Update dependency superagent to v3

[dev-mend-for-github-com]

This PR contains the following updates:

Package	Type	Update	Change
superagent	dependencies	major	~1.2.0 → ~3.7.0

By merging this PR, the below vulnerabilities will be automatically resolved:

Severity	CVSS Score	Vulnerability
Critical	9.4	CVE-2025-7783
Critical	9.3	CVE-2018-16492
High	8.7	CVE-2017-16138
High	8.2	CVE-2017-16129
Medium	6.3	CVE-2026-2391
Medium	5.5	CVE-2022-25901

---

Release Notes

ladjs/superagent (superagent)

v3.7.0

Compare Source

• Limit maximum response size. Prevents zip bombs (Kornel)
• Catch and pass along errors in .ok() callback (Jeremy Ruppel)
• Fixed parsing of XHR headers without a newline (nsf)

v3.6.3

Compare Source

v3.6.2

Compare Source

• Upgrade MIME type dependency to a newer, secure version
• Recognize PDF MIME as binary
• Fix for error in subsequent require() calls (Steven de Salas)

v3.6.1

Compare Source

v3.6.0

Compare Source

• Support disabling TCP_NODELAY option (#​1240) (xiamengyu)
• Send payload in query string for GET and HEAD shorthand API (Peter Lyons)
• Support passphrase with pfx certificate (Paul Westerdale (ABRS Limited))
• Documentation improvements (Peter Lyons)
• Fixed duplicated query string params (#​1200) (Kornel)

v3.5.2

Compare Source

v3.5.1

Compare Source

• Allow crossDomain errors to be retried (#​1194) (Michael Olson)
• Read responseType property from the correct object (Julien Dupouy)
• Check for ownProperty before adding header (Lucas Vieira)

v3.5.0

Compare Source

• Add errno to distinguish between request timeout and body download timeout (#​1184) (Kornel Lesiński)
• Warn about bogus timeout options (#​1185) (Kornel Lesiński)

v3.4.4

Compare Source

• Treat videos like images (Kornel Lesiński)
• Avoid renaming module (Kornel Lesiński)

v3.4.3

Compare Source

• Fixed being able to define own parsers when their mime type starts with text/ (Damien Clark)
• withCredentials(false) (Andy Woods)
• Use formData.on instead of .once (Kornel Lesiński)
• Ignore attach("file",null) (Kornel Lesiński)

v3.4.2

Compare Source

v3.4.1

Compare Source

• Allow retry() and retry(0) (Alexander Pope)
• Allow optional body/data in DELETE requests (Alpha Shuro)
• Fixed query string on retried requests (Kornel Lesiński)

v3.4.0

Compare Source

• New .retry(n) method and err.retries (Alexander Pope)
• Docs for HTTPS request (Jun Wan Goh)

v3.3.2

Compare Source

v3.3.1

Compare Source

• Fixed "double callback bug" warning on timeouts of gzipped responses

v3.3.0

Compare Source

• Added .ok(callback) that allows customizing which responses are errors (Kornel Lesiński)
• Added .responseType() to Node version (Kornel Lesiński)
• Added .parse() to browser version (jakepearson)
• Fixed parse error when using responseType('blob') (Kornel Lesiński)

v3.2.1

Compare Source

v3.2.0

Compare Source

• Added .timeout({response:ms}), which allows limiting maximum response time independently from total download time (Kornel Lesiński)
• Added warnings when .end() is called more than once (Kornel Lesiński)
• Added response.links to browser version (Lukas Eipert)
• btoa is no longer required in IE9 (Kornel Lesiński)
• Fixed .sortQuery() on URLs without query strings (Kornel Lesiński)
• Refactored common response code into ResponseBase (Lukas Eipert)

v3.1.0

Compare Source

• Added .sortQuery() (vicanso)
• Added support for arrays and bools in .field() (Kornel Lesiński)
• Made superagent.Request subclassable without need to patch all static methods (Kornel Lesiński)

v3.0.0

Compare Source

• Dropped support for Node 0.x. Please upgrade to at least Node 4.
• Dropped support for componentjs (Damien Caselli)
• Removed deprecated .part()/superagent.Part APIs.
• Removed unreliable .body property on internal response object used by unbuffered parsers.
  Note: the normal response.body is unaffected.
• Multiple .send() calls mixing Buffer/Blob and JSON data are not possible and will now throw instead of messing up the data.
• Improved .send() data object type check (Fernando Mendes)
• Added common prototype for Node and browser versions (Andreas Helmberger)
• Added http+unix: schema to support Unix sockets (Yuki KAN)
• Added full attach options parameter in the Node version (Lapo Luchini)
• Added pfx TLS option with new pfx() method. (Reid Burke)
• Internally changed .on to .once to prevent possible memory leaks (Matt Blair)
• Made all errors reported as an event (Kornel Lesiński)

v2.3.0

Compare Source

• Enabled .field() to handle objects (Affan Shahid)
• Added authentication with client certificates (terusus)
• Added .catch() for more Promise-like interface (Maxim Samoilov, Kornel Lesiński)
• Silenced errors from incomplete gzip streams for compatibility with web browsers (Kornel Lesiński)
• Fixed event.direction in uploads (Kornel Lesiński)
• Fixed returned value of overwritten response object's on() method (Juan Dopazo)

v2.2.0

Compare Source

• Added timedout property to node Request instance (Alexander Pope)
• Unified null querystring values in node and browser environments. (George Chung)

v2.1.0

Compare Source

• Refactored async parsers. Now the end callback waits for async parsers to finish (Kornel Lesiński)
• Errors thrown in .end() callback don't cause the callback to be called twice (Kornel Lesiński)
• Added headers to toJSON() (Tao)

v2.0.0

Compare Source

Breaking changes

Breaking changes are in rarely used functionality, so we hope upgrade will be smooth for most users.

• Browser: The .parse() method has been renamed to .serialize() for consistency with NodeJS version.
• Browser: Query string keys without a value used to be parsed as 'undefined', now their value is '' (empty string) (shura, Kornel Lesiński).
• NodeJS: The redirect event is called after new query string and headers have been set and is allowed to override the request URL (Kornel Lesiński)
• .then() returns a real Promise. Note that use of superagent with promises now requires a global Promise object.
  If you target Internet Explorer or Node 0.10, you'll need require('es6-promise').polyfill() or similar.
• Upgraded all dependencies (Peter Lyons)
• Renamed properties documented as @api private to have _prefixed names (Kornel Lesiński)

Probably not breaking changes:

• Extracted common functions to request-base (Peter Lyons)
• Fixed race condition in pipe tests (Peter Lyons)
• Handle FormData error events (scriptype)
• Fixed wrong jsdoc of Request#attach (George Chung)
• Updated and improved tests (Peter Lyons)
• request.head() supports .redirects(5) call (Kornel Lesiński)
• response event is also emitted when using .pipe()

v1.8.5

Compare Source

v1.8.4

Compare Source

v1.8.3

Compare Source

v1.8.2

Compare Source

• Fixed handling of HTTP status 204 with content-encoding: gzip (Andrew Shelton)
• Handling of FormData error events (scriptype)
• Fixed parsing of vnd+json MIME types (Kornel Lesiński)
• Aliased browser implementation of .parse() as .serialize() for forward compatibility

v1.8.1

Compare Source

• Fixed form-data incompatibility with IE9

v1.8.0

Compare Source

• Extracted common code into request-base class (Peter Lyons)
  • It does not affect the public API, but please let us know if you notice any plugins/subclasses breaking!
• Added option {type:'auto'} to auth method, which enables browser-native auth types (Jungle, Askar Yusupov)
• Added responseType() to set XHR responseType (chris)
• Switched to form-data for browserify-compatible FormData (Peter Lyons)
• Added statusCode to error response when JSON response is malformed (mattdell)
• Prevented TCP port conflicts in all tests (Peter Lyons)
• Updated form-data dependency

v1.7.2

Compare Source

• Fix case-sensitivity of header fields introduced by a4ddd6a. (Edward J. Jinotti)
• bump extend dependency, as former version did not contain any license information (Lukas Eipert)

v1.7.1

Compare Source

• Fixed a conflict with express when using npm 3.x (Glenn)
• Fixed redirects after a multipart/form-data POST request (cyclist2)

v1.7.0

Compare Source

• When attaching files, read default filename from the File object (JD Isaacks)
• Add direction property to progress events (Joseph Dykstra)
• Update component-emitter & formidable (Kornel Lesiński)
• Don't re-encode query string needlessly (Ruben Verborgh)
• ensure querystring is appended when doing stream.pipe(request) (Keith Grennan)
• change set header function, not call this.request() until call this.end() (vicanso)
• Add no-op withCredentials to Node API (markdalgleish)
• fix delete breaking on ie8 (kenjiokabe)
• Don't let request error override responses (Clay Reimann)
• Increased number of tests shared between node and client (Kornel Lesiński)

v1.6.1

Compare Source

• avoid misleading CORS error message
• added 'progress' event on file/form upload in Node (Olivier Lalonde)
• return raw response if the response parsing fails (Rei Colina)
• parse content-types ending with +json as JSON (Eiryyy)
• fix to avoid throwing errors on aborted requests (gjurgens)
• retain cookies on redirect when hosts match (Tom Conroy)
• added Bower manifest (Johnny Freeman)
• upgrade to latest cookiejar (Andy Burke)

v1.6.0

Compare Source

• avoid misleading CORS error message
• added 'progress' event on file/form upload in Node (Olivier Lalonde)
• return raw response if the response parsing fails (Rei Colina)
• parse content-types ending with +json as JSON (Eiryyy)
• fix to avoid throwing errors on aborted requests (gjurgens)
• retain cookies on redirect when hosts match (Tom Conroy)
• added Bower manifest (Johnny Freeman)
• upgrade to latest cookiejar (Andy Burke)

v1.5.0

Compare Source

• encode array values as key=1&key=2&key=3 etc... (aalpern, Davis Kim)
• avoid the error which is omitted from 'socket hang up'
• faster JSON parsing, handling of zlib errors (jbellenger)
• fix IE11 sends 'undefined' string if data was undefined (Vadim Goncharov)
• alias del() method as delete() (Aaron Krause)
• revert Request#parse since it was actually Response#parse

v1.4.0

Compare Source

• add Request#parse method to client library
• add missing statusCode in client response
• don't apply JSON heuristics if a valid parser is found
• fix detection of root object for webworkers

v1.3.0

Compare Source

• fix incorrect content-length of data set to buffer
• serialize request data takes into account charsets
• add basic promise support via a then function

---

• If you want to rebase/retry this PR, check this box