High severity vulnerability found with node-fetch

[cmacdonnacha]

There is a High severity vulnerability with the current node-fetch package being used, which is throwing dependabot alerts.

See github advisory here

I'm submitting a:

• Bug report
• Feature request
• Other (Describe below)

Current behavior

Vulnerability exists

Expected behavior

Vulnerability is patched. Upgrading to version 3.1.1 should be enough.

[denysoblohin-okta]

okta-auth-js version 6.1.0 depends on cross-fetch@3.1.5 which uses vuln-free node-fetch 2.6.7

[denysoblohin-okta]

However old version of node-fetch left in yarn.lock, will be fixed in next version of okta-auth-js
Internal ref: OKTA-470146