[Security] Bump superagent from 3.5.2 to 3.7.0

[dependabot-preview]

Bumps superagent from 3.5.2 to 3.7.0. This update includes security fixes.

Vulnerabilities fixed

Sourced from The GitHub Security Advisory Database.

Low severity vulnerability that affects superagent
The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes several magnitudes larger once uncompressed. If a client does not take special care when processing such responses, it may result in excessive CPU and/or memory consumption. An attacker might exploit such a weakness for a DoS attack. To exploit this the attacker must control the location (URL) that superagent makes a request to.

Affected versions: < 3.7.0

Sourced from The GitHub Security Advisory Database.

Low severity vulnerability that affects superagent
The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes several magnitudes larger once uncompressed. If a client does not take special care when processing such responses, it may result in excessive CPU and/or memory consumption. An attacker might exploit such a weakness for a DoS attack. To exploit this the attacker must control the location (URL) that superagent makes a request to.

Affected versions: <3.7.0

Release notes

Sourced from superagent's releases.

v3.7.0

• Limit maximum response size. Prevents zip bombs (Kornel)
• Catch and pass along errors in .ok() callback (Jeremy Ruppel)
• Fixed parsing of XHR headers without a newline (nsf)

v3.6.2

• Upgrade MIME type dependency to a newer, secure version
• Recognize PDF MIME as binary
• Fix for error in subsequent require() calls (Steven de Salas)

v3.6.0

• Support disabling TCP_NODELAY option (#1240) (xiamengyu)
• Send payload in query string for GET and HEAD shorthand API (Peter Lyons)
• Support passphrase with pfx certificate (Paul Westerdale (ABRS Limited))
• Documentation improvements (Peter Lyons)
• Fixed duplicated query string params (#1200) (Kornel)

Changelog

Sourced from superagent's changelog.

3.7.0 (2017-10-17)

• Limit maximum response size. Prevents zip bombs (Kornel)
• Catch and pass along errors in .ok() callback (Jeremy Ruppel)
• Fixed parsing of XHR headers without a newline (nsf)

3.6.2 (2017-10-02)

• Upgrade MIME type dependency to a newer, secure version
• Recognize PDF MIME as binary
• Fix for error in subsequent require() calls (Steven de Salas)

3.6.0 (2017-08-20)

• Support disabling TCP_NODELAY option (#1240) (xiamengyu)
• Send payload in query string for GET and HEAD shorthand API (Peter Lyons)
• Support passphrase with pfx certificate (Paul Westerdale (ABRS Limited))
• Documentation improvements (Peter Lyons)
• Fixed duplicated query string params (#1200) (Kornel)

3.5.1 (2017-03-18)

• Allow crossDomain errors to be retried (#1194) (Michael Olson)
• Read responseType property from the correct object (Julien Dupouy)
• Check for ownProperty before adding header (Lucas Vieira)

3.5.0 (2017-02-23)

• Add errno to distinguish between request timeout and body download timeout (#1184) (Kornel Lesiński)
• Warn about bogus timeout options (#1185) (Kornel Lesiński)

3.4.4 (2017-02-17)

• Treat videos like images (Kornel Lesiński)
• Avoid renaming module (Kornel Lesiński)

3.4.3 (2017-02-14)

• Fixed being able to define own parsers when their mime type starts with text/ (Damien Clark)
• withCredentials(false) (Andy Woods)
• Use formData.on instead of .once (Kornel Lesiński)
• Ignore attach("file",null) (Kornel Lesiński)

3.4.1 (2017-01-29)

• Allow retry() and retry(0) (Alexander Pope)
• Allow optional body/data in DELETE requests (Alpha Shuro)
• Fixed query string on retried requests (Kornel Lesiński)

3.4.0 (2017-01-25)

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot ignore this [patch|minor|major] version will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

Finally, you can contact us by mentioning @dependabot.