search

ruimarinho / bitcoin-core

A modern Bitcoin Core REST and RPC client.
477 stars 186 forks source link

remove bluebird #85

Closed madeken closed 4 years ago

madeken commented 5 years ago

I'd like to suggest removing bluebird as a dependency:

Mostly because it's not really required as pretty much everything and everyone either supports native promises or babel. It impacts performance, and debuggability.

As we've seen with numerous npm security issues, each dependency is an increased attack surface.

In my case, I noticed a credential leak from accidentally console.log(promise) from this library, which ends up printing all the promise information, including the credentials to connect. Native promises wouldn't have done that, and just printed the resolved value.

pedrobranco commented 5 years ago

Fixed by #87. Can you please help by testing the PR?