chore(deps): Upgrade superagent to v10.2.X

[abshierjoel]

Changes

Superagent has a patch for a publicly announced vulnerability now available in version 10.2.X. This PR updates the superagent dependency to the latest version.

warning auth0-js > [email protected]: Please upgrade to v9.0.0+ as we have fixed a public vulnerability with formidable dependency. Note that v9.0.0+ requires Node.js v14.18.0+. See https://github.com/ladjs/superagent/pull/1800 for insight. This project is supported and maintained by the team at Forward Email @ https://forwardemail.net

References

Please include relevant links supporting this change such as a:

• support ticket
• community post
• StackOverflow post
• support forum thread

Testing

Please describe how this can be tested by reviewers. Be specific about anything not tested and reasons why. If this library has unit and/or integration testing, tests should be added for new functionality and existing tests should complete without errors.

• This change adds unit test coverage
• This change adds integration test coverage

Checklist

• I have read the Auth0 general contribution guidelines
• I have read the Auth0 Code of Conduct
• All tests and linters described in the Develop section run without errors

[ankita10119]

@abshierjoel

We're holding off on merging this PR as it upgrades superagent only to v9.x, which still depends on a vulnerable version of form-data.

We're planning an upgrade to [email protected], which includes form-data@^4.0.4, the first patched version fixing the vulnerability (CVE-2025-7783).

If you're able to update this PR to target [email protected] (or later), we’ll consider it for merging.

Otherwise, once we proceed with our internal upgrade to [email protected], we’ll likely close this PR.

Thank you for your contribution and understanding!

[abshierjoel]

@ankita10119 happy to take another look at it and get this PR up to date 👍

[abshierjoel]

@ankita10119 no breaking changes from superagent v9 to v10, so I upgraded the package and rebased on the latest master.

[amitsingh05667]

@abshierjoel Addressed the vulnerability fixed by this PR in a different PR that has already been merged