Migrate away from request package

The request module is now fully deprecated and will no longer receive any fixes.

Its latest published version, 2.88.2, adds a deprecation warning whenever it is npm-installed. On that basis, we’ll stick on 2.88.0 for the time being otherwise we’ll get needless issues from our end-users.

But it does mean we need a plan to migrate off the request package to something else. I don’t yet know what that will be, but this issue gives a good list of potential alternatives: https://github.com/request/request/issues/3143

For more info on the deprecation of request, refer to this issue: https://github.com/request/request/issues/3142

[boisei0]

If we can get a better sense of the true impact of the agent-base issue, that would be helpful.

If my neck will stay cooperative for the rest of the evening, I think I can put together a quick prototype to figure out which/how many nodes would be affected by a move to got. My neck is a big if, just like how I haven’t programmed anything beyond a couple lines in JavaScript in months. But this sounds doable.

[knolleary]

So we have shipped this and sure enough, had a couple reports of issues thanks to old levels of agent-base.

I am adding some code to the request node that detects the patched module and restores the original code. It then displays this warning:

---------------------------------------------------------------------
Patched https.request function detected. Restoring original code.
This is likely caused by the 'agent-base@<5.0.0' module that has
been installed as a dependency of a contrib node.

You can identify what node is at fault by running:
   npm list agent-base
in your Node-RED user directory (/Users/nol/.node-red)
---------------------------------------------------------------------

(the user dir is inserted dynamically…)

That should keep the core working and help nail down the modules that need updating.