Skip to content

update request to 2.87.0#1471

Closed
rohithzr wants to merge 2 commits into
nodejs:masterfrom
rohithzr:vulnerabilities
Closed

update request to 2.87.0#1471
rohithzr wants to merge 2 commits into
nodejs:masterfrom
rohithzr:vulnerabilities

Conversation

@rohithzr

Copy link
Copy Markdown
Contributor

updated request to include security fixes and make it same as npm current
Passes all tests.

updated request to include security fixes and make it same as npm current
Passes all tests.
@refack

refack commented Jun 14, 2018

Copy link
Copy Markdown
Contributor

Hello @rohithzr and thank you for the contribution!

The only issue this might have is that it's incompatible with node <= 4. We planned on releasing a node-gyp@4.0.0 that will require node@4, so generally this might need to wait before we land this in master.
Or you can add a bump of the node version as well in:

node-gyp/package.json

Lines 37 to 39 in 50b8734

"engines": {
"node": ">= 4.0.0"
},

Let's see if our CI is properly setup - https://ci.nodejs.org/job/nodegyp-test-pull-request/54/

@refack

refack commented Jun 14, 2018

Copy link
Copy Markdown
Contributor

The only issue this might have is that it's incompatible with node <= 4.

I guess I was wrong and request>=2.82.1 is only incompatible with node < 4, so we're all good here.

@richardlau

Copy link
Copy Markdown
Member

@refack Ben split off a a v3.x branch to continue v3.x releases. For node-gyp@4.0.0 we might as well drop Node.js v4 as well given that it is EOL.

@rohithzr

Copy link
Copy Markdown
Contributor Author

Ah! I actually tested it with node 4.x which is still used somewhere in our legacy code. didn't give me any issues. Thanks for confirming it.

Comment thread package.json Outdated
"npmlog": "0 || 1 || 2 || 3 || 4",
"osenv": "0",
"request": "2",
"request": "^2.86.0",

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Although the version should match, maybe use 2.87.0 since they removed the heok/hawk issues https://github.com/request/request/blob/master/CHANGELOG.md#v2870-20180521

@rohithzr

rohithzr commented Jul 4, 2018

Copy link
Copy Markdown
Contributor Author

@refack I guess this PR can be merged now.
the request bump solves security issues while supporting node < 4

@rohithzr rohithzr mentioned this pull request Jul 4, 2018
2 tasks
@rohithzr rohithzr changed the title update request to ^2.86.0 update request to 2.87.0 Jul 7, 2018
@xzyfer

xzyfer commented Jul 8, 2018

Copy link
Copy Markdown

FWIW we did this update in node-sass@4.9.1 to resolve the security warnings and maintains support for Node 0.10. It was a smooth update.

@Fishrock123

Copy link
Copy Markdown
Contributor

CI: https://ci.nodejs.org/job/nodegyp-test-pull-request/65/

@rohithzr

Copy link
Copy Markdown
Contributor Author

@Fishrock123 so it works here without a doubt. How about we merge this and also figure out the 3.x.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants