Stop using request

[LiFaytheGoblin]

Request has a known vulnerability (GHSA-p8p7-x288-28g6) and is deprecated besides (https://www.npmjs.com/package/request). However, it appears that this is still a dependency used by brevo. Maybe consider migrating away from request.

[milo-]

Some more info here @LiFaytheGoblin #16

Hopefully @shubhamUpadhyayInBlue will be able get this resolved soon 🤞

[bolds07]

@LiFaytheGoblin there is no need to use this api AT ALL

this api is just the most messed up wrapper i've seen in my life... you can go to brevo's website and look at all curls requests they have
then build up your own api with whatever http client you prefer... all you need is to follow their data model and endpoints

really i did it and in 5 minutes i acomplished what i wanted... much easier than use this dumbass api

[shanehoban]

For the lazy, this is specific to transactional emails:

'use server'

import 'server-only'

/*
  type StandardResponse = {
    success: boolean
    message: string
  }
*/
import { StandardResponse } from '@/types/request-response'

export default async function SendBrevoEmail({
  toEmail,
  bccEmail,
  emailSubject,
  emailHtmlBody,
}: {
  toEmail: string
  bccEmail?: string
  emailSubject: string
  emailHtmlBody: string
}): Promise<StandardResponse> {
  const brevoApiEndpoint = 'https://api.brevo.com/v3/smtp/email'

  const brevoApiKey = process.env.BREVO_API_KEY

  const emailData = {
    sender: {
      name: 'Sender Name', // Replace with your sender name or keep as placeholder
      email: 'sender@example.com', // Replace with your sender email or keep as placeholder
    },
    to: [
      {
        email: toEmail,
      },
    ],
    bcc: bccEmail ? [{ email: bccEmail }] : undefined,
    subject: emailSubject,
    htmlContent: emailHtmlBody,
  }

  if (brevoApiKey) {
    try {
      const response = await fetch(brevoApiEndpoint, {
        method: 'POST',
        headers: {
          accept: 'application/json',
          'api-key': brevoApiKey,
          'content-type': 'application/json',
        },
        body: JSON.stringify(emailData),
      })

      if (!response.ok) {
        throw new Error(`HTTP error! status: ${response.status}`)
      }

      return {
        success: true,
        message: 'Email sent',
      }
    } catch (error) {
      return {
        success: false,
        message:
          'Error sending email: ' +
          (error instanceof Error ? error.message : String(error)),
      }
    }
  } else {
    return {
      success: false,
      message: 'No Brevo API key found',
    }
  }
}

[evolross]

Definitely considering rolling my own too. I love that I just updated the "deprecated" sib-api-v3-sdk to @getbrevo/brevo (which was last published 13 days ago) and it has more npm vulnerabilities than sib-api-v3-sdk! It's a mad world over at Brevo.