fix(deps): drop unused request via node-ninja/nw-gyp aliases (Dependabot 38)

[TimelordUK]

Closes Dependabot alert 38 — GHSA-p8p7-x288-28g6, SSRF in request <=2.88.2 (moderate).

Why not just upgrade

request was deprecated in 2020, 2.88.2 is the final release, and the advisory has no patched version. npm audit's suggested fix is a semver-major downgrade of prebuild 13 → 3.0.3, which is not viable.

Where it came from

request is not referenced anywhere in this repo — not in lib/, test/, or samples/. It arrives purely as a dev-only transitive dependency:

prebuild@13.0.1  (devDependency)
├─ node-ninja@1.0.2 → request@2.88.2
└─ nw-gyp@3.6.8    → request@2.88.2 (deduped)

Both are alternative gyp backends we never invoke. node-ninja requires --backend node-ninja; nw-gyp only engages for -r nw (prebuild.js:18). Our workflows run npx prebuild --strip and npx prebuild -r electron, both of which use the plain node-gyp backend.

The fix

They can't simply be dropped — prebuild/gyp.js:6-8 requires all three backends eagerly at module load. node-gyp exports the same require(...)() factory shape, so aliasing both to it keeps gyp.js loading while removing the request subtree entirely:

"node-ninja": "npm:node-gyp@^12",
"nw-gyp": "npm:node-gyp@^12"

Net effect on the lockfile: -951 lines.

Verification

check	before	after
npm ls request	request@2.88.2 ×2	empty
npm audit	4 moderate	0 vulnerabilities
npx prebuild --version	13.0.1	13.0.1
prebuild/gyp.js loads	✓	✓
backends expose parseArgv/commands	✓	✓

The aliases resolve to node-gyp@12.4.0 under node_modules/prebuild/node_modules/ (not hoisted), which is where gyp.js resolves them from.

This does not touch the cd node_modules/prebuild && npm install --no-save node-gyp@^13 ABI-refresh step in prebuild.yml — that targets prebuild's own bundled node-gyp (10.3.1), which is independent of the aliased backends.

Testing note

The lockfile was regenerated with npm install --ignore-scripts, so the native addon was not rebuilt locally. A manual workflow_dispatch run of Prebuild Binaries is the meaningful confirmation that npx prebuild --strip still produces artifacts with the aliases in place.

🤖 Generated with Claude Code