All (the pull request submitter and all commit authors) CLAs are signed, but one or more commits were authored or co-authored by someone other than the pull request submitter.

We need to confirm that all authors are ok with their commits being contributed to this project. Please have them confirm that by leaving a comment that contains only @googlebot I consent. in this pull request.

Note to project maintainer: There may be cases where the author cannot leave a comment, or the comment is not properly detected as consent. In those cases, you can manually confirm consent of the commit author(s), and set the cla label to yes (if enabled on your project).

ℹ️ Googlers: Go here for more info.

A Googler has manually verified that the CLAs look good.

(Googler, please make sure the reason for overriding the CLA status is clearly documented in these comments.)

ℹ️ Googlers: Go here for more info.

CLI has been signed if #798

@sebastianbenz Seems you omitted cross-fetch, but it's also needed since it's used here

@merceyz cross-fetch is a transitive dependency of toolbox-core

@sebastianbenz That makes us rely on hoisting which is really fragile and prone to breaking. If you want to require it from toolbox-core you should use createRequire or have toolbox-core export it.

Running npm i cross-fetch@1 @ampproject/toolbox-optimizer will produce a tree looking like this:

. -> cross-fetch@1
  -> core -> cross-fetch@3.0.4
  -> optimizer

This breaks optimizer as it will be getting cross-fetch@1 instead of cross-fetch@3.0.4

Thanks for the explanation. Will add it.

Awesome, thank you. Also, the same issue is present for toolbox-cli, it tries to use toolbox-core without declaring it