Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

While upgrading Serverless module with latest version @3.0.1, dependency module node-fetch is not updated to latest version

See original GitHub issue

Are you certain it’s a bug?

Yes, it looks like a bug

Is the issue caused by a plugin?

It is not a plugin issue

Are you using the latest version?

Yes, I’m using the latest version

Is there an existing issue for this?

I have searched existing issues, it hasn’t been reported yet

Issue description

While upgrading Serverless module with latest version @3.0.1, dependency module node-fetch is not updated to latest version

As per npm, node fetch latest version is 3.2.0, but while upgrading Serverless with latest version @3.0.1, node-fetch version taken as @2.6.7. Due to this reason, we are facing security issues.

Kindly update on the above issue, whether node-fetch dependency of the Serverless module will be upgraded.

Service configuration (serverless.yml) content

N/A

Command name and used flags

N/A

Command output

N/A

Environment information

N/A

Issue Analytics

State:
Created 2 years ago
Comments:5 (3 by maintainers)

Top GitHub Comments

1reaction

pgrzesikcommented, Feb 4, 2022

I’ve checked and it seems like the security patch is applied to 2.6.7 as @dne suggests, so I think the report is incorrect. Could you confirm @SaitejaChavva ?

0reactions

dnecommented, Feb 4, 2022

If this is CVE-2022-0235, the fix was backported to node-fetch 2.x and released in v2.6.7, so maybe JFROG is inaccurate?