3 ms·

Request, a NPM pkg with 55k dependents no longer accepts security fixes

• yeldarb 3y ago
  I noticed when running an `npm audit fix` that request has an open vulnerability is deprecated and not accepting security fixes anymore. While we don't use it directly, several of the packages in our dependency chain do. Looks like it still gets over 18M installs per week.
• detaro 3y ago
  Also a package that was declared deprecated 3 years ago, so this shouldn't be terribly surprising.
• hackermatic 3y ago
  It's really that they no longer accept any fixes, as the library is officially deprecated. >As of Feb 11th 2020, request is fully deprecated. No new changes are expected to land. In fact, none have landed for some time. But 18,302,678 weekly downloads[0] haven't noticed... [0] https://www.npmjs.com/package/request https://www.npmjs.com/package/request