fixes #280 node-fetch > 3 requires ESM; 2.9.0 broken #285
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
node-fetch > 3 requires ESM but was updated by snyk automatically; this breaks anything using the lib/slas.js file (as well as projects using this as a library). i.e. 2.9.0 is broken in many use cases due to this dependency. 2.6.7 is fixed anyway according to the snyk vulnerability that triggered the initial upgrade of the major version (https://security.snyk.io/vuln/SNYK-JS-NODEFETCH-2342118) so this is unlikely to reoccur. However we may also want to prevent it from trying a major update again via configuration.
tobiaslohr
approved these changes
Feb 3, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
fixes #280
node-fetch > 3 requires ESM but was updated by snyk automatically; this
breaks anything using the lib/slas.js file (as well as projects using
this as a library). i.e. 2.9.0 is broken in many use cases due to this
dependency.
2.6.7 is fixed anyway according to the snyk vulnerability that triggered
the initial upgrade of the major version
(https://security.snyk.io/vuln/SNYK-JS-NODEFETCH-2342118) so this is
unlikely to reoccur. However we may also want to prevent it from
trying a major update again via configuration.