Replace outdated request dependency that introduces critical vulnerability in json-schema (CVE-2021-3918)

[gustaff-weldon]

Describe the bug
This client depends on no longer maintained request dependency.

The path to upgrade was described in request/request#3142

This client is linked from Officially-supported Kubernetes client libraries page and as such will be widely used by developers who unknowingly will introduce vulnerability.

request brings in a dependency chain with json-schema with a critical vulnerability reported:

** Client Version **
0.16.3

To Reproduce

• yarn init
• yarn add @kubernetes/client-node
• yarn why json-schema -R

Expected behavior
No dependency on vulnerable json-schema version < 0.4.0

Environment (please complete the following information):
Any

Additional context
Github advisory entry for json-schema:
CVE-2021-3918 (GHSA-896r-f27r-55mw)

[Timothy-Dement]

This looks like it will resolve the following warnings:

> $ npm install @kubernetes/client-node
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142

• request > har-validator
• request > uuid

Although uuid is also listed under:

• nyc > istanbul-lib-processinfo
• istanbul-lib-processinfo > uuid

So that warning may require additional package updates to fully resolve.

[brendandburns]

This is a duplicate of #414 there is a long discussion there.

Additionally there is documentation for the migration path here:
https://github.com/kubernetes-client/javascript/blob/master/FETCH_MIGRATION.md

The fetch migration has slowed because this is a community supported project. If someone wants to help with the migration, we would be very happy to have the help.

Thanks!

[gustaff-weldon]

@brendandburns that discussion is over 2 years old and looks to be stalled.
At this stage, this client should not be a recommended one anymore as it introduces critical security errors.

What is your recommendation for people who need to use Kubernetes API from Node?