Alternatives? about cross-fetch HOT 6 CLOSED

@rwlodarczyk-xealth @lquixada
May I know the update on this ticket as we are consuming this package and this is blocked for security issue.

Ref:
https://huntr.dev/bounties/a7e6a136-0a4b-46c4-ad20-802f1dd60bf7/
https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7/

from cross-fetch.

We're using cross-fetch in many internal libraries, and #117 is critical; currently, many of our libraries are failing due to missing DNS caching when using node-fetch.

from cross-fetch.

We have the same concerns here. If this package updates itself to use node-fetch 3.2.10, that would be tremendously helpful. Please see the CVE that discusses the security issue.

from cross-fetch.

@lquixada, can you provide an update on this and fixing security issues in general?

from cross-fetch.

@lquixada Friendly reminder about this security issue. Any update?

from cross-fetch.

Starting from v3, node-fetch is an ESM-only module while cross-fetch is CommonJS compatible. If there's a security issue, a patch should be requested on node-fetch v2.x. FWIW [email protected] was recently released with [email protected].

from cross-fetch.