diff --git a/extensions/gitpod-web/package.json b/extensions/gitpod-web/package.json
index c9a14fa14c1f51..d432837b4e4b06 100644
--- a/extensions/gitpod-web/package.json
+++ b/extensions/gitpod-web/package.json
@@ -500,7 +500,7 @@
   },
   "dependencies": {
     "gitpod-shared": "0.0.1",
-    "node-fetch": "^2.6.5",
+    "node-fetch": "2.6.7",
     "uuid": "8.1.0",
     "vscode-jsonrpc": "^5.0.1",
     "vscode-nls": "^5.0.0",
diff --git a/extensions/gitpod/package.json b/extensions/gitpod/package.json
index efe84ec4f88cec..bc1f8b060b11e4 100644
--- a/extensions/gitpod/package.json
+++ b/extensions/gitpod/package.json
@@ -3,7 +3,7 @@
 	"displayName": "%displayName%",
 	"description": "%description%",
 	"publisher": "gitpod",
-	"version": "0.0.28",
+	"version": "0.0.29",
 	"license": "MIT",
 	"preview": true,
 	"icon": "resources/gitpod.png",
@@ -45,7 +45,7 @@
 	"dependencies": {
 		"@gitpod/local-app-api-grpcweb": "main",
 		"@improbable-eng/grpc-web-node-http-transport": "^0.14.0",
-		"node-fetch": "^2.6.1",
+		"node-fetch": "2.6.7",
 		"tmp": "^0.2.1",
 		"vscode-nls": "^5.0.0"
 	},
diff --git a/extensions/yarn.lock b/extensions/yarn.lock
index be4037e3098275..3c9f4c99707c61 100644
--- a/extensions/yarn.lock
+++ b/extensions/yarn.lock
@@ -672,17 +672,10 @@ ms@^2.0.0:
   resolved "https://registry.yarnpkg.com/ms/-/ms-2.1.3.tgz#574c8138ce1d2b5861f0b44579dbadd60c6615b2"
   integrity sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==
 
-node-fetch@^2.6.1:
-  version "2.6.6"
-  resolved "https://registry.yarnpkg.com/node-fetch/-/node-fetch-2.6.6.tgz#1751a7c01834e8e1697758732e9efb6eeadfaf89"
-  integrity sha512-Z8/6vRlTUChSdIgMa51jxQ4lrw/Jy5SOW10ObaA47/RElsAN2c5Pn8bTgFGWn/ibwzXTE8qwr1Yzx28vsecXEA==
-  dependencies:
-    whatwg-url "^5.0.0"
-
-node-fetch@^2.6.5:
-  version "2.6.5"
-  resolved "https://registry.yarnpkg.com/node-fetch/-/node-fetch-2.6.5.tgz#42735537d7f080a7e5f78b6c549b7146be1742fd"
-  integrity sha512-mmlIVHJEu5rnIxgEgez6b9GgWXbkZj5YZ7fx+2r94a2E+Uirsp6HsPTPlomfdHtpt/B0cdKviwkoaM6pyvUOpQ==
+node-fetch@2.6.7:
+  version "2.6.7"
+  resolved "https://registry.yarnpkg.com/node-fetch/-/node-fetch-2.6.7.tgz#24de9fba827e3b4ae44dc8b20256a379160052ad"
+  integrity sha512-ZjMPFEfVx5j+y2yF35Kzx5sF7kDzxuDj6ziH4FFbOp87zKDZNx8yExJIb05OGF4Nlt9IHFIMBkRl41VdvcNdbQ==
   dependencies:
     whatwg-url "^5.0.0"