Dug up this resolution comment (see other resolutions linked in there too): node-fetch/node-fetch#1793 (comment)

Reverted the node-fetch upgrade (@ maintainers, please follow up as you like) in favour of overriding the whatwg-url dependency.
Throwing in an npm audit fix on top ;)

@MKRhere please have a look!

Telegraf v4 started support with Node 12, and while that's too old now, I'm not sure if we should break compat within a major release. v5 is still a while away and it removes node-fetch completely in favour of native. I wonder if we should just request users to add overrides in newer versions of Node? Or considering Node may break compat in newer versions by removing the deprecated punycode module, perhaps we should break Node <18 compat after all, hmmm...

Minor version 4 update dropping node <18 compat seems the way to go imo if v5 is too far away

Hi! Upstream is dead since last year, so I've started a community fork telegraf-hardened. I'd love to have your PR there: https://github.com/siakinnik/telegraf-hardened/issues/1

✅ Implemented | Zero-Dependency Network Layer (Native Fetch) | @siakinnik | Dropped node-fetch & abort-controller, migrated to native Node.js 18+ API.

@siakinnik do you really need this PR if you dropped node-fetch?

✅ Implemented | Zero-Dependency Network Layer (Native Fetch) | @siakinnik | Dropped node-fetch & abort-controller, migrated to native Node.js 18+ API.

@siakinnik do you really need this PR if you dropped node-fetch?

Thanks for checking in! You're absolutely right, I don't need it anymore.
Feel free to check out my fork if you're interested

Superseded by #2092: the v6 dependency refresh moves to node-fetch 3 and no longer carries the old whatwg-url path that produced the punycode warning.

Tracking PR: #2092