This will create a confusing warning for users that says cookie-signature@1.1.0: wanted: {"node":">=6.6.0"} (current: {"node":"1.8.4","npm":"2.9.0"}) but will also fail to install Express when they have strict engine set.

Do you want me to remove the bump for cookie-signature, @dougwilson ? 🤔

Yea, it will likely need to be held for 5.0

We want to make sure this doesn't cause duplicate depd stances within the install tree. I haven't checked if any of our other sub deps use depd, but you'll want to check that out, and then "bubble up" the dependency updated into this repo so we keep our install tree small.

😅 Yes! You are right. Let's move it for 5.0

├─┬ cookie-session@1.3.3
│ ├─┬ cookies@0.7.3
│ │ ├── depd@1.1.2

├─┬ multiparty@4.2.1
│ ├─┬ fd-slicer@1.1.0
│ │ └── pend@1.2.0
│ ├─┬ http-errors@1.7.3
│ │ ├── depd@1.1.2

├─┬ send@0.17.1
│ ├── depd@1.1.2
│ ├── destroy@1.0.4

I think this is already in #4011

Yes! Seems duplicated. Do you want me to revert it?

We may want to so as I begin landing these once the plan is determined it doesn't delay with merge conflicts.