Skip to content

Migrate from deprecated request to modern HTTP client #4679

@3copelan

Description

@3copelan

Describe the bug

The Webex JS SDK depends on the request package which was deprecated in February 2020. This creates several problems:

  1. Security vulnerabilities - Multiple CVEs in request and its dependencies with no patches available
  2. Compliance issues - Organizations with security policies cannot use the SDK
  3. Technical debt - The request package is no longer maintained
  4. Modern Node.js compatibility - Cannot leverage modern features like native fetch

To Reproduce

  1. Install webex SDK in any project
  2. Run security audit (npm audit or pnpm audit)
  3. Observe vulnerabilities that cannot be patched due to deprecated dependency

Expected behavior

Migrate @webex/http-core from request to a modern, maintained HTTP client:

  1. undici (Recommended) - Powers Node.js built-in fetch(), actively maintained by Node.js team
  2. Native fetch() - Available in Node.js 18+, no external dependencies
  3. got - Popular, well-maintained, good TypeScript support

Screenshots

N/A

Platform (please complete the following information):

  • OS: Any
  • Browser: N/A (Node.js SDK)
  • Version: webex@3.11.0
  • Device Type: Desktop

Additional context

Alternatives considered:

  • Using pnpm overrides to force newer versions of transitive dependencies (may break functionality)
  • Forking the SDK (maintenance burden)
  • Using Webex REST API directly without SDK (loses SDK features)

The request deprecation notice: request/request#3142

This change would benefit all Webex JS SDK consumers and is essential for enterprise adoption where security scanning is mandatory.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions