`prop-types 15.5.8` references `node-fetch@^1.0.1`, and yarn audit tells me ``` │ low │ Denial of Service │ │ Package │ node-fetch │ │ Patched in │ >=2.6.1 <3.0.0-beta.1|| >= 3.0.0-beta.9 │ ```