[Snyk] Upgrade node-fetch from 2.7.0 to 3.3.2

[Madhuri-cs]

Snyk has created this PR to upgrade node-fetch from 2.7.0 to 3.3.2.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 28 versions ahead of your current version.

• The recommended version was released 3 years ago.

Release notes

Package name: node-fetch

• 3.3.2 - 2023-07-25
  

  3.3.2 (2023-07-25)

  Bug Fixes

  • Remove the default connection close header. (#1736) (8b3320d), closes #1735 #1473
• 3.3.1 - 2023-03-11
  

  3.3.1 (2023-03-11)

  Bug Fixes

  • release "Allow URL class object as an argument for fetch()" #1696 (#1716) (7b86e94)
• 3.3.0 - 2022-11-10
  

  3.3.0 (2022-11-10)

  Features

  • add static Response.json (#1670) (55a4870)
• 3.2.10 - 2022-07-31
  

  3.2.10 (2022-07-31)

  Bug Fixes

  • ReDoS referrer (#1611) (2880238)
• 3.2.9 - 2022-07-18
  

  3.2.9 (2022-07-18)

  Bug Fixes

  • Headers: don't forward secure headers on protocol change (#1599) (e87b093)
• 3.2.8 - 2022-07-12
• 3.2.7 - 2022-07-11
• 3.2.6 - 2022-06-09
• 3.2.5 - 2022-06-01
• 3.2.4 - 2022-04-28
• 3.2.3 - 2022-03-11
• 3.2.2 - 2022-03-07
• 3.2.1 - 2022-03-01
• 3.2.0 - 2022-01-20
• 3.1.1 - 2022-01-16
• 3.1.0 - 2021-11-08
• 3.0.0 - 2021-08-31
• 3.0.0-beta.6-exportfix - 2020-05-25
• 3.0.0-beta.10 - 2021-07-19
• 3.0.0-beta.9 - 2020-09-05
• 3.0.0-beta.8 - 2020-08-10
• 3.0.0-beta.7 - 2020-06-11
• 3.0.0-beta.6 - 2020-05-25
• 3.0.0-beta.5 - 2020-04-22
• 3.0.0-beta.4 - 2020-03-14
• 3.0.0-beta.3 - 2020-03-13
• 3.0.0-beta.2 - 2020-03-13
• 3.0.0-beta.1 - 2020-03-13
• 2.7.0 - 2023-08-23

from node-fetch GitHub release notes

---

Important

• Warning: This PR contains a major version upgrade, and may be a breaking change.
• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	2	1	10	✅ Passed
🟠 High Severity	13	4	25	✅ Passed
🟡 Medium Severity	21	16	500	✅ Passed
🔵 Low Severity	0	2	1000	✅ Passed

⏱️ SLA Breach Summary

⚠️ Warning: The following vulnerabilities have exceeded their SLA thresholds (days since publication).

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	1	15 / 30 days	⚠️ Warning
🟠 High	0	1	30 / 120 days	⚠️ Warning
🟡 Medium	0	3	90 / 365 days	⚠️ Warning
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 1
• High without fixes: 4
• Medium without fixes: 16
• Low without fixes: 2

⚠️ BUILD PASSED WITH WARNINGS - SLA breaches detected for issues without available fixes

Consider reviewing these vulnerabilities when fixes become available.

[abhishek-ezhava-cstk]

Closing: not mergeable as-is. node-fetch v3 is ESM-only, and this plugin is CommonJS (main: gatsby-node.js, no "type": "module"), so the bump would break require() for consumers. npm audit reports no advisory against the current ^2.7.0, so there is no exposure in staying on v2. A move to v3 needs an ESM migration tracked separately.

Also closed as secret-scan hygiene — the commit message on this branch embeds a Snyk project URL that TruffleHog flags as a SnykKey (false positive; it is a dashboard project ID, not an API key).