Find a replacement for `download` package

[garg3133]

The download package is no longer supported and there are a lot of vulnerabilities in it now. So, we need to find a replacement for the download package and replace it.

[wes-q]

Can I refactor the code to use axios to download the APK? If yes, please assign this issue to me.

[garg3133]

@wes-q You could use axios but we'd need the features provided by the download package (download progress for example).

It seems from kevva/download#220 that someone has created a fork of the download package and they're maintaining it as well, so we could probably use that instead.

Although it seems that they've migrated the fork to ESM, so you'd have to see how we can use that ESM package in this project.

[wes-q]

@garg3133
I have a solution which shows the download progress even while using axios only. If I am not mistaken, "download" package is only used in one instance in the whole mobile-helper-tool repository. I am proposing we remove this dependency instead if it sounds good to you.

[garg3133]

@wes-q Can you share more about the solution you're talking about? The thing with download package is that it is built solid for this use case and provides a lot of features (which are not well documented in the README), some of which are (as far as I can remember):

• It automatically decompress .zip files after downloading and deletes the original .zip.
• Download progress
• Good error handling

So, a replacement to this should also be solid.

To answer your second question, yes, it is being used at a single place in the repository, but the function containing download package call is being called at multiple places.

[wes-q]

@garg3133 Apologies, because I didn't realize download was also responsible for decompressing zip. I thought it was enough if download was finished and progress was shown. Noob mistake, by the way this is my first time contributing. So scrap that.

I got back to the thread you shared and followed it and learned a lot about the open source process. In the end, I found 3 solutions which other people used to replace download.

1. Using node-downloader-helper package
2. Using node-fetch package
3. Using the @xhmikosr/downloader

I believe the third one was the fork that you mentioned. If we are going to use that, we simply need to replace the import statement with the new one

import download from @xhmikosr/downloader

However when I tried that, typescript was looking for a declaration file for that module. I tried this command but it didn't work:
npm install --save-dev @types/xhmikosr__downloader

I tried adding a d.ts file (xhmikosr__downloader.d.ts) inside src folder, and it worked but let me know if that is an acceptable solution.

[garg3133]

@wes-q Sorry for not getting back to you earlier. Yes, creating a new declaration file is acceptable. There's a PR for adding the types to the package itself here but I'm not sure if the types are complete or not.

Anyway, if you are doing this, make sure that the tool works after changing the import because I feel that just changing the import statement won't be enough here (since the downloader project is on ESM and we're on CommonJS).

[AkhilJ321]

@garg3133 , I found a package :https://www.npmjs.com/package/@guoyunhe/downloader
But this is only for downloading and automatically extracting zip folders.

And I checked for node-downloader-helper. It can show progress and all but I guess extraction thing is not present in that.