Vulnerable hardcoded 'cookie' package version

[sethidden]

You are using a cookie package version vulnerable to GHSA-pxg6-pf52-xh8x

spa-sdk/packages/spa-sdk/package.json

Line 43 in e9da762

"cookie": "0.4.1",

Because you've hardcoded the dep version to 0.4.1 I can't update in my lockfile to get this fixed on my side. I don't understand why did you do it - does spa-sdk work ONLY on 0.4.1 and no other version?

Please release a new version and don't hardcode package versions and use ^0.7.0 instead of 0.7.0