Skip to content

Secure, compatible replacement of request with supported postman-request fork#152

Merged
FGRibreau merged 3 commits intoFGRibreau:masterfrom
markstos:postman-request
Oct 28, 2025
Merged

Secure, compatible replacement of request with supported postman-request fork#152
FGRibreau merged 3 commits intoFGRibreau:masterfrom
markstos:postman-request

Conversation

@markstos
Copy link
Contributor

@markstos markstos commented Oct 28, 2025

It includes the test fixes from earlier PR that fixed the tests, as I needed to make sure tests pass. That earlier PR is expected to be reviewed first.

- fillform.com no longer exists
- httpbingo.org changed some responses
- Several tests needed error handling so they fail instead of timing out.
- Some error handling updates were needed for modern node versions.
- Longer timeouts were needed for test suite reliability with remote hosts.
request 2.88.1 used tough-cookie 2.5.0 as a dependency
In that version of tough-cookie, the `getCookies()`
method was not a sync method. Either you had to call
a callback or use `getCookiesSync()`.

postman-request also uses a tough-cookie-compatible fork.

Ref: https://github.com/request/request/blob/3c0cddc7c8eb60b470e9519da85896ed7ee0081e/package.json#L47
Ref: https://www.npmjs.com/package/tough-cookie/v/2.5.0
postman-request is a fork of request 2.88.1, with only some security
and bug fixes applied.

All tested passed as-is with exception one that appeared it needed to
be updated to be compatible with the last released version of `request`
as well.
@markstos
Copy link
Contributor Author

Although this was a 1:1 replacement, I think the better refactor is to make postman-request a direct dep and not a peerDep. Peer-dep expects that something else will install the dep while a direct dep insures that we install it ourselves. While it was safe to expect that request would have been installed, we should not expect that postman-request will be available and should install it ourselves.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants