logrocket-cli icon indicating copy to clipboard operation
logrocket-cli copied to clipboard

Remove isomorphic-fetch due to vulnerabilities

Open rjimenezda opened this issue 1 year ago • 0 comments

Hi!

We're in the process of removing a bunch of dependabot vulnerabilities in our project because of an upcoming audit, and have encountered that the latest version of logrocket-cli depends on isomorphic-fetch, which depends on a vulnerable version of node-fetch.

This PR drops isomorphic fetch in favour of using node-fetch directly. Node-fetch v1 is still in the lockfile, due to mock-fetch, but it's a devDependency, so it would not affect LogRocket's clients.

I'll leave some comments in the PR itself

rjimenezda avatar Jan 29 '25 23:01 rjimenezda