Update node-fetch minimum

[wbt]

Per GHSA-r683-j2x4-v87g

[mcmire]

I already looked at this in another repo, and this makes sense to me.

[wbt]

@mcmire thanks for the merge!
Note that the same high-severity vuln warning will continue showing up for MetaMask developer-users until MetaMask/web3-provider-engine#404 is merged as well. If you know who to poke for a review request on that, it could be helpful!

[mcmire]

@wbt I can take a look. Note that we recommend people use json-rpc-engine instead of web3-provider-engine — we're trying to transition off of it internally ourselves. That said, I know people still rely on that package, so in the meantime, I'll ask and see if we can get a new release out with your PR.

[wbt]

@mcmire Thanks!
The dependency is indirect, via @truffle/hdwallet-provider. If you have collaboration with the Truffle folks, please work with them to do that migration off.

[mcmire]

@wbt Ah, good to know, will reach out!