Upgrade event-stream to 3.3.4

[chrisseto]

• A dep of event-stream (flatmap-stream) was recently removed from NPM

See flatmap-stream and the dependencies tab of event-stream.

Note: To reproduce the installation failure, remove package-lock.json, node_modules and run npm install --cache /tmp/empty

[chrimesdev]

@chrisseto should it be a downgrade to 3.3.4 rather than upgrade to 4.0.0?

Vulnerable versions: > 3.3.4
Patched version: No fix
The NPM package flatmap-stream is considered malicious. A malicious actor added this package as a dependency to the NPM event-stream package in versions 3.3.6 and later. Users of event-stream are encouraged to downgrade to the last non-malicious version, 3.3.4.

[durandt]

Agreed with AdamChrimes, the right fix is to target no later version than 3.3.4 ( like lijunle@3e7f933 )
4.0.0 may not contain the malicious code BUT there is yet no guarantee about what future releases will bring.

Even better, remove the dependency toward event-stream since it is not (poorly) maintained.

[muuki88]

LGTM.

[dbemiller]

Even better, remove the dependency toward event-stream since it is not (poorly) maintained.

This turned out to be really easy, so... I did it. See #261.

[chrisseto]

Closed in favor of #261