chai-http 4.4.0 reports a security vulnerability
chai-http 4.4.0 reports a security vulnerability related to superagent and formidable dependencies.
Installing report the following deprecation:
`npm warn deprecated superagent@8.1.2: Please upgrade to v9.0.0+ as we have fixed a public vulnerability with formidable dependency. Note that v9.0.0+ requires Node.js v14.18.0+. See https://github.com/ladjs/superagent/pull/1800 for insight. This project is supported and maintained by the team at Forward Email @ https://forwardemail.net`
And npm audit report the following:
`formidable 2.1.0 - 3.5.2
Formidable relies on hexoid to prevent guessing of filenames for untrusted executable content - https://github.com/advisories/GHSA-75v8-2h7p-7m2m
fix available via `npm audit fix --force`
Will install chai-http@5.1.1, which is a breaking change
node_modules/formidable
superagent 8.0.6 - 8.1.2
Depends on vulnerable versions of formidable
node_modules/superagent
chai-http 4.4.0 - 5.0.0-alpha2
Depends on vulnerable versions of superagent
node_modules/chai-http`
The issue is fixed in chai-http 5.x but the package is ESM only so not all projects are able to upgrade easily.
Is there any plan to address security audits in v4?
Thank you so much.
关闭于 2025-05-02 7 条评论