[deps]: Update node-fetch to v3 by renovate[bot] · Pull Request #869 · bitwarden/directory-connector

core: update fetch-blob by @jimmywarting in #1371
docs: Fix typo around sending a file by @jimmywarting in #1381
core: (http.request): Cast URL to string before sending it to NodeJS core by @jimmywarting in #1378
core: handle errors from the request body stream by @mdmitry01 in #1392
core: Better handle wrong redirect header in a response by @tasinet in #1387
core: Don't use buffer to make a blob by @jimmywarting in #1402
docs: update readme for TS @types/node-fetch by @adamellsworth in #1405
core: Fix logical operator priority to disallow GET/HEAD with non-empty body by @maxshirshin in #1369
core: Don't use global buffer by @jimmywarting in #1422
ci: fix main branch by @dnalborczyk in #1429
core: use more node: protocol imports by @dnalborczyk in #1428
core: Warn when using data by @jimmywarting in #1421
docs: Create SECURITY.md by @JamieSlome in #1445
core: don't forward secure headers to 3th party by @jimmywarting in #1449

New Contributors

@mdmitry01 made their first contribution in #1392
@tasinet made their first contribution in #1387
@adamellsworth made their first contribution in #1405
@maxshirshin made their first contribution in #1369
@JamieSlome made their first contribution in #1445

Full Changelog: node-fetch/node-fetch@v3.1.0...v3.1.1

`v3.1.0`

Compare Source

What's Changed

fix(Body): Discourage form-data and buffer() by @jimmywarting in #1212
fix: Pass url string to http.request by @serverwentdown in #1268
Fix octocat image link by @lakuapik in #1281
fix(Body.body): Normalize Body.body into a node:stream by @jimmywarting in #924
docs(Headers): Add default Host request header to README.md file by @robertoaceves in #1316
Update CHANGELOG.md by @jimmywarting in #1292
Add highWaterMark to cloned properties by @davesidious in #1162
Update README.md to fix HTTPResponseError by @thedanfernandez in #1135
docs: switch url to URL by @dhritzkiv in #1318
fix(types): declare buffer() deprecated by @dnalborczyk in #1345
chore: fix lint by @dnalborczyk in #1348
refactor: use node: prefix for imports by @dnalborczyk in #1346
Bump data-uri-to-buffer from 3.0.1 to 4.0.0 by @dependabot in #1319
Bump mocha from 8.4.0 to 9.1.3 by @dependabot in #1339
Referrer and Referrer Policy by @tekwiz in #1057
Add typing for Response.redirect(url, status) by @c-w in #1169
chore: Correct stuff in README.md by @Jiralite in #1361
docs: Improve clarity of "Loading and configuring" by @serverwentdown in #1323
feat(Body): Added support for BodyMixin.formData() and constructing bodies with FormData by @jimmywarting in #1314
template: Make PR template more task oriented by @jimmywarting in #1224
docs: Update code examples by @jimmywarting in #1365

New Contributors

@serverwentdown made their first contribution in #1268
@lakuapik made their first contribution in #1281
@robertoaceves made their first contribution in #1316
@davesidious made their first contribution in #1162
@thedanfernandez made their first contribution in #1135
@dhritzkiv made their first contribution in #1318
@dnalborczyk made their first contribution in #1345
@dependabot made their first contribution in #1319
@c-w made their first contribution in #1169

Full Changelog: node-fetch/node-fetch@v3.0.0...v3.1.0

`v3.0.0`

Compare Source

version 3 is going out of a long beta period and switches to stable

One major change is that it's now a ESM only package
See changelog for more information about all the changes.

Configuration

📅 Schedule: Branch creation - "every 2nd week starting on the 2 week of the year before 4am on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

bitwarden-bot · 2025-09-13T07:43:53Z

Internal tracking:

ID: PM-25711
Link: https://bitwarden.atlassian.net/browse/PM-25711

github-actions · 2025-09-17T15:13:46Z

Checkmarx One – Scan Summary & Details – c40a69fe-b424-4d13-b30b-15d2806c6531

Great job! No new security vulnerabilities introduced in this pull request

sonarqubecloud · 2025-09-23T14:18:37Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

eliykat · 2025-10-01T04:00:34Z

I'm not sure this should've been reopened. We previously closed it here: #316

Node fetch 3 is not compatible with CommonJs, and we can't use it. The better solution here would be to replace this package with the native fetch API, but we can't do that until we upgrade node a bit.

I agree with that assessment, but we need node >= 21 to be able to use the native fetch: https://nodejs.org/docs/latest-v21.x/api/globals.html#fetch

So... almost! but not yet

EDIT: see #863 for Node 20 -> 22 upgrade

codecov · 2025-12-11T18:07:42Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 16.01%. Comparing base (a0c3035) to head (886849b).
⚠️ Report is 3 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #869   +/-   ##
=======================================
  Coverage   16.01%   16.01%           
=======================================
  Files          67       67           
  Lines        2791     2791           
  Branches      481      481           
=======================================
  Hits          447      447           
  Misses       2306     2306           
  Partials       38       38

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

claude · 2025-12-12T15:42:35Z

Claude finished @renovate[bot]'s task —— View job

Reviewing PR #869: Update node-fetch to v3 ✅

Tasks

Launch code review agent to analyze the PR changes
Wait for agent to complete review and post findings
Update comment with completion status

Review Complete

The code review agent has analyzed the node-fetch v2 → v3 migration and posted detailed feedback directly on the PR.

Summary:

✅ ESM imports: Correctly implemented for node-fetch v3
✅ Type safety: Enhanced with @octokit/types and runtime type guards
✅ Webpack config: Properly configured for ESM dependencies
⚠️ Concerns: Type safety issues with as any casts and global namespace pollution

The agent has posted 5 inline comments on specific code sections with detailed recommendations for improvement.

renovate · 2025-12-12T16:25:17Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

…fetch

BTreston

After my changes here:
build ✅ tests ✅ smoke test ✅
@eliykat for a second set of eyes. Turning on auto-merge.

eliykat · 2025-12-13T04:46:49Z

As discussed in Slack, holding off until we've reviewed ESM support. The node upgrade may also make this obsolete.

renovate · 2025-12-13T04:47:49Z

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 3.x releases. But if you manually upgrade to 3.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

renovate Bot requested a review from a team as a code owner September 12, 2025 18:58

renovate Bot requested a review from JimmyVo16 September 12, 2025 18:58

bitwarden-bot changed the title ~~[deps]: Update node-fetch to v3~~ [PM-25711] [deps]: Update node-fetch to v3 Sep 13, 2025

renovate Bot changed the title ~~[PM-25711] [deps]: Update node-fetch to v3~~ [deps]: Update node-fetch to v3 Sep 13, 2025

vincentsalucci requested a review from r-tome October 29, 2025 20:32

renovate Bot force-pushed the renovate/node-fetch-3.x branch from 33a9c42 to 9009be3 Compare November 18, 2025 13:24

renovate Bot added the major-update label Nov 18, 2025

renovate Bot force-pushed the renovate/node-fetch-3.x branch from 9009be3 to a9356a9 Compare December 3, 2025 14:39

[deps]: Update node-fetch to v3

fd3b909

renovate Bot force-pushed the renovate/node-fetch-3.x branch from a9356a9 to fd3b909 Compare December 11, 2025 18:05

fix type issue for node-fetch v3, cleanup

321f8a5