fix(deps): update dependency cross-fetch to v3.1.5 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
cross-fetch	3.0.6 -> 3.1.5

GitHub Vulnerability Alerts

CVE-2022-1365

When fetching a remote url with Cookie if it get Location response header then it will follow that url and try to fetch that url with provided cookie . So cookie is leaked here to thirdparty.
Ex: you try to fetch example.com with cookie and if it get redirect url to attacker.com then it fetch that redirect url with provided cookie .

---

Release Notes

lquixada/cross-fetch (cross-fetch)

v3.1.5

Compare Source

What's Changed

• chore: updated node-fetch version to 2.6.7 by @​dlafreniere in https://github.com/lquixada/cross-fetch/pull/124

New Contributors

• @​dlafreniere made their first contribution in https://github.com/lquixada/cross-fetch/pull/124

Full Changelog: lquixada/cross-fetch@v3.1.4...v3.1.5

v3.1.4

Compare Source

🐞 fixed typescript errors.

v3.1.3

Compare Source

🐞 fixed typescript compilation error causing #​95, #​101, #​102.

v3.1.2

Compare Source

🐞 added missing Headers interface augmentation from lib.dom.iterable.d.ts (#​97)

v3.1.1

Compare Source

🐞 fixed missing fetch api types from constructor signatures #​96 (thanks @​jstewmon)

v3.1.0

Compare Source

⚡️ improved TypeScript support with own fetch API type definitions (thanks @​jstewmon)
⚡️ set fetch.ponyfill to true when custom ponyfill implementation is used.
💡 set the same fetch API test suite to run against node-fetch, whatwg-fetch and native fetch.

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[changeset-bot]

⚠️ No Changeset found

Latest commit: d05bcd8

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[socket-security]

New dependencies detected. Learn more about Socket for GitHub ↗︎

Packages	Version	New capabilities	Transitives	Size	Publisher
cross-fetch	3.1.5	None	+3	531 kB	lquixada

[aaronmgdr]

Ignore

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (3.1.5). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.