breaking: Upgrade @cypress/request to 3.0.0

[chrisbreiding]

• Closes Getting 2 moderate severity vulnerabilities  #27535

Additional details

Steps to test

How has the user experience changed?

PR Tasks

• [N/A] Have tests been added/updated?
• [N/A] Has a PR for user-facing changes been opened in cypress-documentation?
• [N/A] Have API changes been updated in the type definitions?

[cypress]

9 flaky tests on run #50358 ↗︎

0

5337

78

0

9

Details:

fix test
Project: cypress	Commit: 80a4cdccb0
Status: Passed	Duration: 18:07 💡
Started: Aug 23, 2023 3:35 PM	Ended: Aug 23, 2023 3:53 PM

  cypress_api.cy.ts • 1 flaky test • 5x-driver-electron

View Output Video

Test		Artifacts
cy.origin Cypress API > Commands > adds a custom command		Test Replay Output

  commands/cookies.cy.ts • 1 flaky test • 5x-driver-electron

View Output Video

Test		Artifacts
cy.origin cookies > client side > .getCookie(), .getCookies(), and .setCookie()		Test Replay Output

  patches.cy.ts • 1 flaky test • 5x-driver-electron

View Output Video

Test		Artifacts
src/cross-origin/patches > submit > correctly submits a form when the target is _top for HTMLFormElement		Test Replay Output

  commands/spies_stubs_clocks.cy.ts • 1 flaky test • 5x-driver-electron

View Output Video

Test		Artifacts
cy.origin spies, stubs, and clock > spy()		Test Replay Output

  commands/log.cy.ts • 1 flaky test • 5x-driver-electron

View Output Video

Test		Artifacts
cy.origin log > logs in primary and secondary origins		Test Replay Output

The first 5 flaky specs are shown, see all 7 specs in Cypress Cloud.

_{This comment has been generated by cypress-bot as a result of this project's GitHub integration settings.}

[BarneyPowell]

Apologies - it's the little person in me who gives me an itch when I spot the tiniest of typos :). Stumbled across this when searching for a better solution to update our cypress 9.5.3 to cover CVE-2023-26136. Dependabot is helpfully offering to patch package-lock.json but that gives me the heebie-jeebies, as until this PR is merged, and we've upgraded to the latest Cypress, any changes will regress the alert.

Suggested change

	- Upgraded [`@cypress/request`](https://www.npmjs.com/package/@cypress/request) from `^2.8.11` to `^3.0.0` and [`@cypress/request-promise`](https://www.npmjs.com/package/@cypress/request-promise) from `4.2.6` to `4.2.7`. Addressed in [#27495](https://github.com/cypress-io/cypress/pull/27495).
	- Upgraded [`@cypress/request`](https://www.npmjs.com/package/@cypress/request) from `^2.88.11` to `^3.0.0` and [`@cypress/request-promise`](https://www.npmjs.com/package/@cypress/request-promise) from `4.2.6` to `4.2.7`. Addressed in [#27495](https://github.com/cypress-io/cypress/pull/27495).

[jordanpowell88]

We can close in favor of #27515 (which addresses the binary failure and updates @cypress/request and @cypress/request-promise)

[jordanpowell88]

Looks like this is a breaking change and will need to get put in v13. Going to just patch 2.88.12 in my PR and then we can include this in 13 afterwards

[MikeMcC399]

Without this PR, and executing npm audit on a clean installation of [email protected] reports

# npm audit report

@cypress/request  <=2.88.12
Severity: moderate
Server-Side Request Forgery in Request - https://github.com/advisories/GHSA-p8p7-x288-28g6
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/@cypress/request
  cypress  >=4.3.0
  Depends on vulnerable versions of @cypress/request
  node_modules/cypress

2 moderate severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force

I would suggest to add GHSA-p8p7-x288-28g6 to the CHANGELOG, e.g.

... to address security vulnerability [GHSA-p8p7-x288-28g6](https://github.com/advisories/GHSA-p8p7-x288-28g6)

The Common Vulnerabilities and Exposures article ID CVE-2023-28155 does not actually mention @cypress/request or cypress, so it might be confusing to use this ID as a reference in the Cypress CHANGELOG.

[MikeMcC399]

• This PR should link back to the issue Getting 2 moderate severity vulnerabilities  #27535 which reported the vulnerability.

[cypress-bot]

Released in 13.0.0.

This comment thread has been locked. If you are still experiencing this issue after upgrading to
Cypress v13.0.0, please open a new issue.