Replace deprecated request/request-promise with axios

request has been deprecated since 2020 with an unfixed SSRF advisory and
pins vulnerable copies of form-data (critical), qs, tough-cookie and
uuid - 8 of the 13 remaining production audit findings, none fixable by
version bumps (issue #1634, item 1).

All 36 backend files that imported request-promise now use a small
compatibility wrapper (server/utils/request.ts) backed by axios, which
is already a production dependency. The wrapper accepts the existing
options shape (qs, form - object or pre-encoded string, body,
baseUrl/uri, rejectUnauthorized, json), resolves with the response body
directly, and rejects with a plain object mirroring request-promise's
StatusCodeError/RequestError shape, so CommonService.handleError works
unchanged (ECONNREFUSED -> 503, Eclair StatusCodeError -> 500, nested
error body extraction). Auth headers are excluded from rejected errors
so they cannot leak into logs. Callers without json: true (block
explorer, currency rates) still get raw text bodies, and LND's
line-delimited /v2/router/send stream still surfaces as a string for
the existing parser.

Only behavioral code change: CLN verifyMessage used request-promise's
callback style and was ported to the same promise style as signMessage;
four Eclair handlers gained explicit returns to satisfy
noImplicitReturns once the import became typed.

Production npm audit drops from 13 findings (2 critical) to 6 low, all
in the crypto-browserify/elliptic chain tracked in #1634.

Verified against the docker regtest fixture with 43 API checks across
LND, Core Lightning and Eclair: reads, invoice creation, a routed LND
payment over the streaming endpoint, cross-implementation payments from
CLN and Eclair, message sign/verify, channel backup to disk, and
bad-invoice/node-unreachable error mapping. Lint and both production
builds are clean.

server/controllers/cln/channels.ts

@@ -1,4 +1,4 @@
-import request from 'request-promise';
+import request from '../../utils/request.js';
 import { Logger, LoggerService } from '../../utils/logger.js';
 import { Common, CommonService } from '../../utils/common.js';
 import { getAlias } from './network.js';

server/controllers/cln/getInfo.ts

@@ -1,4 +1,4 @@
-import request from 'request-promise';
+import request from '../../utils/request.js';
 import { Logger, LoggerService } from '../../utils/logger.js';
 import { Common, CommonService } from '../../utils/common.js';
 import { CLWSClient, CLWebSocketClient } from './webSocketClient.js';

server/controllers/cln/invoices.ts

@@ -1,4 +1,4 @@
-import request from 'request-promise';
+import request from '../../utils/request.js';
 import { Logger, LoggerService } from '../../utils/logger.js';
 import { Common, CommonService } from '../../utils/common.js';
 let options = null;

server/controllers/cln/network.ts

@@ -1,4 +1,4 @@
-import request from 'request-promise';
+import request from '../../utils/request.js';
 import { Logger, LoggerService } from '../../utils/logger.js';
 import { Common, CommonService } from '../../utils/common.js';
 import { SelectedNode } from '../../models/config.model.js';

server/controllers/cln/offers.ts

@@ -1,4 +1,4 @@
-import request from 'request-promise';
+import request from '../../utils/request.js';
 import { Logger, LoggerService } from '../../utils/logger.js';
 import { Common, CommonService } from '../../utils/common.js';
 import { Database, DatabaseService } from '../../utils/database.js';

server/controllers/cln/onchain.ts

@@ -1,4 +1,4 @@
-import request from 'request-promise';
+import request from '../../utils/request.js';
 import { Logger, LoggerService } from '../../utils/logger.js';
 import { Common, CommonService } from '../../utils/common.js';
 let options = null;

server/controllers/cln/payments.ts

@@ -1,4 +1,4 @@
-import request from 'request-promise';
+import request from '../../utils/request.js';
 import { Logger, LoggerService } from '../../utils/logger.js';
 import { Common, CommonService } from '../../utils/common.js';
 import { Database, DatabaseService } from '../../utils/database.js';

server/controllers/cln/peers.ts

@@ -1,4 +1,4 @@
-import request from 'request-promise';
+import request from '../../utils/request.js';
 import { Logger, LoggerService } from '../../utils/logger.js';
 import { Common, CommonService } from '../../utils/common.js';
 import { getAlias } from './network.js';

server/controllers/cln/utility.ts

@@ -1,4 +1,4 @@
-import request from 'request-promise';
+import request from '../../utils/request.js';
 import { Logger, LoggerService } from '../../utils/logger.js';
 import { Common, CommonService } from '../../utils/common.js';
 
@@ -42,7 +42,7 @@ export const verifyMessage = (req, res, next) => {
   if (options.error) { return res.status(options.statusCode).json({ message: options.message, error: options.error }); }
   options.url = req.session.selectedNode.settings.lnServerUrl + '/v1/checkmessage';
   options.body = req.body;
-  request.post(options, (error, response, body) => {
+  request.post(options).then((body) => {
     logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Message', msg: 'Message Verified', data: body });
     res.status(201).json(body);
   }).catch((errRes) => {

server/controllers/eclair/channels.ts

@@ -1,4 +1,4 @@
-import request from 'request-promise';
+import request from '../../utils/request.js';
 import { Logger, LoggerService } from '../../utils/logger.js';
 import { Common, CommonService } from '../../utils/common.js';
 import { SelectedNode } from '../../models/config.model.js';
@@ -68,7 +68,7 @@ export const getChannels = (req, res, next) => {
         });
       } else {
         logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Channels', msg: 'Empty Channels List Received' });
-        res.status(200).json([]);
+        return res.status(200).json([]);
       }
     }).
       catch((errRes) => {

server/controllers/eclair/fees.ts

@@ -1,4 +1,4 @@
-import request from 'request-promise';
+import request from '../../utils/request.js';
 import { Logger, LoggerService } from '../../utils/logger.js';
 import { Common, CommonService } from '../../utils/common.js';
 import { SelectedNode } from '../../models/config.model.js';

server/controllers/eclair/getInfo.ts

@@ -1,4 +1,4 @@
-import request from 'request-promise';
+import request from '../../utils/request.js';
 import { Logger, LoggerService } from '../../utils/logger.js';
 import { Common, CommonService } from '../../utils/common.js';
 import { ECLWSClient, ECLWebSocketClient } from './webSocketClient.js';

server/controllers/eclair/invoices.ts

@@ -1,4 +1,4 @@
-import request from 'request-promise';
+import request from '../../utils/request.js';
 import { Logger, LoggerService } from '../../utils/logger.js';
 import { Common, CommonService } from '../../utils/common.js';
 import { SelectedNode } from '../../models/config.model.js';

server/controllers/eclair/network.ts

@@ -1,4 +1,4 @@
-import request from 'request-promise';
+import request from '../../utils/request.js';
 import { Logger, LoggerService } from '../../utils/logger.js';
 import { Common, CommonService } from '../../utils/common.js';
 import { SelectedNode } from '../../models/config.model.js';

server/controllers/eclair/onchain.ts

@@ -1,4 +1,4 @@
-import request from 'request-promise';
+import request from '../../utils/request.js';
 import { Logger, LoggerService } from '../../utils/logger.js';
 import { Common, CommonService } from '../../utils/common.js';
 let options = null;

server/controllers/eclair/payments.ts

@@ -1,4 +1,4 @@
-import request from 'request-promise';
+import request from '../../utils/request.js';
 import { Logger, LoggerService } from '../../utils/logger.js';
 import { Common, CommonService } from '../../utils/common.js';
 import { SelectedNode } from '../../models/config.model.js';
@@ -89,7 +89,7 @@ export const queryPaymentRoute = (req, res, next) => {
       });
     } else {
       logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Payments', msg: 'Empty Payment Route Information Received' });
-      res.status(200).json({ routes: [] });
+      return res.status(200).json({ routes: [] });
     }
   }).catch((errRes) => {
     const err = common.handleError(errRes, 'Payments', 'Query Route Error', req.session.selectedNode);

server/controllers/eclair/peers.ts

@@ -1,4 +1,4 @@
-import request from 'request-promise';
+import request from '../../utils/request.js';
 import { Logger, LoggerService } from '../../utils/logger.js';
 import { Common, CommonService } from '../../utils/common.js';
 import { SelectedNode } from '../../models/config.model.js';
@@ -42,7 +42,7 @@ export const getPeers = (req, res, next) => {
         });
       } else {
         logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Peers', msg: 'Empty Peers Received' });
-        res.status(200).json([]);
+        return res.status(200).json([]);
       }
     }).
       catch((errRes) => {
@@ -91,7 +91,7 @@ export const connectPeer = (req, res, next) => {
           res.status(201).json(peers);
         });
       } else {
-        res.status(201).json([]);
+        return res.status(201).json([]);
       }
     }).catch((errRes) => {
       const err = common.handleError(errRes, 'Peers', 'Connect Peer Error', req.session.selectedNode);

server/controllers/lnd/balance.ts

@@ -1,4 +1,4 @@
-import request from 'request-promise';
+import request from '../../utils/request.js';
 import { Logger, LoggerService } from '../../utils/logger.js';
 import { Common, CommonService } from '../../utils/common.js';
 let options = null;

server/controllers/lnd/channels.ts

@@ -1,4 +1,4 @@
-import request from 'request-promise';
+import request from '../../utils/request.js';
 import { Logger, LoggerService } from '../../utils/logger.js';
 import { Common, CommonService } from '../../utils/common.js';
 import { SelectedNode } from '../../models/config.model.js';

server/controllers/lnd/channelsBackup.ts

@@ -1,6 +1,6 @@
 import * as fs from 'fs';
 import { sep } from 'path';
-import request from 'request-promise';
+import request from '../../utils/request.js';
 import { Logger, LoggerService } from '../../utils/logger.js';
 import { Common, CommonService } from '../../utils/common.js';
 let options = null;

server/controllers/lnd/fees.ts

@@ -1,4 +1,4 @@
-import request from 'request-promise';
+import request from '../../utils/request.js';
 import { Logger, LoggerService } from '../../utils/logger.js';
 import { Common, CommonService } from '../../utils/common.js';
 import { getAllForwardingEvents } from './switch.js';

server/controllers/lnd/getInfo.ts

@@ -1,4 +1,4 @@
-import request from 'request-promise';
+import request from '../../utils/request.js';
 import { Logger, LoggerService } from '../../utils/logger.js';
 import { Common, CommonService } from '../../utils/common.js';
 import { LNDWSClient, LNDWebSocketClient } from './webSocketClient.js';

server/controllers/lnd/graph.ts

@@ -1,4 +1,4 @@
-import request from 'request-promise';
+import request from '../../utils/request.js';
 import { Logger, LoggerService } from '../../utils/logger.js';
 import { Common, CommonService } from '../../utils/common.js';
 import { SelectedNode } from '../../models/config.model.js';

server/controllers/lnd/invoices.ts

@@ -1,4 +1,4 @@
-import request from 'request-promise';
+import request from '../../utils/request.js';
 import { Logger, LoggerService } from '../../utils/logger.js';
 import { Common, CommonService } from '../../utils/common.js';
 import { LNDWSClient, LNDWebSocketClient } from './webSocketClient.js';

server/controllers/lnd/message.ts

@@ -1,4 +1,4 @@
-import request from 'request-promise';
+import request from '../../utils/request.js';
 import { Logger, LoggerService } from '../../utils/logger.js';
 import { Common, CommonService } from '../../utils/common.js';
 let options = null;

server/controllers/lnd/newAddress.ts

@@ -1,4 +1,4 @@
-import request from 'request-promise';
+import request from '../../utils/request.js';
 import { Logger, LoggerService } from '../../utils/logger.js';
 import { Common, CommonService } from '../../utils/common.js';
 let options = null;

server/controllers/lnd/payments.ts

@@ -1,4 +1,4 @@
-import request from 'request-promise';
+import request from '../../utils/request.js';
 import { Logger, LoggerService } from '../../utils/logger.js';
 import { Common, CommonService } from '../../utils/common.js';
 import { SelectedNode } from '../../models/config.model.js';

server/controllers/lnd/peers.ts

@@ -1,4 +1,4 @@
-import request from 'request-promise';
+import request from '../../utils/request.js';
 import { Logger, LoggerService } from '../../utils/logger.js';
 import { Common, CommonService } from '../../utils/common.js';
 import { SelectedNode } from '../../models/config.model.js';

server/controllers/lnd/switch.ts

@@ -1,4 +1,4 @@
-import request from 'request-promise';
+import request from '../../utils/request.js';
 import { Logger, LoggerService } from '../../utils/logger.js';
 import { Common, CommonService } from '../../utils/common.js';
 let options = null;

server/controllers/lnd/transactions.ts

@@ -1,4 +1,4 @@
-import request from 'request-promise';
+import request from '../../utils/request.js';
 import { Logger, LoggerService } from '../../utils/logger.js';
 import { Common, CommonService } from '../../utils/common.js';
 let options = null;

server/controllers/lnd/wallet.ts

@@ -1,5 +1,5 @@
 import atob from 'atob';
-import request from 'request-promise';
+import request from '../../utils/request.js';
 import { Logger, LoggerService } from '../../utils/logger.js';
 import { Common, CommonService } from '../../utils/common.js';
 let options = null;

server/controllers/lnd/webSocketClient.ts

@@ -1,4 +1,4 @@
-import request from 'request-promise';
+import request from '../../utils/request.js';
 import * as fs from 'fs';
 import { join } from 'path';
 

server/controllers/shared/RTLConf.ts

@@ -3,7 +3,7 @@ import * as fs from 'fs';
 import { sep } from 'path';
 import ini from 'ini';
 import parseHocon from 'hocon-parser';
-import request from 'request-promise';
+import request from '../../utils/request.js';
 import { Database, DatabaseService } from '../../utils/database.js';
 import { Logger, LoggerService } from '../../utils/logger.js';
 import { Common, CommonService } from '../../utils/common.js';

server/controllers/shared/boltz.ts

@@ -1,4 +1,4 @@
-import request from 'request-promise';
+import request from '../../utils/request.js';
 import { Logger, LoggerService } from '../../utils/logger.js';
 import { Common, CommonService } from '../../utils/common.js';
 let options = null;

server/controllers/shared/loop.ts

@@ -1,4 +1,4 @@
-import request from 'request-promise';
+import request from '../../utils/request.js';
 import { Logger, LoggerService } from '../../utils/logger.js';
 import { Common, CommonService } from '../../utils/common.js';
 let options = null;

server/utils/common.ts

@@ -2,7 +2,7 @@ import * as fs from 'fs';
 import { join, dirname, isAbsolute, resolve, sep } from 'path';
 import { fileURLToPath } from 'url';
 import * as crypto from 'crypto';
-import request from 'request-promise';
+import request from './request.js';
 import { Logger, LoggerService } from './logger.js';
 import { ApplicationConfig, SelectedNode } from '../models/config.model.js';
 

server/utils/request.ts

@@ -0,0 +1,77 @@
+import axios from 'axios';
+import * as https from 'https';
+
+// Drop-in replacement for the deprecated request-promise, backed by axios.
+// Accepts the same options shape used across the controllers ({ url, baseUrl,
+// uri, qs, form, body, headers, rejectUnauthorized, json }), resolves with the
+// response body directly and rejects with a plain, serializable object that
+// mirrors request-promise's StatusCodeError/RequestError shape expected by
+// CommonService.handleError. Auth headers are intentionally excluded from the
+// rejected error so they can never leak into logs or API error responses.
+
+const insecureAgent = new https.Agent({ rejectUnauthorized: false });
+
+const buildConfig = (options, method: string) => {
+  const config: any = {
+    url: options.url && options.url !== '' ? options.url : options.uri,
+    method: method || options.method || 'GET',
+    headers: options.headers ? { ...options.headers } : {}
+  };
+  if (options.baseUrl) { config.baseURL = options.baseUrl; }
+  if (options.qs && Object.keys(options.qs).length > 0) { config.params = options.qs; }
+  if (options.rejectUnauthorized === false) { config.httpsAgent = insecureAgent; }
+  if (options.form !== null && options.form !== undefined) {
+    if (typeof options.form === 'string') {
+      // Pre-encoded (or raw JSON string for LND's wallet endpoints), send as-is.
+      config.data = options.form;
+    } else {
+      const params = new URLSearchParams();
+      Object.entries(options.form).forEach(([key, value]) => {
+        if (value !== null && value !== undefined) { params.append(key, String(value)); }
+      });
+      config.data = params;
+    }
+    config.headers['Content-Type'] = 'application/x-www-form-urlencoded';
+  } else if (options.body !== null && options.body !== undefined) {
+    config.data = options.body;
+  }
+  if (options.json !== true) {
+    // Callers without json: true (block explorer, currency rates) JSON.parse the body themselves.
+    config.responseType = 'text';
+    config.transformResponse = [(data) => data];
+  }
+  return config;
+};
+
+const toRequestPromiseError = (err, config) => {
+  const errOptions = { url: config.url, method: config.method };
+  if (err.response) {
+    return {
+      name: 'StatusCodeError',
+      statusCode: err.response.status,
+      message: err.response.status + ' - ' + JSON.stringify(err.response.data),
+      error: err.response.data,
+      options: errOptions
+    };
+  }
+  const message = err.message && err.message !== '' ? err.message : err.code;
+  return {
+    name: 'RequestError',
+    message: message,
+    error: { code: err.code, message: message },
+    options: errOptions
+  };
+};
+
+const call = (options, method?: string) => {
+  const config = buildConfig(options, method);
+  return axios.request(config).then((response) => response.data).catch((err) => Promise.reject(toRequestPromiseError(err, config)));
+};
+
+const request = (options) => call(options);
+request.get = (options) => call(options, 'GET');
+request.post = (options) => call(options, 'POST');
+request.put = (options) => call(options, 'PUT');
+request.delete = (options) => call(options, 'DELETE');
+
+export default request;