Drop request dependency

Packages depend on node-pre-gyp as a deep dependency, not as a top level dependency. Deep dependencies should be lightweight and shouldn’t include bloatware. While the request library has a lot of offer, it ships a shitton of bloatware on install, Node provides http.request and https.request we should be using that

[springmeyer]

I would be open to using got. We maintain two series of node-pre-gyp to make this non-breaking:

• 0.6.x series keeps using request, supports node v0.10x
• 1.x series moves to got and only supports node >4

Anyone interested in providing a PR against master that moves to got? I would also be open to reviewing PRs that remove other heavy dependencies. Space savings is a concern.

[dantman]

Adding to the reasons. request requires a lot of dependencies, these dependencies are the type that commonly have security vulnerabilities that get reported and patched. However the majority of these dependencies aren’t even used by node-pre-gyp. And node-pre-gyp is used all over the place.

In short, when you use security vulnerability checkers like snyk you continually get security vulnerability warnings introduced through node-pre-gyp for irrelevant security vulnerabilities, and request is the cause of many of these.