ITADN

chai-http 4.4.0 reports a security vulnerability

#366Closedfrancescorivola 创建于 2025-04-30
F
francescorivolacommented
chai-http 4.4.0 reports a security vulnerability related to superagent and formidable dependencies. Installing report the following deprecation: `npm warn deprecated superagent@8.1.2: Please upgrade to v9.0.0+ as we have fixed a public vulnerability with formidable dependency. Note that v9.0.0+ requires Node.js v14.18.0+. See https://github.com/ladjs/superagent/pull/1800 for insight. This project is supported and maintained by the team at Forward Email @ https://forwardemail.net` And npm audit report the following: `formidable 2.1.0 - 3.5.2 Formidable relies on hexoid to prevent guessing of filenames for untrusted executable content - https://github.com/advisories/GHSA-75v8-2h7p-7m2m fix available via `npm audit fix --force` Will install chai-http@5.1.1, which is a breaking change node_modules/formidable superagent 8.0.6 - 8.1.2 Depends on vulnerable versions of formidable node_modules/superagent chai-http 4.4.0 - 5.0.0-alpha2 Depends on vulnerable versions of superagent node_modules/chai-http` The issue is fixed in chai-http 5.x but the package is ESM only so not all projects are able to upgrade easily. Is there any plan to address security audits in v4? Thank you so much.
关闭于 2025-05-02 7 条评论