Bump event-stream version to remove flatmap-stream dependency

[pedro823]

tl;dr: There is a backdoored dependency on VTEX toolbelt that has malicious code. This does not affect VTEX in specific, however this should be removed anyway. This is important -- It could have been targeted toward VTEX.

On line 2379 of yarn.lock:

flatmap-stream@^0.1.0:
  version "0.1.1"
  resolved "https://registry.yarnpkg.com/flatmap-stream/-/flatmap-stream-0.1.1.tgz#d34f39ef3b9aa5a2fc225016bd3adf28ac5ae6ea"

this is the exact dependency, exact version, that contains malicious code. Version 0.1.2 doesn't have malicious code, and was completely removed by event-stream in the latest version.

For complete information of what that code did, read this article.

Mentioning the original issues of the backdoored code:

dominictarr/event-stream#116
dominictarr/event-stream#115

Possible Solution

Update the dependencies to fully remove the malicious code.

[ghost]

hi