Skip to content

build(deps-dev): bump supertest from 6.3.0 to 7.3.0 - #7494

Open
noritaka1166 wants to merge 1 commit into
expressjs:masterfrom
noritaka1166:bump-supertest-7.3.0
Open

noritaka1166 wants to merge 1 commit into
expressjs:masterfrom
noritaka1166:bump-supertest-7.3.0

Conversation

@noritaka1166

Copy link
Copy Markdown
Contributor

Summary

  • Upgrade the deprecated SuperTest 6.x dev dependency from ^6.3.0 to ^7.3.0.
  • Add a small shared test helper to send paths containing .. or %2e%2e unchanged. SuperAgent otherwise normalizes these paths before Express receives them.
  • Keep the existing path traversal assertions and leave production code unchanged.

Related PR

This is an alternative to #6856. Both PRs address URL normalization in the newer SuperAgent version used by SuperTest 7. This approach keeps the affected tests short by sharing the path handling in test/support/utils.js.

The helper uses SuperAgent's request event to access the underlying Node request and set its path.

Testing

  • npm run lint — passed
  • npm run test-ci — 1,261 tests passed in a local run

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatednpm/​supertest@​6.3.4 ⏵ 7.3.099100100 +187 +37100

View full report

@krzysdz krzysdz added tests deps dependencies Pull requests that update a dependency file labels Sep 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file deps tests

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants