Live data from Hacker News

Request Node lib used by 48k modules is now deprecated

github.com

11–20 of 135 posts

Re: Request Node lib used by 48k modules is now deprecated

#12
post #2

What, why? Edit: https://github.com/request/request/issues/3142

Specifically: The first version of request was one of the first modules ever created for the Node.js ecosystem. [..] The patterns at the core of request are out of date. [..] A version of request written to truly embrace these new language patterns is, effectively, a new module.

And IMO that's a really good way of solving this issue!

Rather than try to push a paradigm shift under a major version change in a library, and rather than just hand the library over to someone who may or may not be vetted enough, they are gracefully shutting it down while still sticking around to fix any security issues that may crop up.

Re: Request Node lib used by 48k modules is now deprecated

#13
I have a question:

Is it the responsibility of the package manager to keep users safe? By that, I mean, if there was a security vulnerability that the maintainers refused to fix, what would the process be?

Should NPM refuse to install packages marked as deprecated, perhaps after a certain age of deprecation (say, 6 months)?

Comparing this to the browser where I believe it is the expectation Firefox, Chrome, Safari et al to keep users safe, by updating automatically if an issue is discovered.

Re: Request Node lib used by 48k modules is now deprecated

#17
Deprecating is a weird decision as there is nothing wrong with the "request" module. It doesn't lead to bad code, bugs or security risks.

It would be better to say this is the last version, except for security upgrades. These upgrades can be done by other maintainers that are assigned to the project.

Re: Request Node lib used by 48k modules is now deprecated

#18

Deprecating is a weird decision as there is nothing wrong with the "request" module. It doesn't lead to bad code, bugs or security risks. It would be better to say this is the last version, except for security upgrades. These upgrades can be done by other maintainers that are assigned to the project.

There doesn't have to be something wrong with a solution to deprecate it, there just has to be a better alternative.

Re: Request Node lib used by 48k modules is now deprecated

#19

It was about time. I did some benchmarks few years ago and the results were disgusting compared to native lib, plus why so many dependencies for a simple request library? I will never understand why it gained so much publicly, it was worthless since the day one.

There is no reason to be disrespectful.

As a user of Request for the past couple of years, it has made my life absolutely simple. I never had to worry about making HTTP requests and catching all those errors because it did this and a lot lot more.

I've worked on several projects and not all of them ever sat down and wondered the benchmarks at a very high scale and the number of dependencies it needed.

It's not a criteria for all the projects in the world.

I have utmost respect for the maintainers and contributors of Request and so should you.

Post reply on HN