I noticed when running an `npm audit fix` that request has an open vulnerability is deprecated and not accepting security fixes anymore. While we don't use it directly, several of the packages in our dependency chain do. Looks like it still gets over 18M installs per week.