Update shrinkwrapped express to v4.21.1

[oskarwilliams]

Change-type: patch

Update shrinkwrapped express to v4.21.1 to bump cookie version to 0.7.1 to resolve low vulnerability

Resolves: #2888
Change-type: patch

---

Please check the CONTRIBUTING.md file for relevant information and some
guidance. Keep in mind that the CLI is a cross-platform application that runs
on Windows, macOS and Linux. Tests will be automatically run by balena CI on
all three operating systems, but this will only help if you have added test
code that exercises the modified or added feature code.

Note that each commit message (currently only the first line) will be
automatically copied to the CHANGELOG.md file, so try writing it in a way
that describes the feature or fix for CLI users.

If there isn't a linked issue or if the linked issue doesn't quite match the
PR, please add a PR description to explain its purpose or the features that it
implements. Adding PR comments to blocks of code that aren't self explanatory
usually helps with the review process.

If the PR introduces security considerations or affects the development, build
or release process, please be sure to highlight this in the PR description.

Thank you very much for your contribution!

[github-actions]

A repository maintainer needs to approve this workflow run.

https://github.com/balena-io/balena-cli/actions/runs/11776647253

Maintainers, please review all commits and react with 👍 to approve or 👎 to reject.

Things to look for: GitHub Actions Security Cheat Sheet

[flowzone-app]

A repository maintainer needs to approve this workflow run.

https://github.com/balena-io/balena-cli/actions/runs/12049976304

Maintainers, please review all commits and react with 👍 to approve or 👎 to reject.

Things to look for: GitHub Actions Security Cheat Sheet

[oskarwilliams]

@alexgg Could I possibly get a quick eye on this? :)

[alexgg]

hey @oskarwilliams pinging some of the CLI maintainers for review @thgreasi @myarmolinsky

[flowzone-app]

A repository maintainer needs to approve this workflow run.

https://github.com/balena-io/balena-cli/actions/runs/12049976304

Maintainers, please review all commits and react with 👍 to approve or 👎 to reject.

Things to look for: GitHub Actions Security Cheat Sheet

[myarmolinsky]

Hi, thank you for the PR, and sorry for missing it!

The first commit makes sense to me, could you please drop that second commit and rebase instead of having a merge commit and push again? Please also run npm dedupe and add a commit for that change if there is any (as CI will fail if there is a change from the dedupe that has not been added to the PR)

[flowzone-app]

A repository maintainer needs to approve this workflow run.

https://github.com/balena-io/balena-cli/actions/runs/12165047589

Maintainers, please review all commits and react with 👍 to approve or 👎 to reject.

Things to look for: GitHub Actions Security Cheat Sheet

[oskarwilliams]

Thank you very much @alexgg, @myarmolinsky I have hopefully done as asked! :)

[flowzone-app]

A repository maintainer needs to approve this workflow run.

https://github.com/balena-io/balena-cli/actions/runs/12165047589

Maintainers, please review all commits and react with 👍 to approve or 👎 to reject.

Things to look for: GitHub Actions Security Cheat Sheet

[oskarwilliams]

I think some automatic test failed due to GitHub runner automated issues, can we retrigger the failed jobs?

[myarmolinsky]

I think some automatic test failed due to GitHub runner automated issues, can we retrigger the failed jobs?

The failed Test custom is a flake, haven't seen the cancelled tests issue before, checking with our CI maintainers. We may need to update our macos version in the flowzone.yml (if we do so, it will be in a separate PR). I'll share and re-trigger tests when we know more

[myarmolinsky]

Once this PR merges: #2893
We will request that you please rebase again (the dedupe commit could presumably be dropped since its changes will be included in that PR, unless another change to a package is made in the interim) and we will re-run the workflows

[myarmolinsky]

Please go ahead and rebase again when you have a chance. As noted, I expect you should be able to drop the npm dedupe commit (but please run npm dedupe again just to make sure. If there are still changes, please commit them). I will re-run workflows once the PR is rebased

[oskarwilliams]

Thanks @myarmolinsky, I have rebased and rerun dedupe

[flowzone-app]

A repository maintainer needs to approve this workflow run.

https://github.com/balena-io/balena-cli/actions/runs/12177427637

Maintainers, please review all commits and react with 👍 to approve or 👎 to reject.

Things to look for: GitHub Actions Security Cheat Sheet

[myarmolinsky]

Thank you for your contribution! Apologies for the rocky road along the way, but we appreciate your perseverance!