Bump node-fetch from 2.6.1 to 2.6.7 to resolve a security vulnerability

[Sparky-code]

Overview

As a developer, I would like website team repo to be free of security vulnerabilities. For this issue, we will address the security vulnerability alert related to node-fetch.

Details

This issue addresses a security issue in node-fetch version < 2.6.7 that was automatically prompted by GitHub's dependabot.

Note: Node-fetch is vulnerable to exposure of sensitive information to an unauthorized actor.

Action Items

• Enable alerts and updates in your own fork of the Hack for LA website so that they match those in the Hack for LA repository. These settings can be found in the settings tab in your own repo under code security and analysis and is referenced in image 1 below.
• After enabling the above, you should see an autogenerated PR in your own repository which references the node-fetch vulnerability, images 2 and 3 below.
• Review package-lock.json file where changes need to be made.
• Double-check if this update has caused issues and/or unintended changes in repositories that were updated.
• Include the results of your check as a comment in this issue.
• Address this PR in your own repository in order to test if the update causes any issues for the Hack for LA website.
• Pending successful research and testing of the update, create a PR to merge the changes in node-fetch to gh-pages (main).

Resources/Instructions

A page about dependabot and enabling alerts/updates
Package-lock.json file

Image 1

Image 2

Image 3

Is there a dependency?

No

If Yes, please explain

N/A

[blulady]

ETA: Thursday (5/26)
Availability: Thursday - Saturday (5/26 - 5/28)

[JessicaLucindaCheng]

@blulady Please move this issue into the "In Progress" column

Edit: I have gone ahead and moved it to the In Progress column this time. However, in the future, please remember to move the issue to the In Progress column at the time you self-assign an issue. Thanks.

[github-actions]

@blulady

Please add update using the below template (even if you have a pull request). Afterwards, remove the 'To Update !' label and add the 'Status: Updated' label.

1. Progress: "What is the current status of your project? What have you completed and what is left to do?"
2. Blockers: "Difficulties or errors encountered."
3. Availability: "How much time will you have this week to work on this issue?"
4. ETA: "When do you expect this issue to be completed?"
5. Pictures: "Add any pictures of the visual changes made to the site so far."

If you need help, be sure to either: 1) place your issue in the developer meeting discussion column and ask for help at your next meeting, 2) put a "Status: Help Wanted" label on your issue and pull request, or 3) put up a request for assistance on the #hfla-site channel.

_{You are receiving this comment because your last comment was before Tuesday, June 7, 2022 at 12:21 AM PST.}

[blulady]

Progress: I have completed the first few check marks. I need to read: A page about dependabot and enabling alerts/updates and the
Blockers: As of right now, just need to read the instructions
Availability: 4 hours to work on it this weekend
ETA: Uncertain how many hours it will take
Pictures (optional): Currently no visual changes

[blulady]

Step 1: Enable Dependency Graph, Dependabot Alerts, Dependabot Security Updates

Step 2: Make sure that I am seeing the alert in my repository

and that I am able to review the security update

Step 3: Review [package-lock.json file](https://github.com/hackforla/website/blob/gh-pages/github-actions/github-data/package-lock.json) where changes need to be made. This is a bit more challenging because Hack For LA’s package-lock.json file doesn’t look like my package-lock.json file:

Hack for LA's

Mine

Step 4: Review package-lock where changes need to be made

Step 5: Research if this update has caused issues and/or unintended changes in repositories that were updated.

Unclear as to what steps should be taken here. Google search?

Step 6: Address this PR in your own repository in order to test if the update causes any issues for the Hack for LA website.

Step 7: Pending successful research and testing of the update, create a PR to merge the changes in node-fetch to gh-pages

Will attend meeting tonight and ask about moving forward with a PR