sendinblue/APIv3-typescript-library

Dependency update: 2 moderate severity vulnerabilities

Closed this issue · 7 comments

acomanescu commented

Are you planning to replace "request" with "fetch" (now available in Node.js by default)

# npm audit report

request  *
Severity: moderate
Server-Side Request Forgery in Request - https://github.com/advisories/GHSA-p8p7-x288-28g6
No fix available
node_modules/request
  @sendinblue/client  *
  Depends on vulnerable versions of request
  node_modules/@sendinblue/client

2 moderate severity vulnerabilities

Some issues need review, and may require choosing
a different dependency.
Charlygraphy23 commented

request package can be converted to node-fetch or axios. team you can assign to me for this task

shivpratik commented

Please fix this issue.

alfaproject commented

Honestly guys, if this package is not maintained just let us know so we can build our own bindings

  • 👍1
psychonetic commented

When can we expect to get the PR merged?

Charlygraphy23 commented

Using now Brevo commercially, it seems important to me to remove the deprecated lib.

Hey @psychonetic please use Brevo. This is going to be deprecated.

  • 👍1
alfaproject commented

Is there a new Brevo SDK now?

psychonetic commented

@alfaproject
Yes: https://github.com/getbrevo/brevo-node

Typescript is not fully supported yet and it seems like there are also issues with attachments.
So not really production ready. Hope they will manage to update the SDK soon.

  • 👍1