Node-fetch, a popular library bringing the Fetch API to Node.js, underwent significant changes between versions 2.7.0 and 3.0.0. The most notable difference lies in its dependencies. Version 2.7.0 relied on whatwg-url for URL parsing, a dependency that was removed in version 3.0.0. Instead, version 3.0.0 introduces data-uri-to-buffer and fetch-blob, indicating a shift towards improved handling of data URIs and Blob objects, features increasingly relevant for modern web development.
For developers, this means version 3.0.0 offers enhanced capabilities for working with binary data and potentially streamlined data handling, reflecting the evolution of web standards and Node.js environments. The jump also involves a significant cleanup of development dependencies, likely improving build times and reducing the overall project footprint.
While version 2.7.0 used older tooling like Babel for transpilation, version 3.0.0 hints at a more modern development workflow with tools like c8 for coverage, and linters like xo. The update also signals that the package is trying to keep up with newest web standards. The license remains MIT in both versions, ensure that both versions can be used on almost every context and project type. Developers considering upgrading should carefully evaluate these changes and potential compatibility implications, particularly regarding URL handling and data URIs as well as the newer versions of dev dependencies.
All the vulnerabilities related to the version 3.0.0 of the package
node-fetch forwards secure headers to untrusted sites
node-fetch forwards secure headers such as authorization, www-authenticate, cookie, & cookie2 when redirecting to a untrusted site.
node-fetch Inefficient Regular Expression Complexity
node-fetch is a light-weight module that brings window.fetch to node.js.
Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the isOriginPotentiallyTrustworthy() function in referrer.js, when processing a URL string with alternating letters and periods, such as 'http://' + 'a.a.'.repeat(i) + 'a'.
