security vulnerability in dependency tree

[nattySP]

nsp caught this and fails our builds --
codecov@3.0.0 > request@2.81.0 > hawk@3.1.3 > hoek@2.x.x

I think updating request should fix the issue.

hoek:
https://nodesecurity.io/advisories/566
Vulnerable <= 4.2.0 || >= 5.0.0 < 5.0.3
Patched > 4.2.0 < 5.0.0 || >= 5.0.3

[davedoesdev]

This is on the @github security alert system now so anyone who owns a project which uses this module anywhere in their dependency tree will being getting alerts.

[eddiemoore]

All updated and released in v3.0.1

[davedoesdev]

@eddiemoore thanks

[davedoesdev]

Note that @github alerts are erroneously saying that hoek@4.2.1 has a vulnerability but it does not (fix was backported to that version: hapijs/hoek#230) - so codecov-node is fine

[polytypic]

Version 3.0.3 reintroduces the vulnerability. See my comment here.

[eddiemoore]

Thanks for the update. Fixes in 3.0.4