solovevayaroslavna opened a new issue, #314: URL: https://github.com/apache/casbin-casbin.js/issues/314
## Summary Casbin.js is positioned as a frontend/browser authorization library, but it currently depends on `axios@^0.21.1`. In our project, the current axios dependency chain triggers security scanners (like Snyk). Since Casbin.js appears to use axios only for a simple GET request in auto mode, this dependency may be removable entirely in favor of native `fetch`. ## Why this would help - removes an old and security-sensitive dependency - reduces dependency maintenance burden - lowers bundle size for a browser-focused package - better aligns Casbin.js with modern browser and Node.js runtimes - avoids downstream consumers having to patch or override axios-related vulnerabilities ## Proposed change From what I can see, Casbin.js uses axios only to fetch permission data from the configured backend endpoint in auto mode. The usage appears to be relatively simple: - one GET request - optional request headers - response body parsing Because of that, replacing axios with `fetch` looks low-risk. ## Notes This seems reasonable that the package already targets modern runtimes and is explicitly frontend-oriented. If this change is welcome, I’d be happy to help with a PR 🤗 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
