Update hawk to version 4.0.0 🚀

[greenkeeperio-bot]

Hello 👋

🚀🚀🚀

hawk just published its new version 4.0.0, which is not covered by your current version range.

If this pull request passes your tests you can publish your software with the latest version of hawk – otherwise use this branch to work on adaptions and fixes.

Happy fixing and merging 🌴

---

The new version differs by 7 commits .

• a4486be noise
• 4fc847c ES5 build. Closes #154
• 0e3621b node4
• e011181 es6. Closes #153
• 10daa13 Cleanup for #148
• 5e72fa2 Merge pull request #148 from LeviticusMB/parseUri-fix
• 9feb3f4 Rewrite parseUri to handle unusual but valid URI characters.

See the full diff.

---

This pull request was created by greenkeeper.io.
It keeps your software, up to date, all the time.

_{Tired of seeing this sponsor message? Upgrade to the supporter plan! You'll also get your pull requests faster ⚡}

[simov]

On hold until we drop support for everything below 4.0.0 https://twitter.com/eranhammer/status/662013345550065664

[joeycozza]

Hawk@4.1.1 would solve the Node Security Advisory that has just recently been released.

[simov]

The Node Security Advisory 77 was fixed for hawk@3.1.3 as well so you and your code are protected. Not to mention that the fix was about the server implementation of hawk, not the client one.

Resources:

• Fix security vulnerabilities #2021
• Node security advisory issued for Hawk ~3.1 dependency #2020

I'm going to use this comment as references to any new PR about this issue. If you have problems with warning messages about this security issue, contact the authors of that tool to update their database.

[ralphtheninja]

The Node Security Advisory 77 was fixed for hawk@3.1.3 as well so you and your code are protected. Not to mention that the fix was about the server implementation of hawk, not the client one.

@simov Thanks! What's the process of updating nsp to not report on false positives?

[simov]

No idea TBH, I guess they (https://github.com/nodesecurity/nsp) should support things like:

Patched: >=3.1.3 || >=4.1.1

but I'm not sure.

[evilpacket]

I'm updating the advisory to reflect the correct semver versions right now.

[simov]

#2353