Bump formidable and superagent

[dependabot]

Bumps formidable to 3.5.4 and updates ancestor dependency superagent. These dependencies need to be updated together.

Updates formidable from 2.1.2 to 3.5.4

Release notes

Sourced from formidable's releases.

v3.5.4

What's Changed

• switch to pnpm, minimize deps & devDeps, fix deps through pnpm audit
• remove os.machine, fix #994 in #995

Full Changelog: node-formidable/formidable@v3.5.3...v3.5.4

v3.5.3

What's Changed

• Fix existing test failure by @​ryhmrt in node-formidable/formidable#990

• update Ryan Dahl x account link by @​moetezch in node-formidable/formidable#989

• update failing tests

• update CI/CD workflows and actions;

• update CodeQL github action for security analysis

• update readme, links and badges

• update to use cuid2 (battle-tested @paralleldrive/cuid2 package) for better random names - should not be breaking anything since it's still 25 characters long, but a lot safer and faster.

New Contributors

• @​ryhmrt made their first contribution in node-formidable/formidable#990
• @​moetezch made their first contribution in node-formidable/formidable#989

Full Changelog: node-formidable/formidable@v3.5.2...v3.5.3

v3.5.2

No release notes provided.

v3.2.5

No release notes provided.

3.2.4

No release notes provided.

3.1.4

https://github.com/node-formidable/formidable/blob/master/CHANGELOG.md

Changelog

Sourced from formidable's changelog.

3.5.4

• fix the os.machine breaking some dependents, fix #994
• add Node 16, 18, 20, 22 to CI/CD

3.5.3

• security report by ZAST.AI help for some vulnerabilities addressing (primarily the random names generation)
• update failing tests
• update CI/CD workflows and actions;
• update CodeQL github action for security analysis
• update readme, links and badges
• update to use cuid2 (battle-tested @paralleldrive/cuid2 package) for better random names - should not be breaking anything since it's still 25 characters long, but a lot safer and faster.

3.5.2

• fix: (#982) make it easier to import hexoid with webpack

3.5.1

• fix: (#945) multipart parser fix: flush or fail always (don't hang)

3.5.0

• feature: (#944) Dual package: Can be imported as ES module and required as commonjs module

3.4.0

• feature: (#940) form.parse returns a promise if no callback is provided
• it resolves with an array [fields, files]

3.3.2

• feature: (#855) add options.createDirsFromUploads, see README for usage
• form.parse is an async function (ignore the promise)
• benchmarks: add e2e becnhmark with as many request as possible per second
  • npm run to display all the commands
• mark as latest on npm

3.2.5

• fix: (#881) fail earlier when maxFiles is exceeded

3.2.4

• fix: (#857) improve keep extension
• The code from before 3.2.4 already removed some characters from the file extension. But not always. So it was inconsistent.

... (truncated)

Commits

• See full diff in compare view

Updates superagent from 8.1.2 to 10.3.0

Release notes

Sourced from superagent's releases.

v10.3.0

• fix: fixed package lock 5db8232
• fix: fixed package lock b80038d
• fix: add back zuul, fix mocha, xo, rimraf versions 829893c
• fix: fixed deps 426c2bf
• fix: fixed deps a55a6d6
• fix: added back node v18 to tests c93aa19
• chore: fix deps 5cd3751
• Merge pull request #1842 from hlovdal/dep_updates 68308c8
• Merge pull request #1839 from codders/feat/add-proxy-for-client-agent a488d25
• chore: remove end-of-life nodejs versions and add active lts 170ef07
• chore(deps): update eslint-plugin-compat package 3ce73dd
• chore(deps): update tinify package a9a48a3
• chore(deps): update xo package 5677b73
• chore(deps): update rimraf package 7cda38c
• chore(deps): update mocha package 608b4ef
• chore(deps): update qs package 81719c9
• chore(deps): remove zuul 7d8618b
• chore(deps): update body-parser package e07aaaa
• chore(deps): npm audit fix b4b2275
• Merge pull request #1837 from inseong01/translate-docs-ko cec2606
• feat(client): add proxy object for request.agent for compatibility 44e68b1
• docs: translate documents to ko_KR 624ab8c

---

forwardemail/superagent@v10.2.3...v10.3.0

v10.2.3

• chore: bump deps 9a2d236

---

forwardemail/superagent@v10.2.2...v10.2.3

v10.2.2

• fix: fixed ci 5c2b13d
• fix: fixed README badge 28167d1
• fix: drop node v14 from ci 2ed5ac6
• Revert "fix: fixed ci" 583939f
• Revert "fix: remove husky folder" 17e059b
• fix: remove husky folder 1633f64
• fix: fixed ci 6409480
• fix: added package lock 57d6b35
• feat: fix formidable v3 compatibility with PassThrough bridge for multipart parsing c40db6d
• fix: fixed package version fe58239

---

forwardemail/superagent@list...v10.2.2

... (truncated)

Commits

• 3ef3676 10.3.0
• 5db8232 fix: fixed package lock
• b80038d fix: fixed package lock
• 829893c fix: add back zuul, fix mocha, xo, rimraf versions
• 426c2bf fix: fixed deps
• a55a6d6 fix: fixed deps
• c93aa19 fix: added back node v18 to tests
• 5cd3751 chore: fix deps
• 68308c8 Merge pull request #1842 from hlovdal/dep_updates
• a488d25 Merge pull request #1839 from codders/feat/add-proxy-for-client-agent
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by titanism, a new releaser for superagent since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

[swember]

@dependabot recreate

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​superagent@​8.1.2 ⏵ 10.3.0	+1			+37

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @noble/hashes is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/superagent@10.3.0 → npm/@noble/hashes@1.8.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@noble/hashes@1.8.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @noble/hashes is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/superagent@10.3.0 → npm/@noble/hashes@1.8.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@noble/hashes@1.8.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report