fix: ⬆️ CVE-2022-0235

[chientrm]

update node-fetch to 2.6.7 to fix CVE-2022-0235

[jeremymeng]

@chientrm Thank you for your contribution! Could you please update the version number to 2.6.1 in package.json and lib/util/constants.ts? Please also add an entry in the Changelog.md

[ramya-rao-a]

@jeremymeng Do we need this update given that semver will ensure the latest version is served?

[jeremymeng]

@ramya-rao-a I feel it's ok to ensure minimum version to get the security fixes. This sounds a good topic to discuss in our team meeting.

[ghost]

All CLA requirements met.

[chientrm]

@chientrm Thank you for your contribution! Could you please update the version number to 2.6.1 in package.json and lib/util/constants.ts? Please also add an entry in the Changelog.md

I updated the version numbers and added an entry in the Changelog.

[jeremymeng]

Thank you for the contribution!

[jeremymeng]

@chientrm if a dependency version with security fixes falls into our semver range (in this case ^2.6.0), in general customer should be able to get the update without any changes needed in ms-rest-js. Here's a discussion on how to get the update: Azure/azure-sdk-for-js#19138 (comment)

[chientrm]

@chientrm if a dependency version with security fixes falls into our semver range (in this case ^2.6.0), in general customer should be able to get the update without any changes needed in ms-rest-js. Here's a discussion on how to get the update: Azure/azure-sdk-for-js#19138 (comment)

Had just checked npm audit and those critical vulnerabilities are gone.

Thank you so much for your response.