Skip to content

chore(deps): replace deprecated har-validator - #28

Closed
alexandroit wants to merge 1 commit into
httptoolkit:mainfrom
alexandroit:chore/replace-har-validator
Closed

chore(deps): replace deprecated har-validator#28
alexandroit wants to merge 1 commit into
httptoolkit:mainfrom
alexandroit:chore/replace-har-validator

Conversation

@alexandroit

Copy link
Copy Markdown

Summary

HTTPSnippet currently validates each input through
require('har-validator/lib/async'), while the upstream npm package is
deprecated as unsupported.

This changes only the dependency resolution:

"har-validator": "npm:@stackline/har-validator@1.0.0"

The legacy package name and existing source import remain unchanged. The exact
version pin also keeps the migration deterministic.

Because HTTPSnippet prepares requests immediately after the validator
callback, I separately verified that the replacement preserves synchronous,
exactly-once callback behavior across every request fixture and a 1,000-call
stress run.

Verification

  • npm ci
  • npm test: 1,667 passing; existing skipped tests unchanged
  • npm run pretest: Standard and Echint pass
  • npm pack --dry-run
  • Deep callback smoke: 18 validator exports, 19 request fixtures, multi-entry
    conversion, Promise validation, and invalid HARError behavior
  • npm audit --omit=dev: zero vulnerabilities

Disclosure

I maintain @stackline/har-validator, the replacement proposed here. It is an
independent MIT-licensed compatibility continuation and is not affiliated with
or endorsed by the original har-validator maintainers.

Package: https://www.npmjs.com/package/@stackline/har-validator
Source: https://github.com/alexandroit/stackline-har-validator

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Added@​stackline/​har-validator@​1.0.0791009386100

View full report

@pimterry

Copy link
Copy Markdown
Member

I'd rather not, sorry. Apart from the deprecation warning har-validator works fine, and shifting from a heavily used mature package to a brand new one creates more risk & hassle than upside.

@pimterry pimterry closed this Aug 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants