Skip to content

Dependency request is missing and vulnerable #217

@SNThrailkill

Description

@SNThrailkill

Environment details

  • OS: MacOS 14.4.1
  • Node.js version: 20.11.1
  • npm version: 10.2.4
  • gax-nodejs version: 4.3.1

Steps to reproduce

  1. Add @google-cloud/pubsub as a dependency to any project
  2. Run npm install
  3. Run npm run build or equivalent

Error

⚠ ./node_modules/google-gax/build/src/streamingRetryRequest.js
Module not found: Can't resolve 'request' in '/app/node_modules/google-gax/build/src'

Import trace for requested module:
./node_modules/google-gax/build/src/streamingRetryRequest.js
./node_modules/google-gax/build/src/streamingCalls/streaming.js
./node_modules/google-gax/build/src/index.js
./node_modules/@google-cloud/pubsub/build/src/index.js
./src/app/my/code/pubsub.ts

Workaround
Add request as a dependency of the project by running npm install request --save

Additional Issue
On top of being missing from this package, the request package has been deprecated for 4 years and is vulnerable due to its reliance on the tough-cookie package that has well known vulnerabilities (Link 1, Link 2, Link 3).

Metadata

Metadata

Assignees

Labels

priority: p2Moderately-important priority. Fix may not be included in next release.type: bugError or flaw in code with unintended results or allowing sub-optimal usage patterns.

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions