Prototype Pollution Vulnerability

[drewjenkins]

✗ Low severity vulnerability found on hoek@2.16.3

• desc: Prototype Pollution
• info: https://snyk.io/vuln/npm:hoek:20180212
• from: canvas-prebuilt@1.6.5-prerelease.1 > node-pre-gyp@0.6.39 > request@2.81.0 > hawk@3.1.3 > cryptiles@2.0.5 > boom@2.10.1 > hoek@2.16.3

To resolve this, upgrade to node-pre-gyp >= 0.7.0
See mapbox/node-pre-gyp#347

[sizenineelm]

Vulnerability is still there through dependency versions:
-- canvas-prebuilt@1.6.5-prerelease.1 -- node-pre-gyp@0.6.39
-- hawk@3.1.3 +-- boom@2.10.1 | -- hoek@2.16.3 deduped
+-- hoek@2.16.3
-- sntp@1.0.9 -- hoek@2.16.3 deduped

node-pre-gyp has been updated to avoid its dependency issues, so only this needs updated.
https://nodesecurity.io/advisories/566

Edit to add: noted that the version of node-pre-gyp is updated to 0.10.0 in the v2.0.0-alpha branch.

[chearon]

Both the 1.6 series and 2.0 have node-pre-gyp 0.10 now