diff --git a/History.md b/History.md
index 6ef8b18a..2a563fba 100644
--- a/History.md
+++ b/History.md
@@ -9,6 +9,7 @@ unreleased
   * deps: send@1.0.0
 * change:
   - `res.clearCookie` will ignore user provided `maxAge` and `expires` options
+* deps: cookie-signature@^1.2.1
 * deps: debug@4.3.6
 * deps: merge-descriptors@^2.0.0
 * deps: serve-static@^2.0.0
diff --git a/package.json b/package.json
index 5ab13243..e60aadca 100644
--- a/package.json
+++ b/package.json
@@ -33,7 +33,7 @@
     "content-disposition": "0.5.4",
     "content-type": "~1.0.4",
     "cookie": "0.6.0",
-    "cookie-signature": "1.0.6",
+    "cookie-signature": "^1.2.1",
     "debug": "4.3.6",
     "depd": "2.0.0",
     "encodeurl": "~1.0.2",