cookie@0.5.0 triggers npm audit

[y-nk]

when running pnpm audit on a codebase which has this package installed:

telemetry(main): pnpm why cookie
Legend: production dependency, optional only, dev only

telemetry@2.6.0 /{REDACTED}

dependencies:
elastic-apm-node 3.52.2
└── cookie 0.5.0

telemetry(main): pnpm audit

┌─────────────────────┬────────────────────────────────────────────────────────┐
│ low                 │ cookie accepts cookie name, path, and domain with out  │
│                     │ of bounds characters                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ cookie                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <0.7.0                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=0.7.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ . > elastic-apm-node@3.52.2 > cookie@0.5.0             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-pxg6-pf52-xh8x      │
└─────────────────────┴────────────────────────────────────────────────────────┘

It's a low vulnerability, so priority is low, but that'd be nice if it could be updated.

Thank you for reading

[y-nk]

will close in favor of upgrading to v4