Support Twilio 4.x library (deprecation notices)

[saurori]

Hi, I recently upgraded my Twilio Functions dependency for twilio to 4.10.0 from 3.x version and noticed a deprecation warning in all of my Function error logs:

services is deprecated. Use v1.services instead.

I believe this is from calling Runtime.getSync(). The warning is here and I believe it's called from here.

Is there a plan to support 4.x in the near future?

[welcome]

Thank you so much for opening your first issue in this project! We'll try to get back to it as quickly as possible. While you are waiting...here's a random picture of a corgi (powered by dog.ceo)

[AlaricWhitney]

I agree with this. This library is being flagged by our security teams as associated with high severity CVE's, so we can't use it in it's current form. the issue is that it's importing twilio v3, and needs to be importing twilio v4

[saurori]

@makserik Thanks for updating the library. However, the deprecation message still exists using version 4.23.0:

services is deprecated. Use v1.services instead.

Please see the original description in this thread for where the deprecation warning is coming from.

[makserik]

@saurori - I believe this should have fixed the issue? https://github.com/twilio-labs/serverless-toolkit/pull/487/files

[saurori]

@makserik that seems to be working fine, using twilio 5.1.0 and @twilio/runtime-handler 2.0.1

[saurori]

@makserik I guess I did not have enough log data, but the issue seems to still be present in @twilio/runtime-handler 2.0.1. It looks like it was fixed in 2.0.2 but I cannot update. Setting the dependency to 2.0.2 gives the error:

Some dependencies could not be validated. No matching version found for @twilio/[email protected]. You can find the valid versions at https://www.twilio.com/docs/serverless/functions-assets/handler

The url in the error message indicates 2.0.2 is not available. Is this a mistake?