`cross-fetch` can be removed from the dependece list

MetaMask / web3-provider-engine

A JavaScript library for composing Ethereum provider objects using middleware modules

MIT License

597 stars 328 forks source link

`cross-fetch` can be removed from the dependece list #401

Closed imsys closed 2 years ago

imsys commented 2 years ago

cross-fetch was replaced by eth-json-rpc-middleware/fetch at the commit https://github.com/MetaMask/web3-provider-engine/commit/eeefd6f4c5363713c5f0c9a207bd7e98e7e26f9b , the older version of cross-fetch has a vulnerability and package managers will be complaining about it. It can be removed without problems.

brianlenz commented 2 years ago

What's the hold-up on #404 here? Seems like a pretty straight-forward PR to merge. I audited the code on main branch and can confirm cross-fetch is no longer used and is safe to remove.