update node-fetch to v3.x

[jimmywarting]

No description provided.

[cosmolightfoot]

Any progress on this one?

Our company's security scans are showing vulnerabilities in node-fetch and are blocking deploys based on this package based on the sub-dependency.
node-fetch v3.1.1 solves the issue.

[borisovg]

Apparently node-fetch v3 breaks non-ESM applications: node-fetch/node-fetch#1263

[bhavikagrawal]

I am also stuck for a week now and have not found any solution yet.

[jimmywarting]

@bhavikagrawal what are you stuck with?
anything i can do to help?

[RishikeshDarandale]

@jimmywarting , I am also stuck in one of the issue, the fix for this one is get updated to node-fetch - v3.x.

[shazron]

2.6.7 also has the security patch

[RishikeshDarandale]

@shazron , Yes it's patched in 2.6.7, but there is an issue using 2.x in tandem with auth-react package. Please see here, thus upgrade 3.x would be the best way for me. Yes, there is a workaround using with 2.x, but going with 3.x is better way for me.