Describe the bug
The Webex JS SDK depends on the request package which was deprecated in February 2020. This creates several problems:
- Security vulnerabilities - Multiple CVEs in
request and its dependencies with no patches available
- Compliance issues - Organizations with security policies cannot use the SDK
- Technical debt - The
request package is no longer maintained
- Modern Node.js compatibility - Cannot leverage modern features like native fetch
To Reproduce
- Install webex SDK in any project
- Run security audit (
npm audit or pnpm audit)
- Observe vulnerabilities that cannot be patched due to deprecated dependency
Expected behavior
Migrate @webex/http-core from request to a modern, maintained HTTP client:
undici (Recommended) - Powers Node.js built-in fetch(), actively maintained by Node.js team
- Native
fetch() - Available in Node.js 18+, no external dependencies
got - Popular, well-maintained, good TypeScript support
Screenshots
N/A
Platform (please complete the following information):
- OS: Any
- Browser: N/A (Node.js SDK)
- Version: webex@3.11.0
- Device Type: Desktop
Additional context
Alternatives considered:
- Using
pnpm overrides to force newer versions of transitive dependencies (may break functionality)
- Forking the SDK (maintenance burden)
- Using Webex REST API directly without SDK (loses SDK features)
The request deprecation notice: request/request#3142
This change would benefit all Webex JS SDK consumers and is essential for enterprise adoption where security scanning is mandatory.
Describe the bug
The Webex JS SDK depends on the
requestpackage which was deprecated in February 2020. This creates several problems:requestand its dependencies with no patches availablerequestpackage is no longer maintainedTo Reproduce
npm auditorpnpm audit)Expected behavior
Migrate
@webex/http-corefromrequestto a modern, maintained HTTP client:undici(Recommended) - Powers Node.js built-infetch(), actively maintained by Node.js teamfetch()- Available in Node.js 18+, no external dependenciesgot- Popular, well-maintained, good TypeScript supportScreenshots
N/A
Platform (please complete the following information):
Additional context
Alternatives considered:
pnpm overridesto force newer versions of transitive dependencies (may break functionality)The
requestdeprecation notice: request/request#3142This change would benefit all Webex JS SDK consumers and is essential for enterprise adoption where security scanning is mandatory.