Vulnerability: hoek should be updated to 5.0.3

[sbrl]

The package hoek is specified in the package-lock.json file at version 4.2.0. When I run npm-remote-ls hoek though, it tells me that version 5.0.3 will suffice. I suggest updating it to mitigate the vulnerability that GitHub has identified.

Here's the reverse-dependency tree generated by npm-remote-ls: https://hastebin.com/enirizinan

[agnivade]

npm update updates it to 4.2.1. Because it is a transitive dependency, I don't know if manually editing package-lock.json is a good idea.

[sbrl]

Hrm true. What I ended up doing for another of my projects is deleting package-lock.json, and using node-check-updates like so:

ncu -u -n -a
npm install

That updated everything to the very latest stable version available. Not sure if it's wise here, but it did the trick for me :P

[vladimyr]

I don't know if manually editing package-lock.json is a good idea.

According to my experience that is a bad idea and should be avoided if possible.

Hrm true. What I ended up doing for another of my projects is deleting package-lock.json, and using node-check-updates

I haven't used ncu in a while but as far as I remember it alters package.json only. Subsequent npm install will respect changes and update package-lock.json accordingly so you don't need to delete it manually and wait for it to get re- generated. 😉

Keeping packages green is typically a good idea but it is also a risky business by definition. If you do it manually try npm-check. It has nice interactive mode and it will warn you about potentially breaking updates.
Mitigating vulnerabilities is another story and it should be done (semi-)automatically relying on 3rd party service to keep track of affected dependencies and bumping those.

Naturally there are dedicated bots providing both services:

1. keeping stuff green: https://greenkeeper.io/ or https://renovatebot.com/
2. keeping stuff safe: https://snyk.io/

All 3 are free for OSS so maybe this is a chance to setup something to avoid future security issues. What do you think @agnivade ?