Replace request with an alternative library

[kittaakos]

Replace request with an alternative library. request is deprecated and causing yarn audit warnings. A list of alternatives is here: request/request#3143 (comment).

% yarn why request
yarn why v1.22.18
[1/4] 🤔  Why do we have the module "request"...?
[2/4] 🚚  Initialising dependency graph...
[3/4] 🔍  Finding dependency...
[4/4] 🚡  Calculating file sizes...
=> Found "[email protected]"
info Reasons this module exists
   - "_project_#@theia#application-package" depends on it
   - Hoisted from "_project_#@theia#application-package#request"
   - Hoisted from "_project_#@theia#plugin-dev#request"
   - Hoisted from "_project_#@theia#plugin-ext-vscode#request"
   - Hoisted from "_project_#@theia#plugin-ext#request"
   - Hoisted from "_project_#jsdom#request"
info Disk size without dependencies: "696KB"
info Disk size with unique dependencies: "2.08MB"
info Disk size with transitive dependencies: "6.69MB"
info Number of shared dependencies: 37
✨  Done in 1.08s.

Since jsdom depends on an old request version, bumping jsdom would be also required:

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ moderate      │ Server-Side Request Forgery in Request                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ request                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ No patch available                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ jsdom                                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ jsdom > request                                              │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1091459                     │
└───────────────┴──────────────────────────────────────────────────────────────┘

jsdom should be replaced anyway, so this would be a good opportunity to get rid of warnings:

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ moderate      │ Insufficient Granularity of Access Control in JSDom          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ jsdom                                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=16.5.0                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ jsdom                                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ jsdom                                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1089185                     │
└───────────────┴──────────────────────────────────────────────────────────────┘

Once request is gone and a more recent version of jsdom is used, one has to update the test helper here, and handle 'undefined' property:

theia/packages/core/src/browser/test/jsdom.ts

Line 51 in b56f399

(global as any)[property] = (dom.window as any)[property];

Feature Description:

AC: yarn audit should not generate warnings.

[vince-fugnitto]

@kittaakos are you interested in contributing a fix?

[kittaakos]

It will take some time, but I will take care of it. Thanks

I am more than open to any lib replacement recommendations, so if anybody has a preference, please add it with a why you recommend it as a comment.

[msujew]

@kittaakos We have our own @theia/request package. It might make sense to use that. It features a few advanced features, such as proxy detection and so on.

[kittaakos]

We have our own @theia/request package.

OK. Let's use that. I checked the node implementation, and it comes with all required env variable support: HTTPS_PROXY and others.