- Upgrade to matrix-js-sdk 34.11.1 to fix CVE-2024-50336

- Remove request package (no longer needed)

package.json

@@ -9,12 +9,11 @@
     "got": "^12.0.2",
     "image-size": "^1.0.2",
     "isomorphic-webcrypto": "^2.3.8",
-    "matrix-js-sdk": "^28.0.0",
+    "matrix-js-sdk": "34.11.1",
     "mime": "^3.0.0",
     "node-fetch": "^3.3.0",
     "node-localstorage": "^2.2.1",
     "olm": "https://gitlab.matrix.org/matrix-org/olm/-/package_files/2572/download",
-    "request": "^2.88.2",
     "sharp": "^0.33.4",
     "tmp": "^0.2.1",
     "utf8": "^3.0.0"

src/matrix-server-config.js

@@ -7,7 +7,6 @@ const { resolve } = require('path');
 const { LocalStorage } = require('node-localstorage');
 const { LocalStorageCryptoStore } = require('matrix-js-sdk/lib/crypto/store/localStorage-crypto-store');
 const {RoomEvent, RoomMemberEvent, HttpApiEvent, ClientEvent, MemoryStore} = require("matrix-js-sdk");
-const request = require("request");
 require("abort-controller/polyfill"); // polyfill abort-controller if we don't have it
 if (!globalThis.fetch) {
     // polyfill fetch if we don't have it
@@ -153,8 +152,7 @@ module.exports = function(RED) {
                     localStorage: localStorage,
                 }),
                 userId: this.userId,
-                deviceId: (this.deviceId || getStoredDeviceId(localStorage)) || undefined,
-                request
+                deviceId: (this.deviceId || getStoredDeviceId(localStorage)) || undefined
                 // verificationMethods: ["m.sas.v1"]
             });
 
@@ -479,8 +477,7 @@ module.exports = function(RED) {
                 baseUrl: baseUrl,
                 deviceId: deviceId,
                 timelineSupport: true,
-                localTimeoutMs: '30000',
-                request
+                localTimeoutMs: '30000'
             });
 
             new TimelineWindow()