Skip to content

Conversation

@laodaniel
Copy link
Contributor

@laodaniel laodaniel commented Apr 2, 2025

related to https://github.com/weekendesk/tech-management/issues/1480

Scope

We have a number of critical, high and moderate vulnerabilities in weekendesk-gateway-frontoffice that are due to lack of updates in our dependencies.

image

Solution

All vulnerabilities are coming from request and request-promise-native which are deprecated and unmaintained since 2020.

  • We are using the native fetch method (since Node 18, it's supported) instead of request and request-promise-native
  • We need to replace nock on all unit tests. It's a way to intercept requests but it's not working with fetch
  • Bump this library to a major release

Also this PR introduces some breaking changes:

  • I've removed the Nodegate passthrough feature which was an incomplete feature and not used on production.
  • It's not possible to do GET or HEAD request with a body as this is not supported by the http protocol

I'm also updating:

  • Express.js where there are some breaking changes
  • body-parser the only breaking change is Node.js 18 is the minimum supported version

image

I've updated this repository protection branch rule to use only node 20:
image

@laodaniel laodaniel self-assigned this Apr 2, 2025
@laodaniel laodaniel force-pushed the up-deps branch 2 times, most recently from 799510f to b6be38d Compare April 4, 2025 11:45
@laodaniel laodaniel changed the title Replace deprecated request library and use fetch Replace deprecated request deps and use fetch Apr 4, 2025
@laodaniel laodaniel marked this pull request as ready for review April 8, 2025 12:52
@laodaniel laodaniel merged commit 953c355 into weekendesk:master Apr 14, 2025
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants