@depup/supertest 7.2.2-depup.0 → 7.3.0-depup.0

package/README.md

@@ -1,471 +1,31 @@
-# [supertest](https://forwardemail.github.io/superagent/)
+# @depup/supertest
 
-[![build status](https://github.com/forwardemail/supertest/actions/workflows/ci.yml/badge.svg)](https://github.com/forwardemail/supertest/actions/workflows/ci.yml)
-[![code coverage](https://img.shields.io/codecov/c/github/ladjs/supertest.svg)](https://codecov.io/gh/ladjs/supertest)
-[![code style](https://img.shields.io/badge/code_style-XO-5ed9c7.svg)](https://github.com/sindresorhus/xo)
-[![styled with prettier](https://img.shields.io/badge/styled_with-prettier-ff69b4.svg)](https://github.com/prettier/prettier)
-[![made with lass](https://img.shields.io/badge/made_with-lass-95CC28.svg)](https://lass.js.org)
-[![license](https://img.shields.io/github/license/ladjs/supertest.svg)](LICENSE)
+> Dependency-bumped version of [supertest](https://www.npmjs.com/package/supertest)
 
-> HTTP assertions made easy via [superagent](http://github.com/ladjs/superagent).  Maintained for [Forward Email](https://github.com/forwardemail) and [Lad](https://github.com/ladjs).
+Generated by [DepUp](https://github.com/depup/npm) -- all production
+dependencies bumped to latest versions.
 
-## About
-
-The motivation with this module is to provide a high-level abstraction for testing
-HTTP, while still allowing you to drop down to the [lower-level API](https://forwardemail.github.io/superagent/) provided by superagent.
-
-## Getting Started
-
-Install supertest as an npm module and save it to your package.json file as a development dependency:
+## Installation
 
 ```bash
-npm install supertest --save-dev
-```
-
-  Once installed it can now be referenced by simply calling ```require('supertest');```
-
-## Example
-
-You may pass an `http.Server`, or a `Function` to `request()` - if the server is not
-already listening for connections then it is bound to an ephemeral port for you so
-there is no need to keep track of ports.
-
-supertest works with any test framework, here is an example without using any
-test framework at all:
-
-```js
-const request = require('supertest');
-const express = require('express');
-
-const app = express();
-
-app.get('/user', function(req, res) {
-  res.status(200).json({ name: 'john' });
-});
-
-request(app)
-  .get('/user')
-  .expect('Content-Type', /json/)
-  .expect('Content-Length', '15')
-  .expect(200)
-  .end(function(err, res) {
-    if (err) throw err;
-  });
-```
-
-To enable http2 protocol, simply append an options to `request` or `request.agent`:
-
-```js
-const request = require('supertest');
-const express = require('express');
-
-const app = express();
-
-app.get('/user', function(req, res) {
-  res.status(200).json({ name: 'john' });
-});
-
-request(app, { http2: true })
-  .get('/user')
-  .expect('Content-Type', /json/)
-  .expect('Content-Length', '15')
-  .expect(200)
-  .end(function(err, res) {
-    if (err) throw err;
-  });
-
-request.agent(app, { http2: true })
-  .get('/user')
-  .expect('Content-Type', /json/)
-  .expect('Content-Length', '15')
-  .expect(200)
-  .end(function(err, res) {
-    if (err) throw err;
-  });
-```
-
-Here's an example with mocha, note how you can pass `done` straight to any of the `.expect()` calls:
-
-```js
-describe('GET /user', function() {
-  it('responds with json', function(done) {
-    request(app)
-      .get('/user')
-      .set('Accept', 'application/json')
-      .expect('Content-Type', /json/)
-      .expect(200, done);
-  });
-});
-```
-
-You can use `auth` method to pass HTTP username and password in the same way as in the [superagent](https://forwardemail.github.io/superagent/#authentication):
-
-```js
-describe('GET /user', function() {
-  it('responds with json', function(done) {
-    request(app)
-      .get('/user')
-      .auth('username', 'password')
-      .set('Accept', 'application/json')
-      .expect('Content-Type', /json/)
-      .expect(200, done);
-  });
-});
-```
-
-One thing to note with the above statement is that superagent now sends any HTTP
-error (anything other than a 2XX response code) to the callback as the first argument if
-you do not add a status code expect (i.e. `.expect(302)`).
-
-If you are using the `.end()` method `.expect()` assertions that fail will
-not throw - they will return the assertion as an error to the `.end()` callback. In
-order to fail the test case, you will need to rethrow or pass `err` to `done()`, as follows:
-
-```js
-describe('POST /users', function() {
-  it('responds with json', function(done) {
-    request(app)
-      .post('/users')
-      .send({name: 'john'})
-      .set('Accept', 'application/json')
-      .expect('Content-Type', /json/)
-      .expect(200)
-      .end(function(err, res) {
-        if (err) return done(err);
-        return done();
-      });
-  });
-});
-```
-
-You can also use promises:
-
-```js
-describe('GET /users', function() {
-  it('responds with json', function() {
-    return request(app)
-      .get('/users')
-      .set('Accept', 'application/json')
-      .expect('Content-Type', /json/)
-      .expect(200)
-      .then(response => {
-         expect(response.body.email).toEqual('foo@bar.com');
-      })
-  });
-});
-```
-
-Or async/await syntax:
-
-```js
-describe('GET /users', function() {
-  it('responds with json', async function() {
-    const response = await request(app)
-      .get('/users')
-      .set('Accept', 'application/json')
-    expect(response.headers["content-type"]).toMatch(/json/);
-    expect(response.status).toEqual(200);
-    expect(response.body.email).toEqual('foo@bar.com');
-  });
-});
-```
-
-Expectations are run in the order of definition. This characteristic can be used
-to modify the response body or headers before executing an assertion.
-
-```js
-describe('POST /user', function() {
-  it('user.name should be an case-insensitive match for "john"', function(done) {
-    request(app)
-      .post('/user')
-      .send('name=john') // x-www-form-urlencoded upload
-      .set('Accept', 'application/json')
-      .expect(function(res) {
-        res.body.id = 'some fixed id';
-        res.body.name = res.body.name.toLowerCase();
-      })
-      .expect(200, {
-        id: 'some fixed id',
-        name: 'john'
-      }, done);
-  });
-});
-```
-
-Anything you can do with superagent, you can do with supertest - for example multipart file uploads!
-
-```js
-request(app)
-  .post('/')
-  .field('name', 'my awesome avatar')
-  .field('complex_object', '{"attribute": "value"}', {contentType: 'application/json'})
-  .attach('avatar', 'test/fixtures/avatar.jpg')
-  ...
-```
-
-Passing the app or url each time is not necessary, if you're testing
-the same host you may simply re-assign the request variable with the
-initialization app or url, a new `Test` is created per `request.VERB()` call.
-
-```js
-request = request('http://localhost:5555');
-
-request.get('/').expect(200, function(err){
-  console.log(err);
-});
-
-request.get('/').expect('heya', function(err){
-  console.log(err);
-});
-```
-
-Here's an example with mocha that shows how to persist a request and its cookies:
-
-```js
-const request = require('supertest');
-const should = require('should');
-const express = require('express');
-const cookieParser = require('cookie-parser');
-
-describe('request.agent(app)', function() {
-  const app = express();
-  app.use(cookieParser());
-
-  app.get('/', function(req, res) {
-    res.cookie('cookie', 'hey');
-    res.send();
-  });
-
-  app.get('/return', function(req, res) {
-    if (req.cookies.cookie) res.send(req.cookies.cookie);
-    else res.send(':(')
-  });
-
-  const agent = request.agent(app);
-
-  it('should save cookies', function(done) {
-    agent
-    .get('/')
-    .expect('set-cookie', 'cookie=hey; Path=/', done);
-  });
-
-  it('should send cookies', function(done) {
-    agent
-    .get('/return')
-    .expect('hey', done);
-  });
-});
-```
-
-There is another example that is introduced by the file [agency.js](https://github.com/ladjs/superagent/blob/master/test/node/agency.js)
-
-Here is an example where 2 cookies are set on the request.
-
-```js
-agent(app)
-  .get('/api/content')
-  .set('Cookie', ['nameOne=valueOne;nameTwo=valueTwo'])
-  .send()
-  .expect(200)
-  .end((err, res) => {
-    if (err) {
-      return done(err);
-    }
-    expect(res.text).to.be.equal('hey');
-    return done();
-  });
+npm install @depup/supertest
 ```
 
-## API
-
-You may use any [superagent](http://github.com/ladjs/superagent) methods,
-including `.write()`, `.pipe()` etc and perform assertions in the `.end()` callback
-for lower-level needs.
-
-### .expect(status[, fn])
-
-Assert response `status` code.
-
-### .expect(status, body[, fn])
-
-Assert response `status` code and `body`.
-
-### .expect(body[, fn])
-
-Assert response `body` text with a string, regular expression, or
-parsed body object.
-
-### .expect(field, value[, fn])
-
-Assert header `field` `value` with a string or regular expression.
-
-### .expect(function(res) {})
-
-Pass a custom assertion function. It'll be given the response object to check. If the check fails, throw an error.
-
-```js
-request(app)
-  .get('/')
-  .expect(hasPreviousAndNextKeys)
-  .end(done);
-
-function hasPreviousAndNextKeys(res) {
-  if (!('next' in res.body)) throw new Error("missing next key");
-  if (!('prev' in res.body)) throw new Error("missing prev key");
-}
-```
-
-### .end(fn)
-
-Perform the request and invoke `fn(err, res)`.
-
-## Cookies
-
-Here is an example of using the `set` and `not` cookie assertions:
-
-```js
-// setup super-test
-const request = require('supertest');
-const express = require('express');
-const cookies = request.cookies;
-
-// setup express test service
-const app = express();
-
-app.get('/users', function(req, res) {
-  res.cookie('alpha', 'one', { domain: 'domain.com', path: '/', httpOnly: true });
-  res.send(200, { name: 'tobi' });
-});
-
-// test request to service
-request(app)
-  .get('/users')
-  .expect('Content-Type', /json/)
-  .expect('Content-Length', '15')
-  .expect(200)
-  // assert 'alpha' cookie is set with domain, path, and httpOnly options
-  .expect(cookies.set({ name: 'alpha', options: ['domain', 'path', 'httponly'] }))
-  // assert 'bravo' cookie is NOT set
-  .expect(cookies.not('set', { name: 'bravo' }))
-  .end(function(err, res) {
-    if (err) {
-      throw err;
-    }
-  });
-```
-
-It is also possible to chain assertions:
-
-```js
-cookies.set({/* ... */}).not('set', {/* ... */})
-```
-
-### Cookie assertions
-
-Functions and methods are chainable.
-
-#### cookies([secret], [asserts])
-
-Get assertion function for [super-test](https://github.com/visionmedia/supertest) `.expect()` method.
-
-*Arguments*
-
-- `secret` - String or array of strings. Cookie signature secrets.
-- `asserts(req, res)` - Function or array of functions. Failed custom assertions should throw.
-
-#### .set(expects, [assert])
-
-Assert that cookie and options are set.
-
-*Arguments*
-
-- `expects` - Object or array of objects.
-  - `name` - String name of cookie.
-  - `options` - *Optional* array of options.
-- `assert` - *Optional* boolean "assert true" modifier. Default: `true`.
-
-#### .reset(expects, [assert])
-
-Assert that cookie is set and was already set (in request headers).
-
-*Arguments*
-
-- `expects` - Object or array of objects.
-  - `name` - String name of cookie.
-- `assert` - *Optional* boolean "assert true" modifier. Default: `true`.
-
-#### .new(expects, [assert])
-
-Assert that cookie is set and was NOT already set (NOT in request headers).
-
-*Arguments*
-
-- `expects` - Object or array of objects.
-  - `name` - String name of cookie.
-- `assert` - *Optional* boolean "assert true" modifier. Default: `true`.
-
-#### .renew(expects, [assert])
-
-Assert that cookie is set with a strictly greater `expires` or `max-age` than the given value.
-
-*Arguments*
-
-- `expects` - Object or array of objects.
-  - `name` - String name of cookie.
-  - `options` - Object of options. `use one of two options below`
-  - `options`.`expires` - String UTC expiration for original cookie (in request headers).
-  - `options`.`max-age` - Integer ttl in seconds for original cookie (in request headers).
-- `assert` - *Optional* boolean "assert true" modifier. Default: `true`.
-
-#### .contain(expects, [assert])
-
-Assert that cookie is set with value and contains options.
-
-Requires `cookies(secret)` initialization if cookie is signed.
-
-*Arguments*
-
-- `expects` - Object or array of objects.
-  - `name` - String name of cookie.
-  - `value` - *Optional* string unsigned value of cookie.
-  - `options` - *Optional* object of options.
-  - `options`.`domain` - *Optional* string domain.
-  - `options`.`path` - *Optional* string path.
-  - `options`.`expires` - *Optional* string UTC expiration.
-  - `options`.`max-age` - *Optional* integer ttl, in seconds.
-  - `options`.`secure` - *Optional* boolean secure flag.
-  - `options`.`httponly` - *Optional* boolean httpOnly flag.
-- `assert` - *Optional* boolean "assert true" modifier. Default: `true`.
-
-#### .not(method, expects)
-
-Call any cookies assertion method with "assert true" modifier set to `false`.
-
-Syntactic sugar.
-
-*Arguments*
-
-- `method` - String method name. Arguments of method name apply in `expects`.
-- `expects` - Object or array of objects.
-  - `name` - String name of cookie.
-  - `value` - *Optional* string unsigned value of cookie.
-  - `options` - *Optional* object of options.
+| Field | Value |
+|-------|-------|
+| Original | [supertest](https://www.npmjs.com/package/supertest) @ 7.3.0 |
+| Processed | 2026-09-27 |
+| Smoke test | passed |
+| Deps updated | 1 |
 
-## Notes
+## Dependency Changes
 
-Inspired by [api-easy](https://github.com/flatiron/api-easy) minus vows coupling.
+| Dependency | From | To |
+|------------|------|-----|
+| superagent | ^10.3.0 | ^10.4.1 |
 
-## License
+---
 
-MIT
+Source: https://github.com/depup/npm | Original: https://www.npmjs.com/package/supertest
 
-[coverage-badge]: https://img.shields.io/codecov/c/github/ladjs/supertest.svg
-[coverage]: https://codecov.io/gh/ladjs/supertest
-[travis-badge]: https://travis-ci.org/ladjs/supertest.svg?branch=master
-[travis]: https://travis-ci.org/ladjs/supertest
-[dependencies-badge]: https://david-dm.org/ladjs/supertest/status.svg
-[dependencies]: https://david-dm.org/ladjs/supertest
-[prs-badge]: https://img.shields.io/badge/PRs-welcome-brightgreen.svg?style=flat-square
-[prs]: http://makeapullrequest.com
-[license-badge]: https://img.shields.io/badge/license-MIT-blue.svg?style=flat-square
-[license]: https://github.com/ladjs/supertest/blob/master/LICENSE
+License inherited from the original package.

package/changes.json

@@ -0,0 +1,10 @@
+{
+  "bumped": {
+    "superagent": {
+      "from": "^10.3.0",
+      "to": "^10.4.1"
+    }
+  },
+  "timestamp": "2026-09-27T01:04:23.403Z",
+  "totalUpdated": 1
+}

package/index.js

@@ -4,6 +4,7 @@
  * Module dependencies.
  */
 const methods = require('methods');
+const http = require('http');
 let http2;
 try {
   http2 = require('http2'); // eslint-disable-line global-require
@@ -24,6 +25,7 @@ const cookies = require('./lib/cookies');
  */
 module.exports = function(app, options = {}) {
   const obj = {};
+  let target = app;
 
   if (typeof app === 'function') {
     if (options.http2) {
@@ -32,12 +34,15 @@ module.exports = function(app, options = {}) {
           'supertest: this version of Node.js does not support http2'
         );
       }
+      target = http2.createServer(app);
+    } else {
+      target = http.createServer(app);
     }
   }
 
   methods.forEach(function(method) {
     obj[method] = function(url) {
-      var test = new Test(app, method, url, options.http2);
+      var test = new Test(target, method, url, options.http2);
       if (options.http2) {
         test.http2();
       }

package/lib/cookies/assertion.js

@@ -212,7 +212,10 @@ module.exports = function (secret, asserts) {
         return;
       }
 
-      const key = part.substr(0, equalsIndex).trim().toLowerCase();
+      const rawKey = part.substr(0, equalsIndex).trim();
+      // Cookie names are case-sensitive, while Set-Cookie attribute names are
+      // case-insensitive.
+      const key = i === 0 ? rawKey : rawKey.toLowerCase();
       // only assign once
       if (typeof cookie[key] !== 'undefined') return;
 

package/lib/test.js

@@ -19,6 +19,10 @@ try {
 
 /** @typedef {import('superagent').Response} Response */
 
+// Tracks only servers started by SuperTest.  WeakMap keeps the bookkeeping
+// private and lets user-owned servers remain untouched.
+const serverStates = new WeakMap();
+
 class Test extends Request {
   /**
    * Initialize a new `Test` with the given `app`,
@@ -58,15 +62,53 @@ class Test extends Request {
    * @api private
    */
   serverAddress(app, path) {
-    const addr = app.address();
+    let addr = app.address();
+    let state = serverStates.get(app);
+
+    if (!addr) {
+      if (!state) {
+        state = {
+          pending: 0,
+          starting: true,
+          closing: false,
+          startError: null
+        };
+        serverStates.set(app, state);
+
+        const onListening = function () {
+          state.starting = false;
+          app.removeListener('error', onError);
+        };
+        const onError = function (err) {
+          state.starting = false;
+          state.startError = err;
+          app.removeListener('listening', onListening);
+        };
+
+        app.once('listening', onListening);
+        app.once('error', onError);
+        app.listen(0);
+      }
+      addr = app.address();
+    }
+
+    // A previously started SuperTest server is shared by every request created
+    // from the same request factory and closes after the final request settles.
+    if (state) {
+      this._server = app;
+    }
 
-    if (!addr) this._server = app.listen(0);
-    // } else {
-    //   this._server = app;
-    // }
-    const port = app.address().port;
+    // A SuperTest-created IPv6 wildcard is dual-stack by default. Prefer IPv4
+    // for that wildcard so SuperAgent does not construct an IPv6 loopback URL;
+    // explicit IPv6-only servers retain their own address family below.
+    let host = addr.address;
+    if (host === '::') host = '127.0.0.1';
+    else if (host === '0.0.0.0') host = '127.0.0.1';
+    if (host.includes(':')) host = `[${host}]`;
+
+    const port = addr.port;
     const protocol = app instanceof Server ? 'https' : 'http';
-    return protocol + '://127.0.0.1:' + port + path;
+    return protocol + '://' + host + ':' + port + path;
   }
 
   /**
@@ -132,29 +174,66 @@ class Test extends Request {
    */
   end(fn) {
     const server = this._server;
+    const state = server && serverStates.get(server);
+    let complete = false;
+    let dispatch;
+    let onListening;
+    let onStartError;
+    let onClose;
+
+    const removeStartListeners = () => {
+      if (!server) return;
+      if (onListening) server.removeListener('listening', onListening);
+      if (onStartError) server.removeListener('error', onStartError);
+      if (onClose) server.removeListener('close', onClose);
+    };
 
-    super.end((err, res) => {
-      const localAssert = () => {
-        this.assert(err, res, fn);
-      };
-
-      if (server && server._handle) {
-        // Handle server closing with error handling for already closed servers
-        return server.close((closeError) => {
-          // Ignore ERR_SERVER_NOT_RUNNING errors as the server is already closed
-          if (closeError && closeError.code === 'ERR_SERVER_NOT_RUNNING') {
-            return localAssert();
-          }
-          // For other errors, pass them through
-          if (closeError) {
-            return localAssert();
-          }
-          localAssert();
-        });
+    const finish = (err, res) => {
+      if (complete) return;
+      complete = true;
+      removeStartListeners();
+
+      const localAssert = () => this.assert(err, res, fn);
+      if (state) {
+        state.pending -= 1;
+        if (state.pending === 0 && !state.closing && server._handle) {
+          state.closing = true;
+          return server.close(function () {
+            serverStates.delete(server);
+            localAssert();
+          });
+        }
+        if (state.pending === 0 && !server._handle) serverStates.delete(server);
       }
 
       localAssert();
-    });
+    };
+
+    dispatch = () => {
+      removeStartListeners();
+      try {
+        super.end(finish);
+      } catch (err) {
+        finish(err);
+      }
+    };
+
+    if (state) state.pending += 1;
+
+    if (state && state.startError) {
+      finish(state.startError);
+    } else if (state && state.starting) {
+      onListening = dispatch;
+      onStartError = finish;
+      onClose = function () {
+        finish(new Error('SuperTest server closed before listening'));
+      };
+      server.once('listening', onListening);
+      server.once('error', onStartError);
+      server.once('close', onClose);
+    } else {
+      dispatch();
+    }
 
     return this;
   }
@@ -217,18 +296,6 @@ class Test extends Request {
     return this;
   }
 
-  /*
-    * Adds a set Authorization Bearer
-    *
-    * @param {Bearer} Bearer Token
-    * Shortcut for .set('Authorization', `Bearer ${token}`)
-    */
-
-  bearer(token) {
-    this.set('Authorization', `Bearer ${token}`);
-    return this;
-  }
-
   /**
    * Perform assertions on a response body and return an Error upon failure.
    *
@@ -275,7 +342,7 @@ class Test extends Request {
    */// eslint-disable-next-line class-methods-use-this
   _assertHeader(header, res) {
     const field = header.name;
-    const actual = res.header[field.toLowerCase()];
+    const actual = res.headers[field.toLowerCase()];
     const fieldExpected = header.value;
 
     if (typeof actual === 'undefined') return new Error('expected "' + field + '" header field');

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@depup/supertest",
-  "description": "SuperAgent driven library for testing HTTP servers",
-  "version": "7.2.2-depup.0",
+  "description": "SuperAgent driven library for testing HTTP servers (with updated dependencies)",
+  "version": "7.3.0-depup.0",
   "author": "TJ Holowaychuk",
   "contributors": [],
   "dependencies": {
     "methods": "^1.1.2",
-    "superagent": "^10.3.0",
+    "superagent": "^10.4.1",
     "cookie-signature": "^1.2.2"
   },
   "devDependencies": {
@@ -30,9 +30,17 @@
   },
   "files": [
     "index.js",
-    "lib"
+    "lib",
+    "changes.json",
+    "README.md"
   ],
   "keywords": [
+    "supertest",
+    "depup",
+    "updated-dependencies",
+    "security",
+    "latest",
+    "patched",
     "bdd",
     "http",
     "request",
@@ -53,5 +61,18 @@
     "lint:fix": "eslint --fix lib/**/*.js test/**/*.js index.js",
     "pretest": "npm run lint --if-present",
     "test": "nyc --reporter=html --reporter=text mocha --exit --require should --reporter spec --check-leaks"
+  },
+  "depup": {
+    "changes": {
+      "superagent": {
+        "from": "^10.3.0",
+        "to": "^10.4.1"
+      }
+    },
+    "depsUpdated": 1,
+    "originalPackage": "supertest",
+    "originalVersion": "7.3.0",
+    "processedAt": "2026-09-27T01:04:28.860Z",
+    "smokeTest": "passed"
   }
 }