The Hard Part of Leaving `request` is the App Built Around It
Disclosure: I maintain request-to-axios . This is a migration guide from the perspective of someone maintaining legacy Node.js code, not an independent review of my own package. When a project uses request , replacing the dependency can look like a one-line change. The hard part usually isn't translating request.get() to axios.get() . It's finding all the assumptions accumulated around the old…
The most challenging aspect of transitioning from the deprecated `request` library to `axios` is not merely swapping one dependency for another. According to the author, who maintains the `request-to-axios` compatibility wrapper, the true difficulty lies in uncovering and adapting all the assumptions built around the older `request` calls.
These can include callbacks expecting a specific error, response, and body format, stream piping, `formData`, `qs`, cookies, default headers, peculiar redirect handling, and tests that make certain assumptions about the response content type.
The author emphasizes that a comprehensive rewrite of a project using `request` could quickly evolve from a straightforward security maintenance task into a high-risk application migration. This is why they created the compatibility wrapper, allowing for a more gradual transition by preserving unsupported behaviors while making common request patterns easier to handle.
The source material goes on to point out that the last release of `request` was 2.88.2, marked as deprecated in 2020 with no new features planned. However, the real concern should be the specific versions of the packages installed in a project and whether that installation path could trigger any vulnerable behaviors. A simple example provided shows that installing `request@2.88.2` in a sandbox project led to the resolution of several vulnerable dependencies, including those addressing serious security issues like SSRF, CRLF injection, and prototype pollution.
The author cautions against assuming that simply updating `request` will automatically make an application secure. Instead, they advise performing a dependency audit to identify any vulnerable packages and to investigate those findings. Directly translating every `request` call to `axios` is not recommended, as the two libraries differ significantly in how they handle responses, redirects, streaming, cookie management, timeouts, and error handling.
Instead, the recommended approach is to inventory the specific options and helper patterns currently in use, write characterization tests to validate critical request and response behavior, replace the transport layer behind the imported `request` module, and then migrate unsupported edge cases one by one, always ensuring that there are explicit tests in place.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
