v1.25.0 pollutes/replaces global.fetch

[djMax]

Describe the bug
I don't precisely know what's happening here because basic steps haven't shown a culprit. But if I upgrade my project to 1.25.0, from 1.24.3, global fetch is now some anonymous function, which breaks all sorts of things.

To Reproduce
Steps to reproduce the behavior:

1. Upgrade project
2. Start node and require/import the module
3. Observe fetch is no longer [Function: fetch]

Expected behavior
Leave global alone.

[djMax]

// src/globals.ts
import crypto from "crypto";
var webFetch = global.fetch;
if (typeof global.crypto === "undefined") {
  global.crypto = crypto;
}
global.fetch = (info, init) => {
  init = {
    // Disable compression handling so people can return the result of a fetch
    // directly in the loader without messing with the Content-Encoding header.
    compress: false,
    ...init
  };
  return webFetch(info, init);
};

That's from @hono/node-server. Which, what the actual ** are they doing.

[djMax]

67ba7ad this did it

[djMax]

And some discussion of it honojs/node-server#154

[djMax]

hono fixed this in their latest, would suggest this module upgrade.

[samuv]

Also, hono has a new high severity vulnerability, so upgrading would both fix the fetch override issue and address the vulnerability

I tried to handle this with two PRs:

• fix(deps): resolve pnpm audit vulnerabilities and bump dependencies #1381
• fix(deps): resolve npm audit vulnerabilities and bump dependencies (v1.x backport) #1382

[felixweinberger]

this should be fixed now - @hono/node-server was bumped to 1.19.9 which no longer wraps global.fetch. the fix landed via #1382 for v1.x. if you're still seeing this on the latest release, let us know and we'll reopen.