Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Bump node-fetch dep to pick up security release #147

Merged
merged 3 commits into from Apr 26, 2023

Conversation

max-stytch
Copy link
Collaborator

Force bumps node-fetch to 2.6.7 to resolve https://nvd.nist.gov/vuln/detail/CVE-2022-0235

stytch@5.4.0 /Users/maxwellgerber/work/client-libs/stytch-node
└─┬ isomorphic-unfetch@3.1.0
  └── node-fetch@2.6.7

@max-stytch max-stytch requested a review from a team as a code owner July 7, 2022 17:23
@@ -54,6 +54,11 @@
"isomorphic-unfetch": "^3.1.0",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I haven't dug too deep into the issue, but "Up to (excluding) 3.1.1" makes me think we should also bump our direct dependency. But I may just be misunderstanding the override system with multiple versions of the same dependency around.

Suggested change
"isomorphic-unfetch": "^3.1.0",
"isomorphic-unfetch": "^3.1.1",

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I took a look into node-fetch and the reported issue isn't fixed in the latest - opened node-fetch/node-fetch#1599

@max-stytch max-stytch temporarily deployed to integration_tests April 26, 2023 19:59 — with GitHub Actions Inactive
@max-stytch max-stytch temporarily deployed to integration_tests April 26, 2023 19:59 — with GitHub Actions Inactive
@max-stytch max-stytch temporarily deployed to integration_tests April 26, 2023 19:59 — with GitHub Actions Inactive
@max-stytch max-stytch merged commit fc661e1 into main Apr 26, 2023
11 checks passed
@max-stytch max-stytch deleted the max/bump-node-fetch branch April 26, 2023 20:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants