[Snyk] Security upgrade node-fetch from 2.6.7 to 3.2.10

[mikolajroszak]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-NODEFETCH-2964180	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: node-fetch

The new version differs by 217 commits.

• 2880238 fix: ReDoS referrer (datastore: use millisecond-precision with stored dates googleapis/google-cloud-node#1611)
• e87b093 fix(Headers): don't forward secure headers on protocol change (projectID requirement not consistently documented googleapis/google-cloud-node#1599)
• bcfb71c chore: remove triple-slash directives from typings (Bigquery import does not populate err in callback when error occurs googleapis/google-cloud-node#1285) (module initialization error googleapis/google-cloud-node#1287)
• 95165d5 fix spelling (Source Code links broken in doc site googleapis/google-cloud-node#1602)
• 11b7033 fix: possibly flaky test (Need a redirect from the old gh-pages site to the new one. googleapis/google-cloud-node#1523)
• 4f43c9e fix: always warn Request.data (Introduce Gapic-generated files for pubsub API googleapis/google-cloud-node#1550)
• 1c5ed6b fix: undefined reference to response.body when aborted (google-cloud/common depending on an unpublished google-proto-files version? googleapis/google-cloud-node#1578)
• a92b5d5 fix: use space in accept-encoding values (bigtable: upgrade dependencies & clean system tests googleapis/google-cloud-node#1572)
• 0f122b8 docs: fix formdata code example (logging: fix examples googleapis/google-cloud-node#1562)
• 6ae9c76 docs(readme): response.clone() is not async (datastore: document how to use the emulator googleapis/google-cloud-node#1560)
• 043a5fc Fix leaking listeners (datastore: pagination changes googleapis/google-cloud-node#1295) (revert docs to gcloud googleapis/google-cloud-node#1474)
• 004b3ac fix: don't uppercase unknown methods (Emit header for gRPC messages googleapis/google-cloud-node#1542)
• c33e393 Fix Code of Conduct link in Readme. (Requests made datastore v0.1.1 are shown as v1beta2 requests in API usage graph googleapis/google-cloud-node#1532)
• 6875205 docs: Fix link markup to Options definition (common: create grpc operation object googleapis/google-cloud-node#1525)
• 6425e20 fix: handle bom in text and json (translate: fix system test translation googleapis/google-cloud-node#1482)
• a4ea5f9 fix: add missing formdata export to types (Documentation recommends using gcd.sh directly. googleapis/google-cloud-node#1518)
• 61b3b5a fix: cancel request example import (How to share App Engine SDK's local Datastore with google-cloud app? googleapis/google-cloud-node#1513)
• 5e78af3 Replace changelog with valid url (BigTable - local instance googleapis/google-cloud-node#1506)
• 9014db7 types: support `agent: false` (Pub/Sub: IAM Permissions Required to Subscribe Unclear googleapis/google-cloud-node#1502)
• 2e1f3a5 chore: fix typo in credential error message (Update gcloud-node/datastore to use the v1 API googleapis/google-cloud-node#1496)
• 4ce2ce5 docs(readme): fix typo (Update home.html googleapis/google-cloud-node#1489)
• ba23fd2 docs: remove the changelog (Cloud Language API googleapis/google-cloud-node#1464)
• 8fedc1b core: move support and feature to discussion (Releasing the modules googleapis/google-cloud-node#1471)
• 0b43b9f docs: update formdata example (catch Exceptions in pubsub googleapis/google-cloud-node#1465)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

[secure-code-warrior-for-github]

Micro-Learning Topic: Regular expression denial of service (Detected by phrase)

Matched on "Regular Expression Denial of Service"

What is this? (2min video)

Denial of Service (DoS) attacks caused by Regular Expression which causes the system to hang or cause them to work very slowly when attacker sends a well-crafted input(exponentially related to input size).Denial of service attacks significantly degrade the service quality experienced by legitimate users. These attacks introduce large response delays, excessive losses, and service interruptions, resulting in direct impact on availability.

Try this challenge in Secure Code Warrior

Micro-Learning Topic: Denial of service (Detected by phrase)

Matched on "Denial of Service"

The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others. Source: https://www.owasp.org/index.php/Denial_of_Service

Try this challenge in Secure Code Warrior