Profiles·Public

superagent

semver>=3.7.0postconditions14functions9last verified2026-06-24coverage score100%

Postconditions: what we check

  • get · network-error-handling
    error
    Whennetwork failure, DNS error, timeout, connection refused, HTTP 4xx/5xx errors
    ThrowsError with status, response, timeout fields (Promise rejection)
    Required handlingUse try-catch (async/await) or .catch() (promises) or .end() callback
    costmediumin prodimmediate exceptionusers seeservice unavailablevisibilityvisible
    Sources[1]
  • get · timeout-error-identifiable
    warning
    Whenrequest exceeds deadline (.timeout(ms)) or response timeout (.timeout({response:ms}))
    ThrowsError with err.timeout=<number> and err.code='ETIME' (deadline) or 'ETIMEDOUT' (response timeout)
    Required handlingCheck err.timeout in catch block to distinguish timeout from network errors; retry with backoff if appropriate
    costlowin prodimmediate exceptionusers seeservice unavailablevisibilityvisible
    Sources[2]
  • get · max-response-size-exceeded
    error
    Whenresponse body exceeds maxResponseSize limit (default 200MB for buffered responses)
    ThrowsError with code='ETOOLARGE' and message='Maximum response size reached'
    Required handlingHandle in catch block; check err.code === 'ETOOLARGE' for specific handling; use streaming .pipe() for large responses instead of buffering
    costmediumin prodimmediate exceptionusers seelost datavisibilitysilent
    Sources[3]
  • post · network-error-handling
    error
    Whennetwork failure, DNS error, timeout, connection refused, HTTP 4xx/5xx errors
    ThrowsError with status, response, timeout fields (Promise rejection)
    Required handlingUse try-catch (async/await) or .catch() (promises) or .end() callback
    costmediumin prodimmediate exceptionusers seeservice unavailablevisibilityvisible
    Sources[1]
  • post · timeout-error-identifiable
    warning
    Whenrequest exceeds deadline or response timeout
    ThrowsError with err.timeout=<number> and err.code='ETIME' (deadline) or 'ETIMEDOUT' (response timeout)
    Required handlingCheck err.timeout in catch to distinguish timeout from auth/rate-limit errors; POST requests are not idempotent so do not auto-retry without deduplication
    costlowin prodimmediate exceptionusers seeservice unavailablevisibilityvisible
    Sources[2]
  • put · network-error-handling
    error
    Whennetwork failure, DNS error, timeout, connection refused, HTTP 4xx/5xx errors
    ThrowsError with status, response, timeout fields (Promise rejection)
    Required handlingUse try-catch (async/await) or .catch() (promises) or .end() callback
    costmediumin prodimmediate exceptionusers seeservice unavailablevisibilityvisible
    Sources[1]
  • patch · network-error-handling
    error
    Whennetwork failure, DNS error, timeout, connection refused, HTTP 4xx/5xx errors
    ThrowsError with status, response, timeout fields (Promise rejection)
    Required handlingUse try-catch (async/await) or .catch() (promises) or .end() callback
    costmediumin prodimmediate exceptionusers seeservice unavailablevisibilityvisible
    Sources[1]
  • delete · network-error-handling
    error
    Whennetwork failure, DNS error, timeout, connection refused, HTTP 4xx/5xx errors
    ThrowsError with status, response, timeout fields (Promise rejection)
    Required handlingUse try-catch (async/await) or .catch() (promises) or .end() callback
    costmediumin prodimmediate exceptionusers seeservice unavailablevisibilityvisible
    Sources[1]
  • del · network-error-handling
    error
    Whennetwork failure, DNS error, timeout, connection refused, HTTP 4xx/5xx errors
    ThrowsError with status, response, timeout fields (Promise rejection)
    Required handlingUse try-catch (async/await) or .catch() (promises) or .end() callback
    costmediumin prodimmediate exceptionusers seeservice unavailablevisibilityvisible
    Sources[1]
  • head · network-error-handling
    error
    Whennetwork failure, DNS error, timeout, connection refused, HTTP 4xx/5xx errors
    ThrowsError with status, response, timeout fields (Promise rejection)
    Required handlingUse try-catch (async/await) or .catch() (promises) or .end() callback
    costmediumin prodimmediate exceptionusers seeservice unavailablevisibilityvisible
    Sources[1]
  • pipe · pipe-errors-not-promise-rejections
    error
    WhenAny error during a piped request: network failure, DNS resolution error, connection refused, HTTP 4xx/5xx response, or timeout. Unlike awaited superagent calls, piped requests bypass the Promise chain entirely — .pipe() returns the destination stream immediately, not a Promise.
    ThrowsDoes NOT throw or reject a Promise. Errors are emitted as 'error' events: (1) Network/HTTP errors: emitted on the Request object via req.emit('error', err) where err.status is set for HTTP errors, absent for network/DNS errors. (2) Decompression errors (gzip/deflate responses): emitted on the destination stream via stream.emit('error', err). err.code='Z_BUF_ERROR' (truncated gzip) is silently swallowed by superagent; other zlib errors propagate to dest stream. If no 'error' listener is registered, Node.js throws an uncaught exception and may crash the process.
    Required handlingMUST register an 'error' event listener on the Request object before calling pipe(). Try-catch and async/await provide zero protection — errors bypass them silently, leaving the destination stream in an incomplete state with no indication of failure. Correct pattern: const req = superagent.get(url); req.on('error', handler); req.pipe(dest); Also register 'error' on the destination stream for decompression errors: dest.on('error', (err) => { /* handle decompression errors */ });
    costhighin prodsilent failureusers seelost datavisibilitysilent
    Sources[4][5]
  • pipe · pipe-cannot-be-mixed-with-promise
    error
    WhenCalling .pipe() after .then()/.catch()/await on the same request, or attempting to pipe the Response object (res.pipe()) received in an .end() callback. Common mistake: const res = await superagent.get(url); res.pipe(stream) — pipe() belongs on the Request, not the Response, and await has already consumed the response via end().
    ThrowsSynchronous Error with message "end() has already been called, so it's too late to start piping" when pipe() is called on the Response object after end() has run. If pipe() is called on the Request after await (same request), behavior is undefined and data may be silently lost without any error.
    Required handlingUse EITHER streaming OR promise/callback — never both on the same request. Streaming: const req = superagent.get(url); req.on('error', h); req.pipe(stream); Promise: const res = await superagent.get(url); process(res.body); If a response must be both processed and streamed, buffer first then write manually.
    costmediumin prodimmediate exceptionusers seelost datavisibilityvisible
    Sources[4]
  • agent · agent-request-network-error
    error
    Whennetwork failure, DNS error, connection refused, or HTTP 4xx/5xx on agent.get/post/put/patch/delete/head()
    ThrowsError with err.status (HTTP errors) or no err.status (network errors), plus err.response for HTTP errors
    Required handlingWrap agent HTTP method calls in try-catch; agent persists cookies so session errors (401, 403) may indicate expired auth that must be re-established
    costmediumin prodimmediate exceptionusers seeservice unavailablevisibilitysilent
    Sources[6]
  • agent · agent-session-auth-failure
    error
    When401 Unauthorized or 403 Forbidden response when agent session/cookie has expired
    ThrowsError with err.status=401 or err.status=403 and err.response containing the response body
    Required handlingCatch 401/403 specifically and re-authenticate: check err.status === 401 to detect session expiry. Agents carry cookies across requests — a 401 mid-session means the cookie/token expired and must be refreshed before retrying. Do not silently swallow these errors or the agent will continue sending expired credentials.
    costmediumin prodimmediate exceptionusers seeauthentication failurevisibilitysilent
    Sources[6][5]

Sources

Every postcondition cites at least one of these. Grouped by source type; numbered to match the footnotes above.

Official documentation

Research notes

Curator notes from SOURCES.md captured when the profile was written so you can verify the reasoning, not just the rules.

Sources for SuperAgent Contract

Official Documentation

  1. SuperAgent Official Website

  2. SuperAgent GitHub Repository

  3. SuperAgent NPM Package

Security Analysis

  1. Snyk Vulnerability Database

  2. Snyk Package Security

Code Examples

  1. DefinitelyTyped TypeScript Tests

  2. Snyk Code Examples

Key Behavioral Characteristics

Error Handling

SuperAgent treats 4xx and 5xx responses as errors by default, which is different from fetch() but similar to axios.

Quote from docs:

"SuperAgent treats 4xx and 5xx responses (as well as unhandled 3xx responses) as errors by default. Network failures produce errors with no status or response fields."

Error Object Structure

Errors contain:

  • err.status - HTTP status code (if applicable)
  • err.response - Full response object (if applicable)
  • err.timeout - Present if timeout occurred
  • err.message - Error message

HTTP Methods

All standard HTTP verbs are supported:

  • GET: request.get(url)
  • POST: request.post(url)
  • PUT: request.put(url)
  • PATCH: request.patch(url)
  • DELETE: request.delete(url) or request.del(url) (IE compatibility)
  • HEAD: request.head(url)

Execution Patterns

Requests are executed via:

  1. .then() - Promise-based
  2. await - Async/await
  3. .end(callback) - Legacy callback

Quote from docs:

"A request can be initiated by invoking the appropriate method on the request object, then calling .then() (or .end() or await) to send the request."

Version Support

Target: v3.7.0+

Rationale:

  • All known CVEs fixed in v3.7.0 (Zip Bomb DoS)
  • Earlier versions had multiple security vulnerabilities
  • Stable API across v3.x - v10.x

Supported range:

^3.7.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0

Severity Justification

All HTTP methods: ERROR severity

Rationale:

  1. Network failures are common in production (DNS, connection timeouts, server downtime)
  2. HTTP 4xx/5xx errors occur regularly (404, 500, 401, 429 rate limiting)
  3. SuperAgent treats HTTP errors as promise rejections by default
  4. Unhandled promise rejections can crash Node.js applications
  5. Consistent with axios, got, and node-fetch contracts

Date

Contract created: 2026-02-26

Need a different package?
Request a profile