Resolve JS security vulnerability in dependency

[brlodi]

The current version of node-sass depends on request 2.79.0, which in turn depends on a package with a known security vulnerability. More recent versions of request have resolved this, but have not yet been upgraded in node-sass.

This is tracked in sass/node-sass#2355 and will be resolved in the next server update of node-sass. We should upgrade our node-sass dependency in package.json at that time.

[vforgione]

Just want to revisit this. Did these imbeciles ever get their shit together?

[brlodi]

You'll note the blocking issue is still open. And this affects several packages we depend on, including Bootstrap itself, beyond our direct use of Sass. They know it's an issue, since every GitHub project depending on node-sass, directly or indirectly (e.g. through Angular), has the same lovely yellow box.

[brlodi]

For completeness, sass/node-sass#2312 and subsequent release is what we, and most of the rest of the JavaScript ecosystem, are waiting on.