node-fetch vulnerability transitive from isomorphic-fetch about fbt

[pkqinys]

I would recommend wait until we release the public version. [email protected] should be stable as it has been deployed to production at Meta for a while now. However [email protected] is not in production yet.

[pkqinys]

According to Dependabot, [email protected] (through 0.10.0-rc5-beta) requires node-fetch@^1.0.1 via a transitive dependency on [email protected].

Hmm, that's different from what I saw. This issue exists in 0.9.5 - 0.9.18 because babel-plugin-fbt-runtime at that time depended on fbjs which in turn depends on isomorphic-fetch.

However, we recently removed fbjs dependency in e42ecd2 and I believe this is no longer an issue

[lucasgonze]

Thank you for this helpful guidance, @pkqinys . I see that fbjs is gone in 0.10.0-rc5-beta. What is the stability of that version, given that it is only a release candidate? Can I pull it into production software?

It may be relevant that my work is also on a Facebook project.