logrocket-cli
logrocket-cli copied to clipboard
Remove isomorphic-fetch due to vulnerabilities
Hi!
We're in the process of removing a bunch of dependabot vulnerabilities in our project because of an upcoming audit, and have encountered that the latest version of logrocket-cli depends on isomorphic-fetch, which depends on a vulnerable version of node-fetch.
This PR drops isomorphic fetch in favour of using node-fetch directly. Node-fetch v1 is still in the lockfile, due to mock-fetch, but it's a devDependency, so it would not affect LogRocket's clients.
I'll leave some comments in the PR itself