search

matthew-andrews / isomorphic-fetch

Isomorphic WHATWG Fetch API, for Node & Browserify
MIT License
6.95k stars 289 forks source link

update node-fetch to v3.x #200

Open jimmywarting opened 2 years ago

cosmolightfoot commented 2 years ago

Any progress on this one?

Our company's security scans are showing vulnerabilities in node-fetch and are blocking deploys based on this package based on the sub-dependency. node-fetch v3.1.1 solves the issue.

borisovg commented 2 years ago

Apparently node-fetch v3 breaks non-ESM applications: https://github.com/node-fetch/node-fetch/issues/1263

bhavikagrawal commented 2 years ago

I am also stuck for a week now and have not found any solution yet.

jimmywarting commented 2 years ago

@bhavikagrawal what are you stuck with? anything i can do to help?

RishikeshDarandale commented 2 years ago

@jimmywarting , I am also stuck in one of the issue, the fix for this one is get updated to node-fetch - v3.x.

shazron commented 2 years ago

2.6.7 also has the security patch

RishikeshDarandale commented 2 years ago

@shazron , Yes it's patched in 2.6.7, but there is an issue using 2.x in tandem with auth-react package. Please see here, thus upgrade 3.x would be the best way for me. Yes, there is a workaround using with 2.x, but going with 3.x is better way for me.