[deps]: Update node-fetch to v3

jslib/common/src/models/request/identityToken/passwordTokenRequest.ts

@@ -1,5 +1,4 @@
 import { ClientType } from "../../../enums/clientType";
-import { Utils } from "../../../misc/utils";
 import { CaptchaProtectedRequest } from "../captchaProtectedRequest";
 import { DeviceRequest } from "../deviceRequest";
 
@@ -30,5 +29,4 @@ export class PasswordTokenRequest extends TokenRequest implements CaptchaProtect
 
     return obj;
   }
-
 }

jslib/common/src/services/state.service.ts

@@ -38,8 +38,7 @@ const partialKeys = {
 export class StateService<
   TGlobalState extends GlobalState = GlobalState,
   TAccount extends Account = Account,
-> implements StateServiceAbstraction<TAccount>
-{
+> implements StateServiceAbstraction<TAccount> {
   protected accountsSubject = new BehaviorSubject<{ [userId: string]: TAccount }>({});
   accounts$ = this.accountsSubject.asObservable();
 

jslib/node/src/cli/commands/update.command.ts

@@ -1,3 +1,4 @@
+import { components } from "@octokit/openapi-types";
 import * as fetch from "node-fetch";
 
 import { I18nService } from "@/jslib/common/src/abstractions/i18n.service";
@@ -6,6 +7,30 @@ import { PlatformUtilsService } from "@/jslib/common/src/abstractions/platformUt
 import { Response } from "../models/response";
 import { MessageResponse } from "../models/response/messageResponse";
 
+type GitHubRelease = components["schemas"]["release"];
+
+function isGitHubRelease(value: unknown): value is GitHubRelease {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+
+  const obj = value as Record<string, unknown>;
+
+  if (typeof obj.tag_name !== "string") {
+    return false;
+  }
+
+  if (obj.body !== undefined && obj.body !== null && typeof obj.body !== "string") {
+    return false;
+  }
+
+  if (obj.assets !== undefined && obj.assets !== null && !Array.isArray(obj.assets)) {
+    return false;
+  }
+
+  return true;
+}
+
 export class UpdateCommand {
   inPkg = false;
 
@@ -27,6 +52,11 @@ export class UpdateCommand {
     );
     if (response.status === 200) {
       const responseJson = await response.json();
+
+      if (!isGitHubRelease(responseJson)) {
+        return Response.error("Invalid response from GitHub API");
+      }
+
       const res = new MessageResponse(null, null);
 
       const tagName: string = responseJson.tag_name;