Skip to content

[9.3] chore(axios,security-generative-ai) Remove axios dependency in favor … (#266771)#267467

Merged
kibanamachine merged 1 commit intoelastic:9.3from
kibanamachine:backport/9.3/pr-266771
May 4, 2026
Merged

[9.3] chore(axios,security-generative-ai) Remove axios dependency in favor … (#266771)#267467
kibanamachine merged 1 commit intoelastic:9.3from
kibanamachine:backport/9.3/pr-266771

Conversation

@kibanamachine
Copy link
Copy Markdown
Contributor

Backport

This will backport the following commits from main to 9.3:

Questions ?

Please refer to the Backport tool documentation

elastic#266771)

## Summary

This PR removes the `axios` dependency for files owned by
`@elastic/security-generative-ai`. Phase 1.1 of the axios migration
tracked under elastic#266556.

### Why

Node.js 22 ships a native `fetch` API built on undici, and every browser
Kibana targets supports `fetch` natively. Removing axios cuts one
runtime dependency and continues the per-team rollout that mirrors the
earlier node-fetch migration
([elastic#250719](elastic#250719) and siblings).

### Changes

- Migrated `create_conversations_script.ts` (a developer seed script
fetching the connector list) from `axios.get` to `fetch`.
- Migrated `create_and_login_users.js` (a developer script that creates
test users via the Elasticsearch security API) from `axios.get` /
`axios.put` to `fetch`. Three call sites: role lookup, role create, user
create. Basic auth was previously passed via axios's `auth: { username,
password }` option; native fetch strips `user:pass@` URL credentials, so
it now goes through an `Authorization: Basic <base64>` header.
- Removed the entire
`x-pack/solutions/security/plugins/elastic_assistant/scripts/` entry
from `AXIOS_LEGACY_CONSUMERS` in `.eslintrc.js`. New axios usage
anywhere in this directory is now blocked by the existing global ban.

### Behavior parity

Native fetch does not throw on non-2xx, so each call site explicitly
checks `res.ok` / `res.status`. The previous status-based branches (404
fall-through on role check, 409 informational on user create) are
preserved with the same logging and `return err` shape. The diff is
intentionally minimal: variable names, comment placement, try-catch
structure, and error-return semantics from the original axios code are
kept.

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
(cherry picked from commit 0643d49)
@kibanamachine kibanamachine added the backport This PR is a backport of another PR label May 4, 2026
@kibanamachine kibanamachine enabled auto-merge (squash) May 4, 2026 12:18
@kibanamachine
Copy link
Copy Markdown
Contributor Author

💚 Build Succeeded

Metrics [docs]

✅ unchanged

cc @azasypkin

@kibanamachine kibanamachine merged commit 1c1c87b into elastic:9.3 May 4, 2026
24 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport This PR is a backport of another PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants