search

Vonage / vonage-node-sdk

Vonage API client for Node.js. API support for SMS, Voice, Text-to-Speech, Numbers, Verify (2FA) and more.
Apache License 2.0
375 stars 178 forks source link

Latest beta release uses deprecated "request" package, which has an open CVE #807

Closed jjtindale closed 1 year ago

jjtindale commented 1 year ago

We use the beta release in order to gain access to the Conversation API functionality. From NPM, it looks like the latest beta release is 2.12.0-beta.3. This release uses the deprecated requests library, and this library has a new CVE.

There is already an issue for removing request, but this is closed saying that the issue is no longer present, but it seems to still be an issue at least for the beta channel.

Expected Behavior

I would expect the SDK to no longer use request as it has been deprecated since 2020.

Current Behavior

The SDK uses request for the latest beta channel release.

Possible Solution

Use a different HTTP library.

Your Environment

manchuck commented 1 year ago

@jjtindale V3 of the SDK no longer uses request in favor of using node-fetch

Checkout the 3.x branch for migration guides or feel free to reach out to our community slack if you have any other issue

jjtindale commented 1 year ago

Hi @manchuck, can I confirm that 3.x supports the Conversation API? The README.md says it doesn't.

manchuck commented 1 year ago

@jjtindale Currently, V3 does not support the conversations API. We do have it in the roadmap to address this. In the meantime, you can use @vonage/server-client to call the conversations API. You will just need to extend the client class in order to set the authentication properly