[security] upgrade to latest version of isomorphic-fetch

[redonkulus]

Version 2.x has a vulnerability in a dependent library that was fixed version 3.x. Can fbjs be updated to use this new version? This might require a major or minor version bump of fbjs as well.

[carystanley]

To resolve the issue with create-react-class the pkg isomorphic-fetch would need to be updated as a patch release fbjs@0.8.18

create-react-class@15.6.3 > fbjs@0.8.17 > isomorphic-fetch@2.2.1 > node-fetch@1.7.3 – SNYK#SNYK-JS-NODEFETCH-674311 Denial of Service. retire create-react-class, which is vulnerable and unmaintained for >1 yr

[jmz527]

I have this same security vulnerability via several relay packages, react-relay, relay-compiler, and relay-runtime. Any updates on this?

[mariuszkrzaczkowski]

Any updates on this?

[imran-iq]

We still have an outstanding security notification for this package, is it being looked at?

[ldemirova]

I am looking for an update, too.

We also have security notification for this package in dependable packages. Is it planned to be fixed?

[DanielRuf]

Also interesting, where is the v3.0.0 release here on GitHub?

#445

[s100]

The README for this package says,

Note: If you are consuming the code here and you are not also a Facebook project, be prepared for a bad time. APIs may appear or disappear and we may not follow semver strictly, though we will do our best to. This library is being published with our use cases in mind and is not necessarily meant to be consumed by the broader public. In order for us to move fast and ship projects like React and Relay, we've made the decision to not support everybody. We probably won't take your feature requests unless they align with our needs. There will be overlap in functionality here and in other open source projects.

Among other things this explains the lack of activity in this issue and the omission of a v3.0.0 release/tag. I don't know how many folks in this thread who need this fix are other Facebook projects, but as a general suggestion it might be more expedient to stop using fbjs entirely rather than wait for this to be resolved.

[DanielRuf]

the omission of a v3.0.0 release/tag

I guess this was just forgotten by @cpojer. Besides this, react, relay, create-react-class and so on are projects which are created and maintained by Facebook.

https://www.npmjs.com/package/create-react-class
https://www.npmjs.com/package/react-relay

Similar case for recompose (https://github.com/acdlite/recompose, not sure why this is hosted on a personal GH page instead of an org) which is actively maintained and developed by one of the React core devs who works at Facebook ;-)

So

as a general suggestion it might be more expedient to stop using fbjs entirely rather than wait for this to be resolved.

Tell that the maintainers of the mentioned packages (who seem to work at / for Facebook) ;-)
I see no mention of projects / packages here which are not from Facebook.

[mroch]

isn't this fixed by 16620e3 which is in fbjs@2.0.0? i must be missing something because that was released several months before this was filed. :)