PatchVault › Errors › request → native fetch

npm warn deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142

You want to replace the deprecated request package. Node.js ships a global fetch(), so most request calls can move to a built-in API with no new dependency.

Check your code free (runs in your browser)

The box is pre-filled with a sample that triggers this error. Paste your own file to check it. Nothing leaves this page.

Or scan your whole repo locally (free, stdlib Python, read-only):

python3 <(curl -fsSL https://patchvault-81y.pages.dev/starters/request-fetch-scan.py) .

Why it happens

request was deprecated in February 2020 (issue #3142) and receives no fixes. fetch() is a global in current Node.js releases, but its options differ: no json:true, no timeout option (use AbortSignal.timeout), and an explicit Authorization header instead of auth:.

Manual fix

// before
const request = require('request')
request({ url, json: true, timeout: 5000 }, (err, res, body) => { ... })
// after
const res = await fetch(url, { signal: AbortSignal.timeout(5000) })
const body = await res.json()

Verify

Re-run your install/build and re-scan the file above. The finding should be gone. The paid fixer applies the same change across a repo: --dry-run shows the diff, --apply keeps a .bak of each file, and --rollback restores them.

Sources

• request/request issue #3142: request's past, present and future
• Node.js docs: global fetch

Related errors

• npm WARN deprecated request@2.88.2: how to fix
• request-promise deprecated: replace with fetch
• npm audit: SSRF in request (CVE-2023-28155) fix
• npm WARN deprecated har-validator@5.1.5: fix

Full guide and free terminal scanner: request → native fetch. Last checked 2026-10-31.