🚨 [security] Update node-fetch 3.2.8 → 3.3.2 (minor)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ node-fetch (3.2.8 → 3.3.2) · Repo · Changelog

Security Advisories 🚨

🚨 node-fetch Inefficient Regular Expression Complexity

node-fetch is a light-weight module that brings window.fetch to node.js.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the isOriginPotentiallyTrustworthy() function in referrer.js, when processing a URL string with alternating letters and periods, such as 'http://' + 'a.a.'.repeat(i) + 'a'.

Release Notes

3.3.2

3.3.2 (2023-07-25)

Bug Fixes

• Remove the default connection close header. (#1736) (8b3320d), closes #1735 #1473

3.3.1

3.3.1 (2023-03-11)

Bug Fixes

• release "Allow URL class object as an argument for fetch()" #1696 (#1716) (7b86e94)

3.3.0

3.3.0 (2022-11-10)

Features

• add static Response.json (#1670) (55a4870)

3.2.10

3.2.10 (2022-07-31)

Bug Fixes

• ReDoS referrer (#1611) (2880238)

3.2.9

3.2.9 (2022-07-18)

Bug Fixes

• Headers: don't forward secure headers on protocol change (#1599) (e87b093)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 12 commits:

• fix: Remove the default connection close header. (#1736)
• fix: release "Allow URL class object as an argument for fetch()" #1696 (#1716)
• docs: readme - non ESM example (#1707)
• ci(release): use latest Node LTS (#1697)
• Allow URL class object as an argument for fetch() (#1696)
• feat: add static Response.json (#1670)
• (1138) - Fixed HTTPResponseError with correct constructor and usage (#1666)
• docs: fix missing comma in example (#1623)
• fix: ReDoS referrer (#1611)
• fix(Headers): don't forward secure headers on protocol change (#1599)
• chore: remove triple-slash directives from typings (#1285) (#1287)
• fix spelling (#1602)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[KunoichiZ]

@depfu recreate