Upgrade node-fetch

[juliocarneiro]

Run next info (available from version 12.0.8 and up)

Operating System:
Platform: win32
Arch: x64
Version: Windows 10 Pro
Binaries:
Node: 14.18.2
npm: 6.14.15
Yarn: 1.22.17
pnpm: N/A
Relevant packages:
next: 12.0.8
react: 17.0.2
react-dom: 17.0.2

What version of Next.js are you using?

12.0.8

What version of Node.js are you using?

14.18.2

What browser are you using?

Chrome

What operating system are you using?

Windows 10

How are you deploying your application?

Vercel

Describe the Bug

Vulnerability in Next.js 12.0.8, in node-fetch package

Expected Behavior

λ snyk test next

Testing next...

✗ Medium severity vulnerability found in node-fetch
Description: Information Exposure
Info: https://snyk.io/vuln/SNYK-JS-NODEFETCH-2342118
Introduced through: node-fetch@2.6.1
From: node-fetch@2.6.1

Organization: xxx
Package manager: npm
Open source: yes
Project path: next

Tested next for known vulnerabilities, found 1 vulnerability, 1 vulnerable path.

To Reproduce

install nextjs project
install snyk global
run snyk test

[nikhilgupta16]

@balazsorban44 / @kodiakhq did we fix this for next 11.x version as well? Is that in the plan?

[balazsorban44]

We likely won't backport it since you can update node-fetch in v11 with overrides for npm or resolutions for yarn. node-fetch wasn't precompiled in 11.1.3

[RishikeshDarandale]

We likely won't backport it since you can update node-fetch in v11 with overrides for npm or resolutions for yarn. node-fetch wasn't precompiled in 11.1.3

@balazsorban44 , overrides is introduced with npm 8.3.0. What about if npm < 8.3.0 ? As this security vulnerability, why can't it get patched in 11.x? Is 11.x will not be maintained further?

[balazsorban44]

On reconsideration, we might do it after all, thank you for pointing it out.

[guidorice]

@balazsorban44 Use npm overrides huh? I hope do you reconsider about patching next v11: Just consider any new users of next v11 today:

$ npm install next@11
npm WARN deprecated querystring@0.2.1: The querystring API is considered Legacy. new code should use the URLSearchParams API instead.
npm WARN deprecated querystring@0.2.0: The querystring API is considered Legacy. new code should use the URLSearchParams API instead.

added 320 packages, and audited 321 packages in 9s

51 packages are looking for funding
  run `npm fund` for details

2 high severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force

Run `npm audit` for details.

$ npm audit
# npm audit report

node-fetch  <2.6.7
Severity: high
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor - https://github.com/advisories/GHSA-r683-j2x4-v87g
fix available via `npm audit fix --force`
Will install next@10.0.1, which is a breaking change
node_modules/node-fetch
  next  9.0.6-canary.0 - 9.3.4-canary.0 || 10.0.2-canary.0 - 12.0.8
  Depends on vulnerable versions of node-fetch
  node_modules/next

2 high severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force

[balazsorban44]

11.1.4 and 12.0.9 is out, please upgrade!

[github-actions]

This closed issue has been automatically locked because it had no new activity for a month. If you are running into a similar issue, please create a new issue with the steps to reproduce. Thank you.