Upgrade request@2.85.0

[epheph]

Fixes hoek vulnerability

[coveralls]

Coverage remained the same at 95.77% when pulling 488c37f on epheph:master into 83ff2cb on nickmerwin:master.

[coveralls]

Coverage remained the same at 95.77% when pulling 488c37f on epheph:master into 83ff2cb on nickmerwin:master.

[davedoesdev]

If I do npm install coveralls it brings in hoek 4.2.1 which is not vulnerable.
This PR isn't required to fix the hoek vulnerability.

https://nodesecurity.io/advisories/566
hapijs/hoek#230

[epheph]

By itself, that's true. Other dependencies in your package.json can cause a vulnerable hoek to be used by coveralls. This package.json:

{
  "name": "some-package",
  "version": "4.11.0-6",
  "devDependencies": {
    "babel-cli": "6.26.0",
    "coveralls": "2.13.3"
  }
}

ends up with this, due to dedupe

└─┬ coveralls@2.13.3
  └─┬ request@2.79.0
    ├─┬ hawk@3.1.3
    │ ├─┬ boom@2.10.1
    │ │ └── hoek@2.16.3 deduped

[ghost]

I'm here because I was about to open a PR of the same nature, too. One of my packages is flagged as being affected by CVE-2018-3728 and my trace got me here.

[davedoesdev]

@epheph that's true but if you use coveralls 3.0.0 then you get a fixed hoek:

{
  "name": "some-package",
  "version": "4.11.0-6",
  "devDependencies": {
    "babel-cli": "6.26.0",
    "coveralls": "3.0.0"
  }
}

produces:

└─┬ coveralls@3.0.0
  └─┬ request@2.85.0
    ├─┬ hawk@6.0.2
    │ ├─┬ boom@4.3.1
    │ │ └── hoek@4.2.1 deduped

[davedoesdev]

There would be a problem if you used a package which fixed request at a lower version than coveralls 3.0.0 does (coveralls uses ^2.79.0).

But shouldn't that be fixed in that package rather than coveralls?

[ghost]

Hello @davedoesdev this is true; however, hoek@4.2.1 isn't "fixed":

[davedoesdev]

Yes 😃

@github are using old data: hapijs/hoek#230 (comment)

https://nodesecurity.io/advisories/566

[ghost]

@davedoesdev Oh, that's interesting. Thank you for the links!

[nickmerwin]

Thanks everyone for the review, closing for now.

[davedoesdev]

FYI github is now marking hoek 4.2.1 as fixed. Re-installing dependencies should get rid of the warning.

[nickmerwin]

@daleharvey thanks, dependencies are updated and warning is gone now.