compiler
compiler copied to clipboard
npm: Change request to other packages
The npm package request
is under maintenance mode: https://github.com/request/request/issues/3142
Therefore, you need to change request
to other packages.
Alternative libraries to request: https://github.com/request/request/issues/3143
Thanks for reporting this! To set expectations:
- Issues are reviewed in batches, so it can take some time to get a response.
- Ask questions in a community forum. You will get an answer quicker that way!
- If you experience something similar, open a new issue. We like duplicates.
Finally, please be patient with the core team. They are trying their best with limited resources.
esbuild
(a popular build tool for JavaScript and TypeScript written in Go) recently switched to an approach that avoids dependencies and postinstall scripts altogether. The creator of esbuild
wrote down a very nice explanation of the technique and its pros and cons here:
https://github.com/evanw/esbuild/pull/1621
swc
(a similar tool written in Rust) already used that technique, too.
This might be viable for Elm too. Leaving this here in case it helps future decisions!
Request 2.88.2
depends on form-data 2.3.3
, which depends on json-schema 0.2.3
json-schema 0.2.3 has a critical vulnerability: https://github.com/advisories/GHSA-896r-f27r-55mw
Which is a problem for using Elm. If you org needs to comply with security audits (like us).
So it would be really good to change this
FYI: The request
dependency is being removed in https://github.com/elm/compiler/pull/2287
hi @lydell since https://github.com/elm/compiler/pull/2287 is no longer going to be completed (in the near future) would it be possible to:
- port the part of the code that replaced
request
- replace
request
with one of its alternatives
I'm willing to help or take the lead on any of those options.
@adrian-gomez I’m not sure I understand what you mean. Could we chat about it on Slack perhaps?
Do you plan to merge https://github.com/elm/compiler/pull/2287 ?
This issue has been outstanding for 2 years. The following security advisory is well known about the request package:
The request package through 2.88.2 for Node.js and the @cypress/request package prior to 3.0.0 allow a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP).