Fix dependabot vulnerability

[aeisenberg]

https://github.com/github/vscode-codeql/security/dependabot/73

Not able to be fixed automatically.

[koesie10]

I don't think this actually fixes the vulnerability since both express and @bundled-es-modules/cookie still depend on a different (vulnerable) version of cookie:

• vscode-codeql/extensions/ql-vscode/package-lock.json

  Lines 2231 to 2238 in e303fec

  	"node_modules/@bundled-es-modules/cookie/node_modules/cookie": {
  	"version": "0.5.0",
  	"resolved": "https://registry.npmjs.org/cookie/-/cookie-0.5.0.tgz",
  	"integrity": "sha512-YZ3GUyn/o8gfKJlnlX7g7xq4gyO6OSuhGPKaaGssGB2qgDUS0gPgtTvoyZLTt9Ab6dC4hfc9dV5arkvc/OCmrw==",
  	"engines": {
  	"node": ">= 0.6"
  	}
  	},

• vscode-codeql/extensions/ql-vscode/package-lock.json

  Lines 12432 to 12440 in e303fec

  	"node_modules/express/node_modules/cookie": {
  	"version": "0.6.0",
  	"resolved": "https://registry.npmjs.org/cookie/-/cookie-0.6.0.tgz",
  	"integrity": "sha512-U71cyTamuh1CRNCfpGY6to28lxvNwPG4Guz/EVjgf3Jmzv0vlDp1atT9eS5dDjMYHucpHbWns6Lwf3BKz6svdw==",
  	"dev": true,
  	"engines": {
  	"node": ">= 0.6"
  	}
  	},

I think we will need to wait for upstream to update before this vulnerability can be fixed. This will just include a different (unused) version of cookie, in addition to the vulnerable versions. We are tracking this vulnerability already (see internal linked issue).

[aeisenberg]

Thanks. I'll close this since it's not a path worth going down.