cube icon indicating copy to clipboard operation
cube copied to clipboard

Migrate away from `request` and `request-promise`

Open jlloyd-widen opened this issue 10 months ago • 2 comments

request and therefore request-promise have been deprecated for a while. On top of that they are dependent on an old version of tough-cookie for which there is a critical CVE report (CVE-2023-26136). migrating to a different request tool is highly recommended for:

  • https://github.com/cube-js/cube/blob/e5d20d228ac07849dbcd4df2f713ea01fc74f0fe/packages/cubejs-backend-cloud/package.json#L29
  • https://github.com/cube-js/cube/blob/e5d20d228ac07849dbcd4df2f713ea01fc74f0fe/packages/cubejs-cli/package.json#L44
  • https://github.com/cube-js/cube/blob/e5d20d228ac07849dbcd4df2f713ea01fc74f0fe/packages/cubejs-schema-compiler/package.json#L81

jlloyd-widen avatar Apr 29 '24 20:04 jlloyd-widen

There are a number of replacements of these packages listed here. Is there a preference by the community as to what we move to?

jlloyd-widen avatar Apr 30 '24 23:04 jlloyd-widen

If you are interested in working on this issue, please go ahead and provide PR for that. We'd be happy to review it and merge it. If this is the first time you are contributing a Pull Request to Cube, please check our contribution guidelines. You can also post any questions while contributing in the #contributors channel in the Cube Slack.

github-actions[bot] avatar May 01 '24 03:05 github-actions[bot]