Skip to content
This repository has been archived by the owner on Apr 22, 2024. It is now read-only.

cross-fetch can be removed from the dependece list #401

Closed
imsys opened this issue Jan 24, 2022 · 1 comment · Fixed by #404
Closed

cross-fetch can be removed from the dependece list #401

imsys opened this issue Jan 24, 2022 · 1 comment · Fixed by #404

Comments

@imsys
Copy link

imsys commented Jan 24, 2022 •
edited
Loading

cross-fetch was replaced by eth-json-rpc-middleware/fetch at the commit eeefd6f , the older version of cross-fetch has a vulnerability and package managers will be complaining about it. It can be removed without problems.
wbt added a commit to wbt/web3-provider-engine that referenced this issue Feb 4, 2022
@wbt
Remove vulnerable version of cross-fetch
4f257da 
Closes MetaMask#401.
@wbt wbt mentioned this issue Feb 4, 2022
Merged
@brianlenz brianlenz mentioned this issue Mar 30, 2022
Closed
@brianlenz
Copy link

What's the hold-up on #404 here? Seems like a pretty straight-forward PR to merge. I audited the code on main branch and can confirm cross-fetch is no longer used and is safe to remove.

mcmire pushed a commit that referenced this issue Apr 6, 2022
@wbt
Remove vulnerable version of cross-fetch (#404)
3773de9 
Closes #401.
@takeratta takeratta mentioned this issue Jun 21, 2023
Open
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Remove vulnerable version of cross-fetch wbt/web3-provider-engine
2 participants
@imsys @brianlenz