build(deps): bump node-fetch from 2.6.7 to 3.3.0

[dependabot]

Bumps node-fetch from 2.6.7 to 3.3.0.

Release notes

Sourced from node-fetch's releases.

v3.3.0

3.3.0 (2022-11-10)

Features

• add static Response.json (#1670) (55a4870)

v3.2.10

3.2.10 (2022-07-31)

Bug Fixes

• ReDoS referrer (#1611) (2880238)

v3.2.9

3.2.9 (2022-07-18)

Bug Fixes

• Headers: don't forward secure headers on protocol change (#1599) (e87b093)

v3.2.8

3.2.8 (2022-07-12)

Bug Fixes

• possibly flaky test (#1523) (11b7033)

v3.2.7

3.2.7 (2022-07-11)

Bug Fixes

• always warn Request.data (#1550) (4f43c9e)

v3.2.6

3.2.6 (2022-06-09)

Bug Fixes

• undefined reference to response.body when aborted (#1578) (1c5ed6b)

v3.2.5

3.2.5 (2022-06-01)

... (truncated)

Commits

• 55a4870 feat: add static Response.json (#1670)
• c071406 (1138) - Fixed HTTPResponseError with correct constructor and usage (#1666)
• 6f72caa docs: fix missing comma in example (#1623)
• 2880238 fix: ReDoS referrer (#1611)
• e87b093 fix(Headers): don't forward secure headers on protocol change (#1599)
• bcfb71c chore: remove triple-slash directives from typings (#1285) (#1287)
• 95165d5 fix spelling (#1602)
• 11b7033 fix: possibly flaky test (#1523)
• 4f43c9e fix: always warn Request.data (#1550)
• 1c5ed6b fix: undefined reference to response.body when aborted (#1578)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by node-fetch-bot, a new releaser for node-fetch since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[Apollon77]

node-fetch 3.x is ESM only!! This might be a breakign change, so I would not merge that directly!

options are:

• adjust code to be able to work with ESM packages (in fact require aka import is async now)
• alternative is to replace node-fetch by a "multi build version" - https://github.com/esm2cjs/node-fetch This is automatically providing ESM/CJS combi version
• or stay on 2.x (but without updates)

[ericzon]

@Apollon77 trying @esm2cjs/node-fetch with v14.17.6 makes appear the error: Cannot find module 'node:http' .

node: prefix syntax is available from v14.18 and it's appearing here

I solved that issue switching to v16.14.0 but this reduces compatibility...

[Apollon77]

@ericzon Hm .. .Yes then seems that some of the "sidehorus" packages already switched to that as minimum. In fact you can set 14.18 as minimum, but yes that would be breaking a bit. (with having in mind that Node.js 14 goes EOL in April 23 I think it could be considered ok to requuire an "up to date nodejs 14" :-)).

Then only chance is for now to stay with node-fetch 2.x and do not update to 3.x (But this might miss security updates).

So these are the both "meeeehhhh" options ... choose one ;-)

[ericzon]

@Apollon77 I think it's reasonable to align library compatibility with EoL of Nodejs versions. Nobody can complain too much about that. By now, we'll switch to @esm2cjs/node-fetch to reduce some security vulnerabilities. We'll update also the requirements in the docs.

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
0.0% Duplication

[dependabot]

Superseded by #1291.