-
Notifications
You must be signed in to change notification settings - Fork 393
Open
Labels
Description
Describe the bug
The Webex JS SDK depends on the request package which was deprecated in February 2020. This creates several problems:
- Security vulnerabilities - Multiple CVEs in
requestand its dependencies with no patches available - Compliance issues - Organizations with security policies cannot use the SDK
- Technical debt - The
requestpackage is no longer maintained - Modern Node.js compatibility - Cannot leverage modern features like native fetch
To Reproduce
- Install webex SDK in any project
- Run security audit (
npm auditorpnpm audit) - Observe vulnerabilities that cannot be patched due to deprecated dependency
Expected behavior
Migrate @webex/http-core from request to a modern, maintained HTTP client:
undici(Recommended) - Powers Node.js built-infetch(), actively maintained by Node.js team- Native
fetch()- Available in Node.js 18+, no external dependencies got- Popular, well-maintained, good TypeScript support
Screenshots
N/A
Platform (please complete the following information):
- OS: Any
- Browser: N/A (Node.js SDK)
- Version: webex@3.11.0
- Device Type: Desktop
Additional context
Alternatives considered:
- Using
pnpm overridesto force newer versions of transitive dependencies (may break functionality) - Forking the SDK (maintenance burden)
- Using Webex REST API directly without SDK (loses SDK features)
The request deprecation notice: request/request#3142
This change would benefit all Webex JS SDK consumers and is essential for enterprise adoption where security scanning is mandatory.
Reactions are currently unavailable