Security vulnerability reported for event source package

[swasun99]

We use signalR package in our application which internally references eventsource version 1.0.7.
We have the below security vulnerability reported for this version asking us to upgrade to 2.0.2

When fetching an url with a link to an external site (Redirect), the users Cookies & Autorisation headers are leaked to the third party application. According to the same-origin-policy, the header should be "sanitized."

We noticed that even the latest signalR version 6.0.5 still doesnt upgrade the eventsource package version.

Could you please advise how we can go about this?

[blowdart]

Dupe of #41829, #41813, #41729, #41728

Fixing in #41270