ladjs/supertest

I didnt find supertest latest version updated with latest superagent 8.0.9

suj123j opened this issue · 3 comments

suj123j commented

Hi Team,
Today for superagent the latest version is 8.0.9 with no vulnerabilities.the supertest version with 6.3.3 is not updated with these dependency superagent 8.0.9. Can you help me here ??
supertest

massipasquesi commented

Hello. superagent@8.0.9 has as dep semver@7.5.1, containing a CVE.
The last version of superagent@8.1.2 has fixed this security issue.

Is this possible to upgrade superagent ?

Thanks,
Massi

qeateam commented

Fix would help us as this is being picked up by pipeline scans for us causing issues.
Does overriding the vulnerable version sound like a good idea for the time being ?
https://docs.npmjs.com/cli/v9/configuring-npm/package-json#overrides

Thanks,
Sumanta