Skip to content

[NFC] Remove @devhigley/parse-proxy as a dependency#385

Open
pnappa wants to merge 1 commit intodocusign:masterfrom
pnappa:pnappa-remove-devhigley
Open

[NFC] Remove @devhigley/parse-proxy as a dependency#385
pnappa wants to merge 1 commit intodocusign:masterfrom
pnappa:pnappa-remove-devhigley

Conversation

@pnappa
Copy link
Copy Markdown

@pnappa pnappa commented May 1, 2026

This is a random package written by someone, which serves as a risk for supply chain integrity. There is no trusted publishing established for this package, so there's a high risk that it could be taken over & cause an attack against all your consumers.

The package isn't very well written, and has some bad handling for cases which are likely to be brought up. The behaviour can be fully implemented using builtins.

For example, localhost:8000 throws, which is a fairly common path to handling proxies, whilst IPv6 support is also non-existent (e.g. http://[::1]:8080 throws).

This is a random package written by someone, which serves as a risk for
supply chain integrity. There is no trusted publishing established for
this package, so there's a high risk that it could be taken over & cause
an attack against all your consumers.

The package isn't very well written, and has some bad handling for cases
which are likely to be brought up. The behaviour can be fully
implemented using builtins.

For example, `localhost:8000` throws, which is a fairly common path to
handling proxies, whilst IPv6 support is also non-existent (e.g.
http://[::1]:8080 throws).
@pnappa
Copy link
Copy Markdown
Author

pnappa commented May 1, 2026

As an aside, literally the only public dependencies of this package are other docusign packages, so I assume it's prudent to go and remove them from the other packages too? Ideally the signature for the docusign client would accept proxy options similar to what axios accepts, but this would be a breaking change, so I decided on keeping the string based proxy definition.

@pnappa
Copy link
Copy Markdown
Author

pnappa commented May 1, 2026

Another important note is that there's a few other dependencies which could be taken out:

  • csv-stringify is not even used at all, it only exists in commented out code (in test/, which means it should be a devDependency WHEN it's used).
  • safe-buffer is not needed, as it's only ever referenced in var Buffer = global.Buffer.from ? global.Buffer : require('safe-buffer').Buffer;, which is impossible, as this library requires Node v12+ (Buffer.from was added in ~v8)
  • I believe passport-oauth2 is unused in practice, I haven't done a deep enough audit for it, but it seems sus

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant