Fix high snyk security vulnerability in v2

[filipatavares]

Hi there,

Snyk found a new HIGH-security vulnerability: https://security.snyk.io/vuln/SNYK-JS-NODEFETCH-2964180

Could you please apply the fix for node-fetch v2?
We can't update to v3 at the moment and v2 is said to be udpated with bug/security issues.

Best regards

[LinusU]

v2 isn't affected by that issue:

#1611 (comment)

Someone needs to contact Snyk and get them to update the affected version range...

[mattcobb]

Contacting Snyk

[mattcobb]

snyk ticket 29544

[vovikhangcdv]

Actually, the Snyk severity (CVSS Score) is not suitable. As I mentioned in the report, it should be 5.9 (Medium) CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), not a high severity vulnerability.

[mattcobb]

Snyk fixed the range:

Jacky Cheung (Snyk)
Aug 3, 2022, 17:40 GMT+1

Hi Matt,

This was updated yesterday to reflect the fact that 2.x was not impacted and the public advisory is already showing as such so this should now be correct.
Cheers,

Jacky
Senior Technical Support Engineer (EMEA)