Skip to content

[8.19] chore(axios,security-solution): remove axios from telemetry/role scripts (#267944)#268475

Merged
kibanamachine merged 1 commit intoelastic:8.19from
kibanamachine:backport/8.19/pr-267944
May 8, 2026
Merged

[8.19] chore(axios,security-solution): remove axios from telemetry/role scripts (#267944)#268475
kibanamachine merged 1 commit intoelastic:8.19from
kibanamachine:backport/8.19/pr-267944

Conversation

@kibanamachine
Copy link
Copy Markdown
Contributor

Backport

This will backport the following commits from main to 8.19:

Questions ?

Please refer to the Backport tool documentation

…pts (elastic#267944)

## Summary

> [!IMPORTANT]
> **NOTE TO CODE OWNERS:** I'm modifying code I don't own day to day.
Please verify the changes still work as expected. For these migrations a
quick run of the affected scripts/tests is worth more than a code-only
review.

This PR removes the `axios` dependency for files owned by
`@elastic/security-solution`. Phase 4 of the axios migration tracked
under elastic#266556.

### Why

Node.js 22 ships a native `fetch` API built on undici, and every browser
Kibana targets supports `fetch` natively. Removing axios cuts one
runtime dependency and continues the per-team rollout that mirrors the
earlier node-fetch migration
([elastic#250719](elastic#250719) and siblings).

### Changes

Three files migrated, two files **deferred to a later phase**:

- `scripts/telemetry/build_ebt_data_view.ts`: 1 axios.get + 1 axios.put.
Replaced with `fetch`, `res.ok` check, and typed `await res.json()` for
the data-view fetch.
- `scripts/telemetry/build_ebt_data_view.test.ts`: was mocking
`axios.put` for `upsertRuntimeFields`. Switched to `jest.spyOn(global,
'fetch')`. The 16 existing test cases pass unchanged in intent:
name/type/url assertions adapted to read the `fetch(url, init)` argument
shape (`init.body` is now `JSON.stringify(payload)` rather than the
third axios arg). Header equality and dotted-name handling assertions
unchanged.
-
`server/lib/detection_engine/scripts/roles_users/create_role_and_user.ts`:
2 axios.put calls. Replaced with `fetch` and an explicit non-2xx throw
that preserves status+body in the error message.

Removed the `scripts/telemetry/**` and
`server/lib/detection_engine/scripts/**` entries from
`AXIOS_LEGACY_CONSUMERS` in `.eslintrc.js`. New axios usage in either of
those directories is now blocked by the existing global ban.

**Deferred to a later phase**:
`server/integration_tests/configuration.test.ts` and
`server/integration_tests/telemetry.test.ts` mock `axios` at the module
level for code under `server/lib/telemetry/*`, which is owned by
`@elastic/security-data-analytics` and not yet migrated. Test mocks must
flip in lockstep with the production code they intercept; these two
tests will migrate alongside that team's PR.

### Behavior parity

Native fetch does not throw on non-2xx, so each call site explicitly
checks `res.ok` / `res.status`. Errors thrown inside the migrated
scripts now have the form `${status}:${body}` to keep the same
diagnostic content the original axios errors carried. The diff is
intentionally minimal: variable names, comment placement, try-catch
structure, and error-handling shape from the original axios code are
preserved.

(cherry picked from commit 312e26c)
@kibanamachine kibanamachine added the backport This PR is a backport of another PR label May 8, 2026
@kibanamachine kibanamachine enabled auto-merge (squash) May 8, 2026 15:03
@kibanamachine
Copy link
Copy Markdown
Contributor Author

💚 Build Succeeded

Metrics [docs]

✅ unchanged

cc @azasypkin

@kibanamachine kibanamachine merged commit dd49c1a into elastic:8.19 May 8, 2026
30 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport This PR is a backport of another PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants