Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

update request to 2.87.0 #1471

Closed
wants to merge 2 commits into from
Closed

Conversation

Rohithzr
Copy link
Contributor

updated request to include security fixes and make it same as npm current
Passes all tests.

updated request to include security fixes and make it same as npm current
Passes all tests.
@refack
Copy link
Contributor

refack commented Jun 14, 2018

Hello @Rohithzr and thank you for the contribution!

The only issue this might have is that it's incompatible with node <= 4. We planned on releasing a node-gyp@4.0.0 that will require node@4, so generally this might need to wait before we land this in master.
Or you can add a bump of the node version as well in:

node-gyp/package.json

Lines 37 to 39 in 50b8734

"engines": {
"node": ">= 4.0.0"
},

Let's see if our CI is properly setup - https://ci.nodejs.org/job/nodegyp-test-pull-request/54/

@refack
Copy link
Contributor

refack commented Jun 14, 2018

The only issue this might have is that it's incompatible with node <= 4.

I guess I was wrong and request>=2.82.1 is only incompatible with node < 4, so we're all good here.

@richardlau
Copy link
Member

@refack Ben split off a a v3.x branch to continue v3.x releases. For node-gyp@4.0.0 we might as well drop Node.js v4 as well given that it is EOL.

@Rohithzr
Copy link
Contributor Author

Ah! I actually tested it with node 4.x which is still used somewhere in our legacy code. didn't give me any issues. Thanks for confirming it.

package.json Outdated
@@ -28,7 +28,7 @@
"nopt": "2 || 3",
"npmlog": "0 || 1 || 2 || 3 || 4",
"osenv": "0",
"request": "2",
"request": "^2.86.0",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Although the version should match, maybe use 2.87.0 since they removed the heok/hawk issues https://github.com/request/request/blob/master/CHANGELOG.md#v2870-20180521

@Rohithzr
Copy link
Contributor Author

Rohithzr commented Jul 4, 2018

@refack I guess this PR can be merged now.
the request bump solves security issues while supporting node < 4

@Rohithzr Rohithzr mentioned this pull request Jul 4, 2018
2 tasks
@Rohithzr Rohithzr changed the title update request to ^2.86.0 update request to 2.87.0 Jul 7, 2018
@xzyfer
Copy link

xzyfer commented Jul 8, 2018

FWIW we did this update in node-sass@4.9.1 to resolve the security warnings and maintains support for Node 0.10. It was a smooth update.

@Fishrock123
Copy link
Contributor

CI: https://ci.nodejs.org/job/nodegyp-test-pull-request/65/

@Rohithzr
Copy link
Contributor Author

@Fishrock123 so it works here without a doubt. How about we merge this and also figure out the 3.x.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants