Migrating Away from the Deprecated request Library Is Harder Than Swapping Calls

The author, who maintains the request-to-axios wrapper, argues that replacing the deprecated request library in Node.js is harder than a simple one-line change because of the assumptions built around it. Callback signatures, streaming, form data, cookies, default headers, and tests relying on response formats all complicate a direct rewrite. An audit of request@2.88.2 showed several vulnerable transitive dependencies, including advisories on SSRF bypass, multipart boundary generation, CRLF injection, and prototype pollution, though exploitability depends on how an application uses them. The article recommends inventorying real usage, adding characterization tests, replacing the transport incrementally, and handling edge cases separately, with an npm alias offered as a gradual trial path.