` based on session or request conditions.
+
+    ```js
+    var app = express()
+    app.use(session({
+      secret: 'keyboard cat',
+      resave: false,
+      saveUninitialized: true,
+      cookie: function (req) {
+        var match = req.url.match(/^\/([^/]+)/);
+        return {
+          path: match ? '/' + match[1] : '/',
+          httpOnly: true,
+          secure: req.secure || false,
+          maxAge: 60000
+        }
+      }
+    }))
+    ```
 * Add sameSite 'auto' support for automatic SameSite attribute configuration
 
     Added `sameSite: 'auto'` option for cookie configuration that automatically sets `SameSite=None` for HTTPS and `SameSite=Lax` for HTTP connections, simplifying cookie handling across different environments.
diff --git a/README.md b/README.md
index 4f19ce59..292b2024 100644
--- a/README.md
+++ b/README.md
@@ -49,6 +49,26 @@ For a list of stores, see [compatible session stores](#compatible-session-stores
 Settings object for the session ID cookie. The default value is
 `{ path: '/', httpOnly: true, secure: false, maxAge: null }`.
 
+In addition to providing a static object, you can also pass a callback function to dynamically generate the cookie options for each request. The callback receives the `req` object as its argument and should return an object containing the cookie settings.
+
+```js
+var app = express()
+app.use(session({
+  secret: 'keyboard cat',
+  resave: false,
+  saveUninitialized: true,
+  cookie: function(req) {
+    var match = req.url.match(/^\/([^/]+)/);
+    return {
+      path: match ? '/' + match[1] : '/',
+      httpOnly: true,
+      secure: req.secure || false,
+      maxAge: 60000
+    }
+  }
+}))
+```
+
 The following are options that can be set in this object.
 
 ##### cookie.domain
diff --git a/index.js b/index.js
index 1ee99eb5..1a509318 100644
--- a/index.js
+++ b/index.js
@@ -70,7 +70,7 @@ var defer = typeof setImmediate === 'function'
  * Setup session store with the given `options`.
  *
  * @param {Object} [options]
- * @param {Object} [options.cookie] Options for cookie
+ * @param {Object|Function} [options.cookie] Options for cookie
  * @param {Function} [options.genid]
  * @param {String} [options.name=connect.sid] Session ID cookie name
  * @param {Boolean} [options.proxy]
@@ -158,7 +158,7 @@ function session(options) {
   store.generate = function(req){
     req.sessionID = generateId(req);
     req.session = new Session(req);
-    req.session.cookie = new Cookie(cookieOptions);
+    req.session.cookie = new Cookie(typeof cookieOptions === 'function' ? cookieOptions(req) : cookieOptions);
 
     var isSecure = issecure(req, trustProxy);
 
@@ -199,7 +199,8 @@ function session(options) {
 
     // pathname mismatch
     var originalPath = parseUrl.original(req).pathname || '/'
-    if (originalPath.indexOf(cookieOptions.path || '/') !== 0) {
+    var resolvedCookieOptions = typeof cookieOptions === 'function' ? cookieOptions(req) : cookieOptions
+    if (originalPath.indexOf(resolvedCookieOptions.path || '/') !== 0) {
       debug('pathname mismatch')
       next()
       return
diff --git a/test/session.js b/test/session.js
index 31f4707b..46fed763 100644
--- a/test/session.js
+++ b/test/session.js
@@ -802,6 +802,58 @@ describe('session()', function(){
       })
     })
 
+    describe('when "cookie" is a function', function () {
+      it('should call custom function and apply cookie options', function (done) {
+        var cookieCallbackCalled = false;
+        var cookieCallback = function () {
+          cookieCallbackCalled = true;
+          return { path: '/test', httpOnly: true, secure: false };
+        };
+        var server = createServer({ cookie: cookieCallback });
+        request(server)
+          .get('/test')
+          .expect(
+            shouldSetCookieWithAttributeAndValue('connect.sid', 'Path', '/test')
+          )
+          .expect(shouldSetCookieWithAttribute('connect.sid', 'HttpOnly'))
+          .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Secure'))
+          .expect(200, function (err) {
+            if (err) return done(err);
+            assert.strictEqual(
+              cookieCallbackCalled,
+              true,
+              'should have called cookie callback'
+            );
+            done();
+          });
+      });
+
+      it('should provide req argument', function (done) {
+        var _path = '/test';
+        var cookieCallbackCalled = false;
+        var cookieCallback = function (req) {
+          cookieCallbackCalled = true;
+          return { path: req.url, httpOnly: true, secure: false };
+        };
+        var server = createServer({ cookie: cookieCallback });
+        request(server)
+          .get(_path)
+          .expect(
+            shouldSetCookieWithAttributeAndValue('connect.sid', 'Path', _path)
+          )
+          .expect(shouldSetCookieWithAttribute('connect.sid', 'HttpOnly'))
+          .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Secure'))
+          .expect(200, function (err) {
+            if (err) return done(err);
+            assert.strictEqual(
+              cookieCallbackCalled,
+              true,
+              'should have called cookie callback'
+            );
+            done();
+          });
+      });
+    });
     describe('when "sameSite" set to "auto"', function () {
       describe('basic functionality', function () {
         before(function () {

From c10b2a383841766899f6dcf53c8aff8c7fd3d2e7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= <ulisesgascongonzalez@gmail.com>
Date: Thu, 22 Jan 2026 15:44:27 +0100
Subject: [PATCH 262/272] 1.19.0 (#1107)

---
 HISTORY.md   | 36 ++++++------------------------------
 package.json |  2 +-
 2 files changed, 7 insertions(+), 31 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index e28c5427..fae1a0f1 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,33 +1,9 @@
-# Unreleased changes
-
-### 🚀 Improvements
-
-* Add dynamic cookie options support
-
-    Cookie options can now be dynamic, allowing for more flexible and context-aware configuration based on each request.  This feature enables programmatic modification of cookie attributes like `secure`, `httpOnly`, `sameSite`, `maxAge`, `domain`, and `path` based on session or request conditions.
-
-    ```js
-    var app = express()
-    app.use(session({
-      secret: 'keyboard cat',
-      resave: false,
-      saveUninitialized: true,
-      cookie: function (req) {
-        var match = req.url.match(/^\/([^/]+)/);
-        return {
-          path: match ? '/' + match[1] : '/',
-          httpOnly: true,
-          secure: req.secure || false,
-          maxAge: 60000
-        }
-      }
-    }))
-    ```
-* Add sameSite 'auto' support for automatic SameSite attribute configuration
-
-    Added `sameSite: 'auto'` option for cookie configuration that automatically sets `SameSite=None` for HTTPS and `SameSite=Lax` for HTTP connections, simplifying cookie handling across different environments.
-
-* deps: use tilde notation for dependencies
+1.19.0 / 2026-01-22
+==========
+
+  * Add dynamic cookie options support
+  * Add sameSite 'auto' support for automatic SameSite attribute configuration
+  * deps: use tilde notation for dependencies
 
 1.18.2 / 2025-07-17
 ==========
diff --git a/package.json b/package.json
index 0f7d92e7..36387796 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.18.2",
+  "version": "1.19.0",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From 31bb90351eceb003e4fb40d01c6c0ca1c1ba2f6f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 2 Mar 2026 08:42:03 +0100
Subject: [PATCH 263/272] build(deps): bump github/codeql-action from 4.31.6 to
 4.32.4 (#1111)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.31.6 to 4.32.4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/fe4161a26a8629af62121b670040955b330f9af2...89a39a4e59826350b863aa6b6252a07ad50cf83e)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.32.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/codeql.yml    | 4 ++--
 .github/workflows/scorecard.yml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 8534ee51..e4fbd605 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -38,7 +38,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@fe4161a26a8629af62121b670040955b330f9af2 # v4.31.6
+        uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
         with:
           languages: javascript
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -61,6 +61,6 @@ jobs:
       #   ./location_of_script_within_repo/buildscript.sh
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@fe4161a26a8629af62121b670040955b330f9af2 # v4.31.6
+        uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
         with:
           category: "/language:javascript"
\ No newline at end of file
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 169262af..a1566ba6 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -68,6 +68,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@fe4161a26a8629af62121b670040955b330f9af2 # v4.31.6
+        uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
         with:
           sarif_file: results.sarif
\ No newline at end of file

From 1d90a1a61921ae600fc127b3bc0ce6de03890cc5 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 2 Mar 2026 08:42:39 +0100
Subject: [PATCH 264/272] build(deps): bump actions/upload-artifact from 5.0.0
 to 7.0.0 (#1112)

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 5.0.0 to 7.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/330a01c490aca151604b8cf639adc76d48f6c5d4...bbbca2ddaa5d8feaa63e36b76fdaad77386f024f)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/ci.yml        | 2 +-
 .github/workflows/scorecard.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 13336155..152d687d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -208,7 +208,7 @@ jobs:
         fi
 
     - name: Upload code coverage
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
       if: steps.list_env.outputs.nyc != ''
       with:
         name: coverage-${{ matrix.node-version }}
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index a1566ba6..e6ba6369 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -60,7 +60,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: SARIF file
           path: results.sarif

From 625c136fe52189ed3cc6e7ad4eb45b1cf11540b1 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 2 Mar 2026 08:43:16 +0100
Subject: [PATCH 265/272] build(deps): bump actions/download-artifact from
 6.0.0 to 8.0.0 (#1113)

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 6.0.0 to 8.0.0.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/018cc2cf5baa6db3ef3c5f8a56943fffe632ef53...70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 8.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 152d687d..9dee4344 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -229,7 +229,7 @@ jobs:
       run: sudo apt-get -y install lcov
 
     - name: Collect coverage reports
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+      uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
       with:
         path: ./coverage
 

From 663359c771f6b13b9b3bd60ee7d56062d98c63bd Mon Sep 17 00:00:00 2001
From: Ignacio Mangas <ignaciomangas@gmail.com>
Date: Mon, 16 Mar 2026 12:23:53 +0100
Subject: [PATCH 266/272] chore: fix node to v25 (#1110)

---
 .github/workflows/ci.yml | 27 ++++++++++++++++++++++++---
 1 file changed, 24 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9dee4344..29b55239 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -37,6 +37,10 @@ jobs:
         - Node.js 19.x
         - Node.js 20.x
         - Node.js 21.x
+        - Node.js 22.x
+        - Node.js 23.x
+        - Node.js 24.x
+        - Node.js 25.x
 
         include:
         - name: Node.js 0.8
@@ -124,10 +128,22 @@ jobs:
           node-version: "19.9"
 
         - name: Node.js 20.x
-          node-version: "20.11"
+          node-version: "20"
 
         - name: Node.js 21.x
-          node-version: "21.6"
+          node-version: "21"
+        
+        - name: Node.js 22.x
+          node-version: "22"
+
+        - name: Node.js 23.x
+          node-version: "23"
+
+        - name: Node.js 24.x
+          node-version: "24"
+
+        - name: Node.js 25.x
+          node-version: "25"
 
     steps:
     - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
@@ -139,7 +155,12 @@ jobs:
         if [[ "${{ matrix.node-version }}" == 0.* && "$(cut -d. -f2 <<< "${{ matrix.node-version }}")" -lt 10 ]]; then
           nvm install --alias=npm 0.10
           nvm use ${{ matrix.node-version }}
-          sed -i '1s;^.*$;'"$(printf '#!%q' "$(nvm which npm)")"';' "$(readlink -f "$(which npm)")"
+          if [[ "$(npm -v)" == 1.1.* ]]; then
+            nvm exec npm npm install -g npm@1.1
+            ln -fs "$(which npm)" "$(dirname "$(nvm which npm)")/npm"
+          else
+            sed -i '1s;^.*$;'"$(printf '#!%q' "$(nvm which npm)")"';' "$(readlink -f "$(which npm)")"
+          fi
           npm config set strict-ssl false
         fi
         dirname "$(nvm which ${{ matrix.node-version }})" >> "$GITHUB_PATH"

From 2c9512fb790e4bf80b3b62305eb8078028607785 Mon Sep 17 00:00:00 2001
From: krzysdz <12915102+krzysdz@users.noreply.github.com>
Date: Sun, 14 Jun 2026 19:11:21 +0000
Subject: [PATCH 267/272] Remove nonexistent projects and update link in readme
 (#1122)

- sequelize has a new website and a slightly broken redirect to the new one
- cyclic has shut down
- dynamodb-store-v3 package does not exist

https://github.com/sequelize/website/issues/839
https://github.com/cyclic-software/www/blob/31e26692f2f04e29917fe011b9bfd7a03fbd7e81/content/posts/cyclic-is-shutting-down.md
https://web.archive.org/web/20240501064115/https://www.cyclic.sh/posts/cyclic-is-shutting-down/
---
 README.md | 14 ++------------
 1 file changed, 2 insertions(+), 12 deletions(-)

diff --git a/README.md b/README.md
index 292b2024..0a7edb04 100644
--- a/README.md
+++ b/README.md
@@ -733,7 +733,7 @@ and other multi-core embedded devices).
 [connect-session-knex-image]: https://badgen.net/github/stars/llambda/connect-session-knex?label=%E2%98%85
 
 [![★][connect-session-sequelize-image] connect-session-sequelize][connect-session-sequelize-url] A session store using
-[Sequelize.js](http://sequelizejs.com/), which is a Node.js / io.js ORM for PostgreSQL, MySQL, SQLite and MSSQL.
+[Sequelize.js](https://sequelize.org/), which is a Node.js / io.js ORM for PostgreSQL, MySQL, SQLite and MSSQL.
 
 [connect-session-sequelize-url]: https://www.npmjs.com/package/connect-session-sequelize
 [connect-session-sequelize-image]: https://badgen.net/github/stars/mweibel/connect-session-sequelize?label=%E2%98%85
@@ -758,11 +758,6 @@ and other multi-core embedded devices).
 [dynamodb-store-url]: https://www.npmjs.com/package/dynamodb-store
 [dynamodb-store-image]: https://badgen.net/github/stars/rafaelrpinto/dynamodb-store?label=%E2%98%85
 
-[![★][dynamodb-store-v3-image] dynamodb-store-v3][dynamodb-store-v3-url] Implementation of a session store using DynamoDB backed by the [AWS SDK for JavaScript v3](https://github.com/aws/aws-sdk-js-v3).
-
-[dynamodb-store-v3-url]: https://www.npmjs.com/package/dynamodb-store-v3
-[dynamodb-store-v3-image]: https://badgen.net/github/stars/FryDay/dynamodb-store-v3?label=%E2%98%85
-
 [![★][express-etcd-image] express-etcd][express-etcd-url] An [etcd](https://github.com/stianeikeland/node-etcd) based session store.
 
 [express-etcd-url]: https://www.npmjs.com/package/express-etcd
@@ -868,7 +863,7 @@ based session store. Supports all backends supported by Fortune (MongoDB, Redis,
 [restsession-url]: https://www.npmjs.com/package/restsession
 [restsession-image]: https://badgen.net/github/stars/jankal/restsession?label=%E2%98%85
 
-[![★][sequelstore-connect-image] sequelstore-connect][sequelstore-connect-url] A session store using [Sequelize.js](http://sequelizejs.com/).
+[![★][sequelstore-connect-image] sequelstore-connect][sequelstore-connect-url] A session store using [Sequelize.js](https://sequelize.org/).
 
 [sequelstore-connect-url]: https://www.npmjs.com/package/sequelstore-connect
 [sequelstore-connect-image]: https://badgen.net/github/stars/MattMcFarland/sequelstore-connect?label=%E2%98%85
@@ -883,11 +878,6 @@ based session store. Supports all backends supported by Fortune (MongoDB, Redis,
 [session-pouchdb-store-url]: https://www.npmjs.com/package/session-pouchdb-store
 [session-pouchdb-store-image]: https://badgen.net/github/stars/solzimer/session-pouchdb-store?label=%E2%98%85
 
-[![★][@cyclic.sh/session-store-image] @cyclic.sh/session-store][@cyclic.sh/session-store-url] A DynamoDB-based session store for [Cyclic.sh](https://www.cyclic.sh/) apps.
-
-[@cyclic.sh/session-store-url]: https://www.npmjs.com/package/@cyclic.sh/session-store
-[@cyclic.sh/session-store-image]: https://badgen.net/github/stars/cyclic-software/session-store?label=%E2%98%85
-
 [![★][@databunker/session-store-image] @databunker/session-store][@databunker/session-store-url] A [Databunker](https://databunker.org/)-based encrypted session store.
 
 [@databunker/session-store-url]: https://www.npmjs.com/package/@databunker/session-store

From e6509b12dea0c2911352725af99874d574c8d66c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= <ulisesgascongonzalez@gmail.com>
Date: Mon, 6 Jul 2026 04:07:01 +0200
Subject: [PATCH 268/272] fix: use RFC 6265 path matching for cookie path
 option (#1114)

* test: add specific RFC 6265 5.1.4 compliance tests

* feat: add specific RFC 6265 5.1.4 handler

* docs: note RFC 6265 5.1.4 compliance in cookie.path documentation

* feat: enhance cookie handling for RFC 6265 compliance with path matching and auto secure/sameSite options

* feat: enforce RFC 6265 section 5.1.4 path matching for session cookie path

---------

Co-authored-by: Sebastian Beltran <bjohansebas@gmail.com>
---
 HISTORY.md      |   6 ++
 README.md       |   7 +++
 index.js        |  48 ++++++++++++++--
 test/session.js | 143 ++++++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 200 insertions(+), 4 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index fae1a0f1..251d5fa7 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,9 @@
+unreleased
+==========
+
+  * Enforce RFC 6265 section 5.1.4 path matching for the session cookie path
+  * Fix `secure: 'auto'` and `sameSite: 'auto'` not being resolved when `cookie` is a function
+
 1.19.0 / 2026-01-22
 ==========
 
diff --git a/README.md b/README.md
index 0a7edb04..162ea14d 100644
--- a/README.md
+++ b/README.md
@@ -126,6 +126,12 @@ More information about can be found in [the proposal](https://github.com/privacy
 Specifies the value for the `Path` `Set-Cookie`. By default, this is set to `'/'`, which
 is the root path of the domain.
 
+Since 1.19.1, path matching follows [RFC 6265 section 5.1.4][rfc-6265-5.1.4]. This means
+the session middleware will only activate when the request path is an exact match or falls
+under a segment boundary of the cookie path. For example, a cookie path of `/admin` will
+match `/admin` and `/admin/users` but will **not** match `/administrator`. Prior versions
+used a simple prefix check that did not enforce segment boundaries.
+
 ##### cookie.priority
 
 Specifies the `string` to be the value for the [`Priority` `Set-Cookie` attribute][rfc-west-cookie-priority-00-4.1].
@@ -1038,6 +1044,7 @@ On Windows, use the corresponding command;
 
 [MIT](LICENSE)
 
+[rfc-6265-5.1.4]: https://datatracker.ietf.org/doc/html/rfc6265#section-5.1.4
 [rfc-6265bis-03-4.1.2.7]: https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-03#section-4.1.2.7
 [rfc-cutler-httpbis-partitioned-cookies]: https://tools.ietf.org/html/draft-cutler-httpbis-partitioned-cookies/
 [rfc-west-cookie-priority-00-4.1]: https://tools.ietf.org/html/draft-west-cookie-priority-00#section-4.1
diff --git a/index.js b/index.js
index 1a509318..41f9447f 100644
--- a/index.js
+++ b/index.js
@@ -158,15 +158,16 @@ function session(options) {
   store.generate = function(req){
     req.sessionID = generateId(req);
     req.session = new Session(req);
-    req.session.cookie = new Cookie(typeof cookieOptions === 'function' ? cookieOptions(req) : cookieOptions);
+    var resolvedCookieOptions = typeof cookieOptions === 'function' ? cookieOptions(req) : cookieOptions;
+    req.session.cookie = new Cookie(resolvedCookieOptions);
 
     var isSecure = issecure(req, trustProxy);
 
-    if (cookieOptions.secure === 'auto') {
+    if (resolvedCookieOptions.secure === 'auto') {
       req.session.cookie.secure = isSecure;
     }
 
-    if (cookieOptions.sameSite === 'auto') {
+    if (resolvedCookieOptions.sameSite === 'auto') {
       req.session.cookie.sameSite = isSecure ? 'none' : 'lax';
     }
   };
@@ -200,12 +201,15 @@ function session(options) {
     // pathname mismatch
     var originalPath = parseUrl.original(req).pathname || '/'
     var resolvedCookieOptions = typeof cookieOptions === 'function' ? cookieOptions(req) : cookieOptions
-    if (originalPath.indexOf(resolvedCookieOptions.path || '/') !== 0) {
+    var cfgPath = resolvedCookieOptions.path || '/'
+
+    if (!rfcPathMatch(originalPath, cfgPath)) {
       debug('pathname mismatch')
       next()
       return
     }
 
+
     // ensure a secret is available or bail
     if (!secret && !req.secret) {
       next(new Error('secret option required for sessions'));
@@ -523,6 +527,42 @@ function session(options) {
   };
 };
 
+/**
+ * Check if the cookiePath matches the requestPath following the
+ * rules in RFC 6265 section 5.1.4.
+ *
+ * @param {String} requestPath
+ * @param {String} cookiePath
+ * @return {Boolean}
+ * @private
+ */
+
+function rfcPathMatch(requestPath, cookiePath) {
+  // Normalize inputs (Node 0.8-safe)
+  requestPath = (typeof requestPath === 'string' && requestPath.length) ? requestPath : '/';
+  cookiePath  = (typeof cookiePath  === 'string' && cookiePath.length)  ? cookiePath  : '/';
+
+  // Root cookie matches everything
+  if (cookiePath === '/') return true;
+
+  // Exact match
+  if (requestPath === cookiePath) return true;
+
+  // Prefix match
+  if (requestPath.indexOf(cookiePath) === 0) {
+    // If cookiePath ends with '/', any longer requestPath is OK
+    if (cookiePath.charAt(cookiePath.length - 1) === '/') return true;
+
+    // Otherwise the next char after the prefix must be '/'
+    var nextChar = requestPath.length > cookiePath.length
+      ? requestPath.charAt(cookiePath.length)
+      : '';
+    return nextChar === '/';
+  }
+
+  return false;
+}
+
 /**
  * Generate a session ID for a new session.
  *
diff --git a/test/session.js b/test/session.js
index 46fed763..330c4137 100644
--- a/test/session.js
+++ b/test/session.js
@@ -853,6 +853,40 @@ describe('session()', function(){
             done();
           });
       });
+
+      it('should not set cookie when request-path does not match returned path', function (done) {
+        var cookieCallback = function () {
+          return { path: '/admin', httpOnly: true, secure: false };
+        };
+        var server = createServer({ cookie: cookieCallback });
+        request(server)
+          .get('/administrator')
+          .expect(shouldNotHaveHeader('Set-Cookie'))
+          .expect(200, done);
+      });
+
+      it('should resolve "secure" and "sameSite" set to "auto"', function (done) {
+        function setup (req) {
+          req.secure = JSON.parse(req.headers['x-secure'])
+        }
+
+        function respond (req, res) {
+          res.end(String(req.secure))
+        }
+
+        var cookieCallback = function () {
+          return { path: '/', secure: 'auto', sameSite: 'auto' };
+        };
+        var server = createServer(setup, { cookie: cookieCallback }, respond);
+        request(server)
+          .get('/')
+          .set('X-Secure', 'true')
+          .expect(shouldSetCookieWithAttribute('connect.sid', 'Secure'))
+          .expect(
+            shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'None')
+          )
+          .expect(200, 'true', done);
+      });
     });
     describe('when "sameSite" set to "auto"', function () {
       describe('basic functionality', function () {
@@ -2620,6 +2654,115 @@ describe('session()', function(){
   })
 })
 
+describe('path matching (RFC 6265)', function () {
+  describe('when "path" is "/" (root path)', function () {
+    before(function () {
+      this.server = createServer({ cookie: { path: '/' } })
+    })
+
+    it('should set cookie when request-path is "/" (root path)', function (done) {
+      // RFC 6265 5.1.4: "The cookie-path and the request-path are identical."
+      request(this.server)
+        .get('/')
+        .expect(shouldSetCookie('connect.sid'))
+        .expect(200, done)
+    })
+
+    it('should set cookie when request-path is any path ("/foo")', function (done) {
+      // RFC 6265 5.1.4: "The cookie-path is a prefix of the request-path, and the last
+      // character of the cookie-path is %x2F ("/")."
+      request(this.server)
+        .get('/foo')
+        .expect(shouldSetCookie('connect.sid'))
+        .expect(200, done)
+    })
+
+    it('should set cookie when request-path has multiple segments ("/foo/bar/baz")', function (done) {
+      // RFC 6265 5.1.4: "The cookie-path is a prefix of the request-path, and the last
+      // character of the cookie-path is %x2F ("/")."
+      request(this.server)
+        .get('/foo/bar/baz')
+        .expect(shouldSetCookie('connect.sid'))
+        .expect(200, done)
+    })
+  })
+
+  describe('when "path" is "/admin"', function () {
+    before(function () {
+      this.server = createServer({ cookie: { path: '/admin' } })
+    })
+
+    it('should set cookie when request-path and cookie-path are identical ("/admin")', function (done) {
+      // RFC 6265 5.1.4: "The cookie-path and the request-path are identical."
+      request(this.server)
+        .get('/admin')
+        .expect(shouldSetCookie('connect.sid'))
+        .expect(200, done)
+    })
+
+    it('should set cookie when cookie-path is prefix and last char is "/" ("/admin/")', function (done) {
+      // RFC 6265 5.1.4: "The cookie-path is a prefix of the request-path, and the last
+      // character of the cookie-path is %x2F ("/")."
+      request(this.server)
+        .get('/admin/')
+        .expect(shouldSetCookie('connect.sid'))
+        .expect(200, done)
+    })
+
+    it('should set cookie when cookie-path is prefix and next char is "/" ("/admin/users")', function (done) {
+      // RFC 6265 5.1.4: "The cookie-path is a prefix of the request-path, and the first
+      // character of the request-path that is not included in the cookie-path is a %x2F ("/") character."
+      request(this.server)
+        .get('/admin/users')
+        .expect(shouldSetCookie('connect.sid'))
+        .expect(200, done)
+    })
+
+    it('should NOT set cookie when cookie-path is not a prefix ("/administrator")', function (done) {
+      // RFC 6265 5.1.4: None of the path-match conditions are met
+      request(this.server)
+        .get('/administrator')
+        .expect(shouldNotHaveHeader('Set-Cookie'))
+        .expect(200, done)
+    })
+  })
+
+  describe('when "path" is "/admin/" (trailing slash)', function () {
+    before(function () {
+      this.server = createServer({ cookie: { path: '/admin/' } })
+    })
+
+    it('should set cookie when cookie-path is prefix and last char is "/" ("/admin/x")', function (done) {
+      // RFC 6265 5.1.4: "The cookie-path is a prefix of the request-path, and the last
+      // character of the cookie-path is %x2F ("/")."
+      request(this.server)
+        .get('/admin/x')
+        .expect(shouldSetCookie('connect.sid'))
+        .expect(200, done)
+    })
+
+    it('should NOT set cookie when request-path is not prefixed by cookie-path ("/admin")', function (done) {
+      // RFC 6265 5.1.4: cookie-path "/admin/" is not a prefix of request-path "/admin"
+      request(this.server)
+        .get('/admin')
+        .expect(shouldNotHaveHeader('Set-Cookie'))
+        .expect(200, done)
+    })
+
+    it('should NOT set cookie when cookie-path is not a prefix ("/administrator")', function (done) {
+      // RFC 6265 5.1.4: None of the path-match conditions are met:
+      // 1. The paths are not identical
+      // 2. "/admin/" is not a prefix of "/administrator"
+      // 3. The prefix condition with next character "/" is not applicable
+      request(this.server)
+        .get('/administrator')
+        .expect(shouldNotHaveHeader('Set-Cookie'))
+        .expect(200, done)
+    })
+  })
+})
+
+
 function cookie(res) {
   var setCookie = res.headers['set-cookie'];
   return (setCookie && setCookie[0]) || undefined;

From 953bfe2ea1878fe79b5494335c0f1c5e332224c2 Mon Sep 17 00:00:00 2001
From: Raashish Aggarwal <94279692+raashish1601@users.noreply.github.com>
Date: Mon, 6 Jul 2026 07:54:05 +0530
Subject: [PATCH 269/272] fix: detect secure socket when connection is missing
 (#1124)

* fix: detect secure socket when connection is missing

* fix: improve secure socket detection logic in session handling

---------

Co-authored-by: Sebastian Beltran <bjohansebas@gmail.com>
---
 index.js        |  3 ++-
 test/session.js | 27 +++++++++++++++++++++++++++
 2 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/index.js b/index.js
index 41f9447f..eb15ea64 100644
--- a/index.js
+++ b/index.js
@@ -677,7 +677,8 @@ function hash(sess) {
 
 function issecure(req, trustProxy) {
   // socket is https server
-  if (req.connection && req.connection.encrypted) {
+  var socket = req.socket || req.connection;
+  if (socket && socket.encrypted) {
     return true;
   }
 
diff --git a/test/session.js b/test/session.js
index 330c4137..abf846f5 100644
--- a/test/session.js
+++ b/test/session.js
@@ -800,6 +800,31 @@ describe('session()', function(){
           .expect(200, 'false', done)
         })
       })
+
+      describe('when request socket is encrypted', function () {
+        it('should set secure over TLS', function (done) {
+          var cert = fs.readFileSync(__dirname + '/fixtures/server.crt', 'ascii')
+          var server = https.createServer({
+            key: fs.readFileSync(__dirname + '/fixtures/server.key', 'ascii'),
+            cert: cert
+          })
+
+          server.on('request', createRequestListener({ secret: 'keyboard cat', cookie: { secure: 'auto' } }))
+
+          var agent = new https.Agent({ ca: cert })
+          var createConnection = agent.createConnection
+
+          agent.createConnection = function (options) {
+            options.servername = 'express-session.local'
+            return createConnection.call(this, options)
+          }
+
+          var req = request(server).get('/')
+          req.agent(agent)
+          req.expect(shouldSetCookieWithAttribute('connect.sid', 'Secure'))
+          req.expect(200, done)
+        })
+      })
     })
 
     describe('when "cookie" is a function', function () {
@@ -888,6 +913,8 @@ describe('session()', function(){
           .expect(200, 'true', done);
       });
     });
+
+
     describe('when "sameSite" set to "auto"', function () {
       describe('basic functionality', function () {
         before(function () {

From 2deb78e42a8dff6c6d8ffcf3f196dfc4ed0f02da Mon Sep 17 00:00:00 2001
From: Ayoub Mabrouk <77799760+Ayoub-Mabrouk@users.noreply.github.com>
Date: Mon, 6 Jul 2026 03:30:48 +0100
Subject: [PATCH 270/272] refactor: replace deprecated substr() with slice()
 (#1099)

Replace all instances of String.prototype.substr() with String.prototype.slice()
to use the standard, non-deprecated method. This maintains compatibility with
Node.js >= 0.8.0 while following modern JavaScript best practices.

All replacements maintain identical functionality as slice() and substr() behave
the same for these use cases.

Co-authored-by: bjohansebas <103585995+bjohansebas@users.noreply.github.com>
---
 index.js        | 6 +++---
 test/session.js | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/index.js b/index.js
index eb15ea64..3e23e901 100644
--- a/index.js
+++ b/index.js
@@ -593,7 +593,7 @@ function getcookie(req, name, secrets) {
     raw = cookies[name];
 
     if (raw) {
-      if (raw.substr(0, 2) === 's:') {
+      if (raw.slice(0, 2) === 's:') {
         val = unsigncookie(raw.slice(2), secrets);
 
         if (val === false) {
@@ -620,7 +620,7 @@ function getcookie(req, name, secrets) {
     raw = req.cookies[name];
 
     if (raw) {
-      if (raw.substr(0, 2) === 's:') {
+      if (raw.slice(0, 2) === 's:') {
         val = unsigncookie(raw.slice(2), secrets);
 
         if (val) {
@@ -696,7 +696,7 @@ function issecure(req, trustProxy) {
   var header = req.headers['x-forwarded-proto'] || '';
   var index = header.indexOf(',');
   var proto = index !== -1
-    ? header.substr(0, index).toLowerCase().trim()
+    ? header.slice(0, index).toLowerCase().trim()
     : header.toLowerCase().trim()
 
   return proto === 'https';
diff --git a/test/session.js b/test/session.js
index abf846f5..405e3ddf 100644
--- a/test/session.js
+++ b/test/session.js
@@ -1299,7 +1299,7 @@ describe('session()', function(){
         var store = new session.MemoryStore()
         var server = createServer({ resave: false, store: store }, function (req, res) {
           if (req.method === 'PUT') {
-            req.session.token = req.url.substr(1)
+            req.session.token = req.url.slice(1)
           }
           res.end('token=' + (req.session.token || ''))
         })

From 2799984fd07d4963fbc128f5f0d9d9f2f48829fe Mon Sep 17 00:00:00 2001
From: Sebastian Beltran <bjohansebas@gmail.com>
Date: Tue, 7 Jul 2026 11:15:48 -0500
Subject: [PATCH 271/272] chore: add groups for GitHub Actions and npm
 dependencies in dependabot (#1133)

---
 .github/dependabot.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 492d67d0..7d2c7033 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,6 +4,10 @@ updates:
     directory: /
     schedule:
       interval: monthly
+    groups:
+      github-actions:
+        patterns:
+          - "*"
 
   - package-ecosystem: npm
     directory: /
@@ -12,3 +16,7 @@ updates:
     ignore:
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]
+    groups:
+      npm-dependencies:
+        patterns:
+          - "*"

From d209c1f4cd645e514cd7320afd15acf7e7b5fcb6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 12:23:53 -0500
Subject: [PATCH 272/272] build(deps): bump the github-actions group with 6
 updates (#1140)

Bumps the github-actions group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `6.0.0` | `7.0.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.0` | `7.0.1` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.0` | `8.0.1` |
| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.32.4` | `4.36.3` |
| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.32.4` | `4.36.3` |
| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.32.4` | `4.36.3` |


Updates `actions/checkout` from 6.0.0 to 7.0.0
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/1af3b93b6815bc44a9784bd300feb67ff0d1eeb3...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0)

Updates `actions/upload-artifact` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a)

Updates `actions/download-artifact` from 8.0.0 to 8.0.1
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c)

Updates `github/codeql-action/init` from 4.32.4 to 4.36.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/89a39a4e59826350b863aa6b6252a07ad50cf83e...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a)

Updates `github/codeql-action/analyze` from 4.32.4 to 4.36.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/89a39a4e59826350b863aa6b6252a07ad50cf83e...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a)

Updates `github/codeql-action/upload-sarif` from 4.32.4 to 4.36.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/89a39a4e59826350b863aa6b6252a07ad50cf83e...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/download-artifact
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action/init
  dependency-version: 4.36.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.36.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.36.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/ci.yml        | 8 ++++----
 .github/workflows/codeql.yml    | 6 +++---
 .github/workflows/scorecard.yml | 6 +++---
 3 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 29b55239..004c35ed 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -146,7 +146,7 @@ jobs:
           node-version: "25"
 
     steps:
-    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
     - name: Install Node.js ${{ matrix.node-version }}
       shell: bash -eo pipefail -l {0}
@@ -229,7 +229,7 @@ jobs:
         fi
 
     - name: Upload code coverage
-      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       if: steps.list_env.outputs.nyc != ''
       with:
         name: coverage-${{ matrix.node-version }}
@@ -243,14 +243,14 @@ jobs:
     needs: test
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
     - name: Install lcov
       shell: bash
       run: sudo apt-get -y install lcov
 
     - name: Collect coverage reports
-      uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         path: ./coverage
 
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index e4fbd605..139ec706 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -34,11 +34,11 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
+        uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
         with:
           languages: javascript
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -61,6 +61,6 @@ jobs:
       #   ./location_of_script_within_repo/buildscript.sh
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
+        uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
         with:
           category: "/language:javascript"
\ No newline at end of file
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index e6ba6369..2bb15b23 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -33,7 +33,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
@@ -60,7 +60,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: SARIF file
           path: results.sarif
@@ -68,6 +68,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
+        uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
         with:
           sarif_file: results.sarif
\ No newline at end of file