Replace deprecated request library and update dependencies#64
Open
Replace deprecated request library and update dependencies#64
Conversation
- Removed request and request-promise-native dependencies - Added axios@^1.12.2 as replacement - Updated eventUpdate method to use axios.put() - Fixes form-data vulnerability by removing transitive dependency on old form-data version This resolves the critical CVE-2025-7783 vulnerability in form-data that was being pulled in by the deprecated request library.
- Upgraded from deprecated v1.6.0 to v5.1.0 - Removes transitive dependency on deprecated request library - Further reduces form-data vulnerability exposure Note: OAuth2Routes code needs to be updated to match v5 API
- Upgraded from deprecated v5.2.0 to v8.6.0 - Removes @bugsnag/node dependency which used deprecated request library - Further reduces form-data vulnerability exposure Note: Some tests may need updates for new Bugsnag API
ryanflynndev
reviewed
Oct 3, 2025
| const Email = require('./lib/email') | ||
| const oauth2Routes = require('./lib/oauth2Routes') | ||
| const get = require('lodash.get') | ||
| const request = require('request-promise-native') |
There was a problem hiding this comment.
I wold just use the form data override instead of replacing it with axios
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR replaces the deprecated
requestlibrary and updates other outdated dependencies to resolve security vulnerabilities, particularly CVE-2025-7783 in form-data.Changes
Replaced Deprecated Libraries
requestlibrary has been deprecated since 2020eventUpdate()method to use axios.put()Updated Dependencies
@bugsnag/js:
^5.2.0→^8.6.0simple-oauth2:
^1.6.0→^5.1.0Security Impact
requestlibraryTesting
Breaking Changes
Follow-up Work
The remaining form-data vulnerability comes from
nodemailer-sendgrid→@sendgrid/client→request. This requires either:🤖 Generated with Claude Code