search

docusign / docusign-esign-node-client

The Official DocuSign Node.js Client Library used to interact with the eSign REST API. Send, sign, and approve documents using this client.
http://docusign.github.io/docusign-esign-node-client
MIT License
144 stars 99 forks source link

Please upgrade libraries #307

Open luiscarlosjayk opened 1 year ago

luiscarlosjayk commented 1 year ago

Hi, while installing I'm getting this warnings:

warning docusign-esign > superagent@3.8.2: Please upgrade to v7.0.2+ of superagent.  We have fixed numerous issues with streams, form-data, attach(), filesystem errors not bubbling up (ENOENT on attach()), and all tests are now passing.  See the releases tab for more information at <https://github.com/visionmedia/superagent/releases>.
warning docusign-esign > superagent > formidable@1.2.6: Please upgrade to latest, formidable@v2 or formidable@v3! Check these notes: https://bit.ly/2ZEqIau
[3/5] Fetching packages...
sylvainleb376 commented 1 year ago

Those are not errors but warnings that won't affect your working and installation. Could you please indicate precisely how did you fell on this message in order I could report your finding to the Engineering team?

UpendraNallapareddy commented 1 year ago

@sylvainleb376

When installing first time by this install command npm add docusign-esign

We get the warning about deprecated libraries. This may break anytime when infrastructure is upgraded. 

npm WARN deprecated formidable@1.2.6: Please upgrade to latest, formidable@v2 or formidable@v3! 
npm WARN deprecated superagent@3.8.2: Please upgrade to v7.0.2+ of superagent.

Thanks

Loigor commented 1 year ago

@sylvainleb376

Is it possible to update superagent package? Superagent 3.8.2 has 'high' vulnerability https://github.com/advisories/GHSA-hrpp-h998-j3pp

NicolasEspiau-stilll commented 7 months ago

I second the demand.

Docusign is supposed to be a reliable and secure tool, it cannot be if its SDKs are based on dependencies that have important and high vulnerabilities.