fix: remove use of node-fetch, use built-in fetch

[shazron]

Motivation and Context

node-fetch@v2's dependencies use the built in punycode module, which is deprecated in node-22, and prints out a deprecation warning.

How Has This Been Tested?

• npm test

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• I have signed the Adobe Open Source CLA.
• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have read the CONTRIBUTING document.
• I have added tests to cover my changes.
• All new and existing tests passed.

[Copilot]

Pull request overview

This PR removes the node-fetch dependency and switches the codebase to Node’s built-in fetch (Node >=20), eliminating deprecation warnings coming from node-fetch@v2’s dependency chain.

Changes:

• Dropped node-fetch from runtime dependencies and removed its usage from src/lib/npm-helper.js.
• Updated unit tests to mock global.fetch instead of node-fetch.
• Added a Jest helper (global.setFetchMock) to simplify fetch mocking across tests.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/lib/npm-helper.js	Removes node-fetch import and relies on built-in fetch.
package.json	Removes node-fetch dependency entry.
jest.setup.js	Adds global.setFetchMock helper for mocking fetch in tests.
test/lib/npm-helper.test.js	Replaces node-fetch mocking with global.fetch mocking via setFetchMock.
test/commands/templates/rollback.test.js	Removes leftover commented node-fetch reference.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[shazron]

@copilot apply changes based on the comments in this thread

[Copilot]

@copilot apply changes based on the comments in this thread

Applied both review suggestions (commit 6503522):

1. jest.setup.js: json() now always resolves regardless of ok status, matching real Fetch API semantics.
2. test/lib/npm-helper.test.js beforeEach: Fixed the mock reset to use global.fetch.mockReset() instead of the previous global.fetchMock.resetMocks() check which was a no-op (since global.fetchMock is never set — we use global.fetch directly). Each test that exercises fetch now explicitly sets up its own mock via global.setFetchMock().

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• scarf.sh
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node ./report.js (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[shazron]

codecov is not running because we don't have secrets: inherit for the reusable workflow. Patching.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!