Security vulnerability in dependency `cross-undici-fetch`

Describe the bug

When your app uses @graphql-codegen/cli and you have dependabot alerts enabled you will get an (unresolvable) alert that undici prior to v5.8.0 is insecure.

Your Example Website or App

https://github.com/GamerBene19/gql-codegen-example

Steps to Reproduce the Bug or Issue

1. Fork example repo
2. Go to security tab
3. Enable dependabot alerts like so:
4. Wait
5. Observe following two (unresolvable) dependabot alerts:

Expected behavior

The “expected behavior” would be to not have a vulnerable version as a dependency or being able to update to a non-vulnerable version.

Screenshots or Videos

No response

Platform

• OS: Arch Linux, but should be irrelevant
• NodeJS: v17.9.0, but should be irrelevant
• graphql version: 16.5.0, but should be irrelevant
• @graphql-codegen/cli version(s): 2.9.1, very much relevant

Codegen Config File

No response

Additional context

As far as I can tell the (problematic) version of undici is a transitive dependency of cross-undici-fetch from here.

A quick google search revealed that perhaps this package (which might very well just be a renamed version of the original one) is a replacement?

[ardatan]

@graphql-codegen/cli@2.11.2 has been released. It doesn’t use cross-undici-fetch that depends on the older version of undici. Now it uses @whatwg-node/fetch which uses the latest undici. https://github.com/dotansimha/graphql-code-generator/blob/master/yarn.lock#L14704

[ardatan]

After hours of work, we finally figured out to make things work on our side with 5.8.0 by adding some workarounds. https://github.com/dotansimha/graphql-code-generator/pull/8155 So this PR is merged, the new patch version will be available soon.