PatchVault › Errors › request → native fetch

npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142

npm warns because request (2.88.2, the final release) is deprecated. The warning appears whether you depend on it directly or a dependency pulls it in.

Check your code free (runs in your browser)

The box is pre-filled with a sample that triggers this error. Paste your own file to check it. Nothing leaves this page.

Or scan your whole repo locally (free, stdlib Python, read-only):

python3 <(curl -fsSL https://patchvault-81y.pages.dev/starters/request-fetch-scan.py) .
Get the request → native fetch auto-fixer: $9 one-time

Why it happens

request has been unmaintained since 2020, and versions ≤ 2.88.2 are affected by CVE-2023-28155. For direct use, replace it with native fetch (Node 18+). For transitive use, run `npm ls request` to find the parent and upgrade it.

Manual fix

npm ls request          # who pulls it in?

// direct use: native fetch
const res = await fetch(url, { headers: { accept: 'application/json' } })
if (!res.ok) throw new Error(`HTTP ${res.status}`)
const data = await res.json()

Verify

Re-run your install/build and re-scan the file above. The finding should be gone. The paid fixer applies the same change across a repo: --dry-run shows the diff, --apply keeps a .bak of each file, and --rollback restores them.

Sources

Related errors

Full guide and free terminal scanner: request → native fetch. Last checked 2026-10-31.