Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenAI's response to the Axios developer tool compromise

openai.com

Post reply on HN
Print view View original

31–40 of 68 posts

Re: OpenAI's response to the Axios developer tool compromise

#31

Post by junon »

kamranjon wrote: post #24
zarzavat wrote: post #21

Earlier quoted context omitted.

> Depending on Axios suggests the devs don't know how to use fetch. You could equally say that using fetch means that the developers don't know how to use axios. They do the same thing, except axios does it a little better, when it doesn't pwn you. Axios predates the availability of fetch in node by 2 years, and fetch has never caught up with axios so there was no reason to switch to fetch, unless you need to run on…

In what ways has fetch never caught up to axios? I have not encountered a situation where I could not use fetch in the last 5 years so I'm just curious what killer features axios has that are still missing in fetch (I certainly remember using axios many moons ago).

Missing a lot of event hooks that axios/ky give you.

Re: OpenAI's response to the Axios developer tool compromise

#33

Post by mattmanser »

KronisLV wrote: post #28
msl wrote: post #27

Earlier quoted context omitted.

Forcing everyone to use ourFetch is rubbish, but forcing everyone to use axios is clean and elegant? You might want to elaborate just a little more.

ourFetch is more likely to be buggy, unmaintained, undocumented and nobody knows it well because the guy who wrote it left the org 2 years ago and so you have to waste time reading and maintaining it yourself. Axios is something where you get most of that work done for you by the community for free, and a lot of people know it. As long as you don’t get pwned due to it. Oh and you will actually find community packages…

Exactly, I completely agree.

It's the difference between using a SQL library and some person on your team writing their own SQL library and everyone having to use it. There's a vast gulf between the two, professionally speaking.

People dissing axios probably suffer from other NIH problems too.

Re: OpenAI's response to the Axios developer tool compromise

#35

Post by ga_to »

eranation wrote: post #30

As others said, no one should be using axios in 2026, fetch has been available in node v18 (experimental) in 2022 [0], stable since v21 in 2023 [1], although Claude Code sometimes will suggest it, probably worth adding a rule. Side note. I'm sure many of you know this, but for those who don't, setting min-release-age=7 in .npmrc (needs npm 11.10+), would have made the malicious axios (@1.14.1 and @0.30.4) invisible t…

Nice ad you got there. How do I define request interceptors with fetch? Axios does it.

Re: OpenAI's response to the Axios developer tool compromise

#37

Post by dheerajvs »

danscan wrote: post #4

Axios, like Express, is something I'm shocked to see used in any modern codebase. I loved both in the 2010s. In JS/TS-land there are much simpler and better options these days. Depending on Axios suggests the devs don't know how to use fetch. I can't think of another reason it would be a necessary dependency

Annoyingly, fetch does not support progress events and HTML / XML Document parsing, which are both supported by XMLHttpRequest, which Axios is based on.

Re: OpenAI's response to the Axios developer tool compromise

#38

Post by azangru »

danscan wrote: post #4

Axios, like Express, is something I'm shocked to see used in any modern codebase. I loved both in the 2010s. In JS/TS-land there are much simpler and better options these days. Depending on Axios suggests the devs don't know how to use fetch. I can't think of another reason it would be a necessary dependency

> Axios, like Express, is something I'm shocked to see used in any modern codebase

I am totally with you on axios; but why is express shocking, and what do you expect to see in its place? Fastify? Hono? Node:http?

Re: OpenAI's response to the Axios developer tool compromise

#39

Post by knocte »

sdevonoes wrote: post #34

Using TS/JS in the backend is irresponsible in 2026. We have better languages and ecosystems

The real issue is the cancer practice in our software development industry of updating dependencies for the sake of updating.

Deps should be updated when you need some features or bugfixes from the new versions; not just when DependaBot prompts you to do it.

I see value in DependaBot and things like that only to check that your module still passes your CI with upgraded dependencies (and if not, then it's worth looking at the failure, to be prepared for the updgrade in the future).

Re: OpenAI's response to the Axios developer tool compromise

#40

Post by eranation »

ga_to wrote: post #35
eranation wrote: post #30

As others said, no one should be using axios in 2026, fetch has been available in node v18 (experimental) in 2022 [0], stable since v21 in 2023 [1], although Claude Code sometimes will suggest it, probably worth adding a rule. Side note. I'm sure many of you know this, but for those who don't, setting min-release-age=7 in .npmrc (needs npm 11.10+), would have made the malicious axios (@1.14.1 and @0.30.4) invisible t…

Nice ad you got there. How do I define request interceptors with fetch? Axios does it.

You can add your own wrapper but if you're building a whole auth/retry/logging layer, axios is probably better for that. For most other use cases a small wrapper will do the job.

Didn't mean it as an ad btw, the supply chain risk is real though. Axios could be the best HTTP library ever written and it still would've dropped a RAT on your laptop on March 31 without min-release-age set.

Post reply on HN