Remove sync-request dependency

What

The download link logic was simplified in #953 and no longer uses sync-request. We’re keeping it around for now for users that might be relying on it, but should remove it in the next major release.

Why

Removing unused dependencies keeps the codebase tidy and minimises the number of dependencies we need to keep up to date.

Done when…

• sync-request no longer listed as a dependency in package.json

[vanitabarrett]

Had a chat with @joelanman about this work. We discussed that even though the documentation on how to update the Kit mentions making sure the package.json files match up and re-installing custom modules, we think most users of the Kit don’t install custom modules and might not have enough knowledge to re-install missing packages without additional support, potentially from our support rota.

We discussed other npm packages that we include in the Kit that we don’t use ourselves and instead provide almost like ‘helper’ packages for our users to make certain tasks easier, e.g: Notify’s notifications-node-client.

Instead of removing sync-request, an alternative approach may be to be more explicit about the packages we provide for our users to use. This would help define 1) what users can do with the Kit; and 2) why we have certain packages installed for developers maintaining the Kit. We would need to be clear that some of these packages can’t just be lifted and shifted to production as some of them aren’t suitable, for example: sync-request says it’s not suitable for production use due to scalability/performance issues.

[joelanman]

sync-request is no longer included in v13 starter files