[Security] Bump superagent from 3.6.0 to 3.7.0

[dependabot-preview]

Bumps superagent from 3.6.0 to 3.7.0. This update includes security fixes.

Vulnerabilities fixed

Sourced from The GitHub Security Advisory Database.

Low severity vulnerability that affects superagent
The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes several magnitudes larger once uncompressed. If a client does not take special care when processing such responses, it may result in excessive CPU and/or memory consumption. An attacker might exploit such a weakness for a DoS attack. To exploit this the attacker must control the location (URL) that superagent makes a request to.

Affected versions: < 3.7.0

Sourced from The GitHub Security Advisory Database.

Low severity vulnerability that affects superagent
The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes several magnitudes larger once uncompressed. If a client does not take special care when processing such responses, it may result in excessive CPU and/or memory consumption. An attacker might exploit such a weakness for a DoS attack. To exploit this the attacker must control the location (URL) that superagent makes a request to.

Affected versions: <3.7.0

Release notes

Sourced from superagent's releases.

v3.7.0

• Limit maximum response size. Prevents zip bombs (Kornel)
• Catch and pass along errors in .ok() callback (Jeremy Ruppel)
• Fixed parsing of XHR headers without a newline (nsf)

v3.6.2

• Upgrade MIME type dependency to a newer, secure version
• Recognize PDF MIME as binary
• Fix for error in subsequent require() calls (Steven de Salas)

Changelog

Sourced from superagent's changelog.

3.7.0 (2017-10-17)

• Limit maximum response size. Prevents zip bombs (Kornel)
• Catch and pass along errors in .ok() callback (Jeremy Ruppel)
• Fixed parsing of XHR headers without a newline (nsf)

3.6.2 (2017-10-02)

• Upgrade MIME type dependency to a newer, secure version
• Recognize PDF MIME as binary
• Fix for error in subsequent require() calls (Steven de Salas)

Commits

• ebb25ce 3.7.0
• 946e28d Limit maximum response size
• 81f0512 Don't pop last array element when parsing a header.
• 4722207 Add standard props to errors thrown by .ok() callback
• cf63db0 Use node with faster npm for browser tests
• 6097e83 Bump Appium version
• 092e3d6 Catch and pass along errors in ok callback
• b4facde Revert to Mime 1.x
• 3d430aa Changelog
• 0fafc1c Bump
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot ignore this [patch|minor|major] version will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

Finally, you can contact us by mentioning @dependabot.

[dependabot-preview]

Superseded by #21.