You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The browserstack-cypress-cli makes use of the request package (2.88.2) which has been deprecated now. Also the request package (2.88.2) had published 3 years back and after that no new version has been published until today.
Is there any plans to change this package and use another one instead?
Previously, Browserstack attempted to transition from the deprecated request module to an alternative, namely the Axios module. However, they encountered certain difficulties, particularly the HTTP_PROXY was not honored as expected.
As a result, Browserstack decided not to pursue it further.
It's worth noting that the request module had a significant user base with over 17 million weekly downloads, and at that time, it did not present any security concerns. However, making the necessary changes is part of Browserstack's roadmap.
For your information, when installing the 'browserstack-cypress-cli' dependency, 8 vulnerabilities are immediately flagged.
This CLI is part of the Browserstack family, and many Browserstack client corporations, including the one I work for, extensively use Browserstack products. Particularly, my company places significant emphasis on keeping our products free from errors and bugs.
While I can override the 'got' and 'tough-cookie' versions with the improved ones, it is not possible for 'request' as the library has been deprecated since 2020.
I believe the team maintaining this CLI should seriously consider keeping it up-to-date and free from potential security issues this library.
It's evident that the tool is open source, and any of us can make a PR with the changes. Then my question is: Are there enough tests to ensure a smooth replacement of 'request' with 'axios' or the native node 'fetch' ? If necessary, my team can commit to using an alpha version with this library change. What do you think?
Activity
grandEL007 commentedon May 24, 2023
Hey there,
Previously, Browserstack attempted to transition from the deprecated request module to an alternative, namely the Axios module. However, they encountered certain difficulties, particularly the HTTP_PROXY was not honored as expected.
As a result, Browserstack decided not to pursue it further.
It's worth noting that the request module had a significant user base with over 17 million weekly downloads, and at that time, it did not present any security concerns. However, making the necessary changes is part of Browserstack's roadmap.
Thanks.
xcafebabe commentedon Jul 19, 2023
For your information, when installing the 'browserstack-cypress-cli' dependency, 8 vulnerabilities are immediately flagged.
This CLI is part of the Browserstack family, and many Browserstack client corporations, including the one I work for, extensively use Browserstack products. Particularly, my company places significant emphasis on keeping our products free from errors and bugs.
While I can override the 'got' and 'tough-cookie' versions with the improved ones, it is not possible for 'request' as the library has been deprecated since 2020.
I believe the team maintaining this CLI should seriously consider keeping it up-to-date and free from potential security issues this library.
It's evident that the tool is open source, and any of us can make a PR with the changes. Then my question is: Are there enough tests to ensure a smooth replacement of 'request' with 'axios' or the native node 'fetch' ? If necessary, my team can commit to using an alpha version with this library change. What do you think?
xcafebabe commentedon Jul 21, 2023
I've noticed that there is a pull request on the way, preparing the change. #596 🙏🏼 🤞🏼
droca commentedon May 14, 2024
One year later, this is still open and the PR for the fix is still in progress and having conflicts.
This is definitely something important to fix