Critical vulnerability of peer dependency formidable

[FabianReitz]

Type of issue: (check with "[x]")

• New feature request
• Bug
• Support request
• Documentation

Current behaviour:

The @alfresco/js-api@7.7.0 uses a vulnerable version of superagent which exposes a critical vulnerability through a peer dependency:

Currently used version of superagent:

alfresco-ng2-components/package.json

Line 90 in 1173253

"superagent": "^8.1.2",

More information:

• Formidable <3.2.4 Arbitrary File Upload Critical Severity ladjs/superagent#1799

Expected behavior:

Use the patched version of superagent as soon as it is available

Steps to reproduce the issue:

1. Clone this the alfresco-ng2-components repository
2. Run npm install
3. Run npm audit
4. Run npm ls formidable

Component name and version:

package.json

Browser and version:

all

Node version (for build issues):

all

New feature request:

[FabianReitz]

The new major version of superagent is now available:

• Update formidable ladjs/superagent#1800
• https://www.npmjs.com/package/superagent/v/9.0.1