{"action":"opened","issue":{"url":"https://api.github.com/repos/mapbox/node-pre-gyp/issues/346","repository_url":"https://api.github.com/repos/mapbox/node-pre-gyp","labels_url":"https://api.github.com/repos/mapbox/node-pre-gyp/issues/346/labels{/name}","comments_url":"https://api.github.com/repos/mapbox/node-pre-gyp/issues/346/comments","events_url":"https://api.github.com/repos/mapbox/node-pre-gyp/issues/346/events","html_url":"https://github.com/mapbox/node-pre-gyp/issues/346","id":297480894,"number":346,"title":"security vulnerability? due to old hawk@3.1.3 (and hoek@2.16.3) dependency","user":{"login":"wvanderdeijl","id":7952432,"avatar_url":"https://avatars1.githubusercontent.com/u/7952432?v=4","gravatar_id":"","url":"https://api.github.com/users/wvanderdeijl","html_url":"https://github.com/wvanderdeijl","followers_url":"https://api.github.com/users/wvanderdeijl/followers","following_url":"https://api.github.com/users/wvanderdeijl/following{/other_user}","gists_url":"https://api.github.com/users/wvanderdeijl/gists{/gist_id}","starred_url":"https://api.github.com/users/wvanderdeijl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wvanderdeijl/subscriptions","organizations_url":"https://api.github.com/users/wvanderdeijl/orgs","repos_url":"https://api.github.com/users/wvanderdeijl/repos","events_url":"https://api.github.com/users/wvanderdeijl/events{/privacy}","received_events_url":"https://api.github.com/users/wvanderdeijl/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-02-15T15:12:34Z","updated_at":"2018-02-15T15:12:34Z","closed_at":null,"author_association":"NONE","body":"in our project, snyk recently started complaining that we have a dependency with a known security vulnerability. It complains about `hoek@2.16.3` which is required by `hawk@3.1.3` which is required by the latest version of `node-pre-gyp`\r\n\r\nthe latest version of `hoek` (version 5.0.3) fixed the vulnerability. But `node-pre-gyp` has locked the version of `hawk` to 3.1.3 while the latest version of `hawk` is 7.0.7. Using such an old version of `hawk` also uses a very old version of `hoek`.\r\n\r\nWould it be easy to upgrade to the latest version of `hawk` so we get the latest version of `hoek` without the vulnerability?\r\n\r\nMore info about the (low prio) vulnerability in `hoek` can be found at https://snyk.io/vuln/npm:hoek:20180212"}}
{"actor":{"display_login":"wvanderdeijl"}}