security vulnerability? due to old [email protected] (and [email protected]) dependency

[wvanderdeijl]

in our project, snyk recently started complaining that we have a dependency with a known security vulnerability. It complains about [email protected] which is required by [email protected] which is required by the latest version of node-pre-gyp

the latest version of hoek (version 5.0.3) fixed the vulnerability. But node-pre-gyp has locked the version of hawk to 3.1.3 while the latest version of hawk is 7.0.7. Using such an old version of hawk also uses a very old version of hoek.

Would it be easy to upgrade to the latest version of hawk so we get the latest version of hoek without the vulnerability?

More info about the (low prio) vulnerability in hoek can be found at https://snyk.io/vuln/npm:hoek:20180212

[nathany]

More information on the security vulnerability in old versions of hoek:
https://nodesecurity.io/advisories/566
https://hackerone.com/reports/310439

For what it's worth, the patch was also backported to hoek 4.2.1.
https://github.com/hapijs/hoek/commits/v4.x.x

[krotscheck]

This is now also being reported by nsp, https://nodesecurity.io/advisories/566

[guyo13]

Or upgrade to [email protected] which have the patched version of hoek in the packge.json

[pumano]

@springmeyer any news about dependency updates?

[evheniy]

Hi
Webpack has dependency

webpack/webpack#6552

Could you please update hawk to latest version.

Thank you!

[ChALkeR]

That won't fix things, as there is +-- [email protected] → +-- [email protected] deduped dep, which also pulls [email protected] which also pulls in old hoek.

Request has several PRs to fix that, but that didn't happen yet.

Perhaps migrate away from request?

[SebastianSchmidt]

@ChALkeR PR: Remove hawk, upgrade request

[ChALkeR]

@SebastianSchmidt request itself isn't updated yet, that won't help.

[ChALkeR]

@SebastianSchmidt Ah, looks like I was indeed wrong, current request version depends on a patched version — request didn't update, but hoek backported the fix, I missed that.

     '5.0.0': '2017-09-26T04:22:40.507Z',
     '5.0.1': '2017-10-26T08:22:11.034Z',
     '5.0.2': '2017-11-03T09:12:15.703Z',
     '5.0.3': '2018-02-06T17:55:50.172Z',
     '4.2.1': '2018-02-15T16:47:47.274Z' 

[springmeyer]

Fixed by merging #347