[Bug]: current version of node-fetch has high severity vulnerability CVE-2022-0235

[humble-barnacle001]

Bug description

Steps to reproduce the problem:

1. npm audit

See CVE-2022-0235

Puppeteer version

13.1.1

Node.js version

16

npm version

8.1

What operating system are you seeing the problem on?

Linux, Windows

Relevant log output

No response

Edit: patch released https://github.com/puppeteer/puppeteer/releases/tag/v13.1.2

[lgarron]

In particular, since Puppeteer pins exact dependency versions, GitHub and various tools will assume that any other version of a transitive dependency is incompatible:

Also note that:

• npm install node-fetch@3.1.1 will not address the security alert from npm audit.
• npm audit fix --force will downgrade Puppeteer to v5.3.1 to avoid the vuln.

So this isn't exactly easy to address in downstream codebases without a new Puppeteer version that avoids the vulnerable dependency versions.

A comment by @jschfflr #7717 (comment) suggests that a simple upgrade might have compatibility issues:

@jackfranklin It looks like node-fetch only supports esm starting with v 3.0.

[humble-barnacle001]

Updating to v2.6.7 fixes the issue

[Trott]

For several hours, the GitHub CVE/tooling reported that this was only fixed in node-fetch@3.1.1. It is also fixed in node-fetch@2.6.7 and GitHub/npm tooling and materials have been updated to show that, so this should be a pretty straightforward/easy fix at this point.

[humble-barnacle001]

Should be fixed by #7924

[PythonCoderAS]

#7924 has fixed it but it won't be patchable by dependabot without a new patch release.

[drealecs]

Can we also patch the other major versions? I mean, cherry-pick 2a8d94c
As per https://github.com/puppeteer/puppeteer/blob/main/docs/api.md that means:

• 11.0.0 to 11.0.1 as the last one supporting v93 chromium.
• 12.0.1 to 12.0.2 as the last one supporting v97 chromium.

In my use case, we are running the v93 version of chromium as it is available on latest alpine.

[drealecs]

Following the PR discussion(#7924), I end up using the overrides feature from npm 8.3+ and added to package.json:

  "overrides": {
    "puppeteer": {
      "node-fetch@2.6.5": "2.6.7"
    }
  },

[lgarron]

I don't think it's been mentioned here yet, but v13.1.2 is out with the dependency update:

https://github.com/puppeteer/puppeteer/releases/tag/v13.1.2

Thanks, @OrKoN! ❤️