Remove dependency on hawk, upgrade request

[krotscheck]

This patch removes the explicit dependency on hawk, and upgrades request
to the newest version. It also removes node 0.10 from the testing grid,
as this version has been EOL'd by the node foundation, and doesn't support
es6 syntax used in the newer introduced dependencies.

https://nodesecurity.io/advisories/566
https://hackerone.com/reports/310439
https://github.com/nodejs/Release

Closes #346

[krotscheck]

The only mention of hawk appears to be the package.json file:
https://github.com/mapbox/node-pre-gyp/search?utf8=%E2%9C%93&q=hawk&type=

[SebastianSchmidt]

The package request@2.81.0 depends on hawk@3.1.3.
This pull request does not completely remove the dependency on hawk and does not solve #346:

node-pre-gyp@0.6.39 › request@2.81.0 › hawk@3.1.3 › hoek@2.16.3
node-pre-gyp@0.6.39 › request@2.81.0 › hawk@3.1.3 › boom@2.10.1 › hoek@2.16.3
node-pre-gyp@0.6.39 › request@2.81.0 › hawk@3.1.3 › sntp@1.0.9 › hoek@2.16.3
node-pre-gyp@0.6.39 › request@2.81.0 › hawk@3.1.3 › cryptiles@2.0.5 › boom@2.10.1 › hoek@2.16.3

Updating to request@2.83.0 fixes the vulnerability.
request@2.83.0 uses hawk@6.0.2 which depends on hoek@4.2.1 (hapijs/hoek#230):

node-pre-gyp@0.6.39 › request@2.83.0 › hawk@6.0.2 › hoek@4.2.1
node-pre-gyp@0.6.39 › request@2.83.0 › hawk@6.0.2 › boom@4.3.1 › hoek@4.2.1
node-pre-gyp@0.6.39 › request@2.83.0 › hawk@6.0.2 › sntp@2.1.0 › hoek@4.2.1
node-pre-gyp@0.6.39 › request@2.83.0 › hawk@6.0.2 › cryptiles@3.1.2 › boom@5.2.0 › hoek@4.2.1

[krotscheck]

@SebastianSchmidt Done. Jetzt auf Travis warten ⏳

[SebastianSchmidt]

request@2.83.0 and Node 0.10: #320, #342

[krotscheck]

Yeah, saw that. Given that node 0.10 is EOL, I removed it from the testing grid.

[krotscheck]

@springmeyer Any chance you can take a look at this?

[JulianLaval]

Would be great to have this PR merged in -- any updates? 🙂

[kontrollanten]

Any updates on this?

[Pablodotnet]

Any updates on this? We need the merge ASAP!

[nhodges]

Whoops, just saw this PR. I also made a PR to address this, #349. Many packages are waiting on this so it can go upstream.

[ronkorving]

Yeah, waiting too. Does node-pre-gyp only have a single maintainer?

[fenichelar]

Merging this PR and releasing a new version would be great! :)

[springmeyer]

Thanks for this PR. Sorry for the wait in review/merging. Will merge now and release as v0.7.0.

[springmeyer]

node-pre-gyp@0.7.0 is now published: https://www.npmjs.com/package/node-pre-gyp