Update dependencies // superagent

[leeleahulkcs]

This package depends on superagent 7.1.6. This is giving a deprecation warning.

npm WARN deprecated superagent@7.1.6: Please downgrade to v7.1.5 if you need IE/ActiveXObject support OR upgrade to v8.0.0 as we no longer support IE and published an incorrect patch version (see forwardemail/superagent#1731)

[AntonOellerer]

Now even more relevant as superagent@7.1.6 depends on qs@6.9.3 which is vulnerable to CVE-2022-24999, which has a CVSSv3 Base Score of HIGH (7.5)

[balintfodor-seon]

Moreover, superagent@7.1.6 depends on cookiejar@2.1.3 which is vulnerable to CVE-2022-25901.

[Rhaal]

Please note that superagent@7.1.6 depends on formidable@^2.0.1, which is vulnerable to CVE-2022-29622 - which has a CVSSv3 of 9.8 (CRITICAL).

@whitlockjc, if you are not going to maintain the library could you consider naming external maintainers?

[thiagosanches]

Hey everyone, this is not mine... But I just wanted to share a workaround some friends came up with while we're waiting for an official fix. I'm not aware of any potential side effects, but it might be worth giving it a try to see how it goes.

You can modify your own package.json to override the version of superagent:

"overrides": {
    "path-loader": {
       "superagent": "9.0.0"
    }
}

npm ls superagent
my-project
└─┬ serverless@3.38.0
  └─┬ json-refs@3.0.15
    └─┬ path-loader@1.0.12 overridden
      └── superagent@9.0.0 overridden

[melroyvandenberg]

Please update to v9 or v10: https://github.com/ladjs/superagent/releases