node-fetch snyk vulnerabilities

[samchungy]

Hello, our Snyk vulnerabilities scanner flagged node-fetch as an issue across your packages. Could we bump this up a version or two? :) Cheers!

Edit: Noticed that might be an issue due to ESM

https://security.snyk.io/vuln/SNYK-JS-NODEFETCH-2964180

[sbrown1214]

Having the same exact issue! Just wanted to bump this thread. Thank you for posting

[glasser]

apollo-server uses node-fetch v2, not node-fetch v3. (Using v3 only works if your app loads files via ESM rather than CJS, so for us to use v3 we'd be preventing Apollo Server users from using CJS.)

According to the developers, this bug appears to only exist in v3; Snyk is incorrect to flag this as an issue. node-fetch/node-fetch#1615 says that they've asked Snyk to update their version range.