Skip to content

[deps]: Update node-fetch to v3 - #869

Closed
renovate[bot] wants to merge 6 commits into
mainfrom
renovate/node-fetch-3.x
Closed

[deps]: Update node-fetch to v3#869
renovate[bot] wants to merge 6 commits into
mainfrom
renovate/node-fetch-3.x

Conversation

@renovate

@renovate renovate Bot commented Sep 12, 2025

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
node-fetch 2.7.0 -> 3.3.2 age confidence

Release Notes

node-fetch/node-fetch (node-fetch)

v3.3.2

Compare Source

Bug Fixes

v3.3.1

Compare Source

Bug Fixes

v3.3.0

Compare Source

Features

v3.2.10

Compare Source

Bug Fixes

v3.2.9

Compare Source

Bug Fixes
  • Headers: don't forward secure headers on protocol change (#​1599) (e87b093)

v3.2.8

Compare Source

Bug Fixes

v3.2.7

Compare Source

Bug Fixes

v3.2.6

Compare Source

Bug Fixes

v3.2.5

Compare Source

Bug Fixes

v3.2.4

Compare Source

Bug Fixes

v3.2.3

Compare Source

Bug Fixes

v3.2.2

Compare Source

Bug Fixes

v3.2.1

Compare Source

Bug Fixes

v3.2.0

Compare Source

Features

v3.1.1

Compare Source

Security patch release

Recommended to upgrade, to not leak sensitive cookie and authentication header information to 3th party host while a redirect occurred

What's Changed

New Contributors

Full Changelog: node-fetch/node-fetch@v3.1.0...v3.1.1

v3.1.0

Compare Source

What's Changed

New Contributors

Full Changelog: node-fetch/node-fetch@v3.0.0...v3.1.0

v3.0.0

Compare Source

version 3 is going out of a long beta period and switches to stable

One major change is that it's now a ESM only package
See changelog for more information about all the changes.


Configuration

📅 Schedule: Branch creation - "every 2nd week starting on the 2 week of the year before 4am on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team as a code owner September 12, 2025 18:58
@renovate
renovate Bot requested a review from JimmyVo16 September 12, 2025 18:58
@bitwarden-bot bitwarden-bot changed the title [deps]: Update node-fetch to v3 [PM-25711] [deps]: Update node-fetch to v3 Sep 13, 2025
@bitwarden-bot

Copy link
Copy Markdown

Internal tracking:

@renovate renovate Bot changed the title [PM-25711] [deps]: Update node-fetch to v3 [deps]: Update node-fetch to v3 Sep 13, 2025
@github-actions

github-actions Bot commented Sep 17, 2025

Copy link
Copy Markdown
Contributor

Logo
Checkmarx One – Scan Summary & Detailsc40a69fe-b424-4d13-b30b-15d2806c6531

Great job! No new security vulnerabilities introduced in this pull request

@sonarqubecloud

Copy link
Copy Markdown

@eliykat

eliykat commented Oct 1, 2025

Copy link
Copy Markdown
Member

I'm not sure this should've been reopened. We previously closed it here: #316

Node fetch 3 is not compatible with CommonJs, and we can't use it. The better solution here would be to replace this package with the native fetch API, but we can't do that until we upgrade node a bit.

I agree with that assessment, but we need node >= 21 to be able to use the native fetch: https://nodejs.org/docs/latest-v21.x/api/globals.html#fetch

So... almost! but not yet

EDIT: see #863 for Node 20 -> 22 upgrade

@vincentsalucci
vincentsalucci requested a review from r-tome October 29, 2025 20:32
@renovate
renovate Bot force-pushed the renovate/node-fetch-3.x branch from 33a9c42 to 9009be3 Compare November 18, 2025 13:24
@renovate
renovate Bot force-pushed the renovate/node-fetch-3.x branch from 9009be3 to a9356a9 Compare December 3, 2025 14:39
@renovate
renovate Bot force-pushed the renovate/node-fetch-3.x branch from a9356a9 to fd3b909 Compare December 11, 2025 18:05
@codecov

codecov Bot commented Dec 11, 2025

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 16.01%. Comparing base (a0c3035) to head (886849b).
⚠️ Report is 3 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files
@@           Coverage Diff           @@
##             main     #869   +/-   ##
=======================================
  Coverage   16.01%   16.01%           
=======================================
  Files          67       67           
  Lines        2791     2791           
  Branches      481      481           
=======================================
  Hits          447      447           
  Misses       2306     2306           
  Partials       38       38           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@claude

claude Bot commented Dec 12, 2025

Copy link
Copy Markdown
Contributor

Claude finished @renovate[bot]'s task —— View job


Reviewing PR #869: Update node-fetch to v3 ✅

Tasks

  • Launch code review agent to analyze the PR changes
  • Wait for agent to complete review and post findings
  • Update comment with completion status

Review Complete

The code review agent has analyzed the node-fetch v2 → v3 migration and posted detailed feedback directly on the PR.

Summary:

  • ESM imports: Correctly implemented for node-fetch v3
  • Type safety: Enhanced with @octokit/types and runtime type guards
  • Webpack config: Properly configured for ESM dependencies
  • ⚠️ Concerns: Type safety issues with as any casts and global namespace pollution

The agent has posted 5 inline comments on specific code sections with detailed recommendations for improvement.


Comment thread jslib/node/src/cli/commands/update.command.ts Outdated
Comment thread jslib/node/src/cli/commands/update.command.ts Outdated
Comment thread jslib/node/src/cli/commands/update.command.ts Outdated
Comment thread jslib/common/src/services/state.service.ts
Comment thread package.json
@renovate

renovate Bot commented Dec 12, 2025

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

Comment thread jslib/node/src/cli/commands/update.command.ts Outdated
Comment thread jslib/node/src/cli/commands/update.command.ts Outdated
Comment thread package.json
Comment thread jslib/node/src/cli/commands/update.command.ts
Comment thread jslib/node/src/cli/commands/update.command.ts
Comment thread jslib/common/src/services/state.service.ts
Comment thread jslib/node/src/cli/commands/update.command.ts
Comment thread jslib/node/src/services/nodeApi.service.ts
Comment thread jslib/node/src/services/nodeApi.service.ts
Comment thread jslib/node/src/cli/commands/update.command.ts
Comment thread jslib/node/src/cli/commands/update.command.ts
Comment thread webpack.cli.js

@BTreston BTreston left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

After my changes here:
build ✅ tests ✅ smoke test ✅
@eliykat for a second set of eyes. Turning on auto-merge.

@eliykat
eliykat self-requested a review December 12, 2025 23:20
@eliykat

eliykat commented Dec 13, 2025

Copy link
Copy Markdown
Member

As discussed in Slack, holding off until we've reviewed ESM support. The node upgrade may also make this obsolete.

@eliykat eliykat closed this Dec 13, 2025
@renovate

renovate Bot commented Dec 13, 2025

Copy link
Copy Markdown
Contributor Author

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 3.x releases. But if you manually upgrade to 3.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

@renovate
renovate Bot deleted the renovate/node-fetch-3.x branch December 13, 2025 04:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants