Remove vulnerable version of cross-fetch

[wbt]

Closes #401.

[wbt]

Error: #404, reviewer not found

[brianlenz]

Any chance we can get this merged and get a 16.0.4 release pushed?

[brianlenz]

@wbt, you probably should run a yarn install with the change to get yarn.lock updated, too.

But having said that, I realized this alone won't solve the root of the issue, as it's also a transitive dependency from eth-json-rpc-infura This is actually a non-issue, as v16.0.3 uses a newer version that is unaffected.

https://github.com/MetaMask/web3-provider-engine/blob/main/yarn.lock#L3338

[wbt]

@brianlenz I've learned the hard way to exclude package-lock files from PRs to web3 projects. If a maintainer wants to do that, or if someone else wants to issue a PR against my branch awaiting a maintainer's indication that that can be merged first, fine, but I'm not going to sink my own PR by violating a rule like that.

[mcmire]

Okay, I took a look and you're right, it seems like this dependency is no longer used. Seems like someone else in #400 had the same idea too. Thanks so much and sorry for the long delay on this.

[jeffwalsh]

is this available in a public version? i don't see a 16.0.4 with this change a @brianlenz was asking for above

[wbt]

No, there has not been a publish since the time this PR was merged. You could use a git ref if you really want to, but you'll miss future patches unless updating back after this does eventually get published.

[mcmire]

16.0.4 is now released with this change. Cheers!