Updated request to avoid security vulnerability in dep by rankida · Pull Request #20 · npm/cli

rankida · 2018-07-18T09:39:52Z

Hi,

Older versions of hoek have a security vulnerability https://snyk.io/vuln/npm:hoek:20180212 and this is pulled in by old versions of request.

This PR simply bumps request to to 2.87.0 (from 2.81.0) to avoid this issue.

Please let me know if I have done anything wrong with this PR.

Thanks!

zkat · 2018-07-18T20:31:39Z

We are intentionally not upgrading request to 2.87.0 until node-gyp gets around to unpinning that package. We can't really do much about it being in our tree, and having the toplevel request be a different version than what node-gyp uses is significantly increasing the package size for our distributed tarball.

As far as we're concerned, the issues with hoek do not pose a risk to npm itself, which is why we decided to let the audit be a little noisy for now.

You wanna try and convince the node-gyp folks to fix that bit? :)

zkat · 2018-07-19T00:56:51Z

I'm gonna actually close this, and there's also a more thorough answer on the discussion board: https://npm.community/t/npm-i-npm-6-2-0-latest-shows-security-noise/709/3

tl;dr you're safe. Like, for sure.

rankida · 2018-07-19T07:00:08Z

Thanks for taking the time to reply.

Cheers!

rankida · 2018-07-18T09:39:52Z

Hi,

Older versions of hoek have a security vulnerability https://snyk.io/vuln/npm:hoek:20180212 and this is pulled in by old versions of request.

This PR simply bumps request to to 2.87.0 (from 2.81.0) to avoid this issue.

Please let me know if I have done anything wrong with this PR.

Thanks!

zkat · 2018-07-18T20:31:39Z

We are intentionally not upgrading request to 2.87.0 until node-gyp gets around to unpinning that package. We can't really do much about it being in our tree, and having the toplevel request be a different version than what node-gyp uses is significantly increasing the package size for our distributed tarball.

As far as we're concerned, the issues with hoek do not pose a risk to npm itself, which is why we decided to let the audit be a little noisy for now.

You wanna try and convince the node-gyp folks to fix that bit? :)

zkat · 2018-07-19T00:56:51Z

I'm gonna actually close this, and there's also a more thorough answer on the discussion board: https://npm.community/t/npm-i-npm-6-2-0-latest-shows-security-noise/709/3

tl;dr you're safe. Like, for sure.

rankida · 2018-07-19T07:00:08Z

Thanks for taking the time to reply.

Cheers!

rankida · 2018-07-18T09:39:52Z

Hi,

Older versions of hoek have a security vulnerability https://snyk.io/vuln/npm:hoek:20180212 and this is pulled in by old versions of request.

This PR simply bumps request to to 2.87.0 (from 2.81.0) to avoid this issue.

Please let me know if I have done anything wrong with this PR.

Thanks!

zkat · 2018-07-18T20:31:39Z

We are intentionally not upgrading request to 2.87.0 until node-gyp gets around to unpinning that package. We can't really do much about it being in our tree, and having the toplevel request be a different version than what node-gyp uses is significantly increasing the package size for our distributed tarball.

As far as we're concerned, the issues with hoek do not pose a risk to npm itself, which is why we decided to let the audit be a little noisy for now.

You wanna try and convince the node-gyp folks to fix that bit? :)

zkat · 2018-07-19T00:56:51Z

I'm gonna actually close this, and there's also a more thorough answer on the discussion board: https://npm.community/t/npm-i-npm-6-2-0-latest-shows-security-noise/709/3

tl;dr you're safe. Like, for sure.

rankida · 2018-07-19T07:00:08Z

Thanks for taking the time to reply.

Cheers!

rankida · 2018-07-18T09:39:52Z

Hi,

Older versions of hoek have a security vulnerability https://snyk.io/vuln/npm:hoek:20180212 and this is pulled in by old versions of request.

This PR simply bumps request to to 2.87.0 (from 2.81.0) to avoid this issue.

Please let me know if I have done anything wrong with this PR.

Thanks!

zkat · 2018-07-18T20:31:39Z

We are intentionally not upgrading request to 2.87.0 until node-gyp gets around to unpinning that package. We can't really do much about it being in our tree, and having the toplevel request be a different version than what node-gyp uses is significantly increasing the package size for our distributed tarball.

As far as we're concerned, the issues with hoek do not pose a risk to npm itself, which is why we decided to let the audit be a little noisy for now.

You wanna try and convince the node-gyp folks to fix that bit? :)

zkat · 2018-07-19T00:56:51Z

I'm gonna actually close this, and there's also a more thorough answer on the discussion board: https://npm.community/t/npm-i-npm-6-2-0-latest-shows-security-noise/709/3

tl;dr you're safe. Like, for sure.

rankida · 2018-07-19T07:00:08Z

Thanks for taking the time to reply.

Cheers!

rankida · 2018-07-18T09:39:52Z

Hi,

Older versions of hoek have a security vulnerability https://snyk.io/vuln/npm:hoek:20180212 and this is pulled in by old versions of request.

This PR simply bumps request to to 2.87.0 (from 2.81.0) to avoid this issue.

Please let me know if I have done anything wrong with this PR.

Thanks!

zkat · 2018-07-18T20:31:39Z

We are intentionally not upgrading request to 2.87.0 until node-gyp gets around to unpinning that package. We can't really do much about it being in our tree, and having the toplevel request be a different version than what node-gyp uses is significantly increasing the package size for our distributed tarball.

As far as we're concerned, the issues with hoek do not pose a risk to npm itself, which is why we decided to let the audit be a little noisy for now.

You wanna try and convince the node-gyp folks to fix that bit? :)

zkat · 2018-07-19T00:56:51Z

I'm gonna actually close this, and there's also a more thorough answer on the discussion board: https://npm.community/t/npm-i-npm-6-2-0-latest-shows-security-noise/709/3

tl;dr you're safe. Like, for sure.

rankida · 2018-07-19T07:00:08Z

Thanks for taking the time to reply.

Cheers!

rankida · 2018-07-18T09:39:52Z

Hi,

Older versions of hoek have a security vulnerability https://snyk.io/vuln/npm:hoek:20180212 and this is pulled in by old versions of request.

This PR simply bumps request to to 2.87.0 (from 2.81.0) to avoid this issue.

Please let me know if I have done anything wrong with this PR.

Thanks!

zkat · 2018-07-18T20:31:39Z

We are intentionally not upgrading request to 2.87.0 until node-gyp gets around to unpinning that package. We can't really do much about it being in our tree, and having the toplevel request be a different version than what node-gyp uses is significantly increasing the package size for our distributed tarball.

As far as we're concerned, the issues with hoek do not pose a risk to npm itself, which is why we decided to let the audit be a little noisy for now.

You wanna try and convince the node-gyp folks to fix that bit? :)

zkat · 2018-07-19T00:56:51Z

I'm gonna actually close this, and there's also a more thorough answer on the discussion board: https://npm.community/t/npm-i-npm-6-2-0-latest-shows-security-noise/709/3

tl;dr you're safe. Like, for sure.

rankida · 2018-07-19T07:00:08Z

Thanks for taking the time to reply.

Cheers!

rankida · 2018-07-18T09:39:52Z

Hi,

Older versions of hoek have a security vulnerability https://snyk.io/vuln/npm:hoek:20180212 and this is pulled in by old versions of request.

This PR simply bumps request to to 2.87.0 (from 2.81.0) to avoid this issue.

Please let me know if I have done anything wrong with this PR.

Thanks!

zkat · 2018-07-18T20:31:39Z

We are intentionally not upgrading request to 2.87.0 until node-gyp gets around to unpinning that package. We can't really do much about it being in our tree, and having the toplevel request be a different version than what node-gyp uses is significantly increasing the package size for our distributed tarball.

As far as we're concerned, the issues with hoek do not pose a risk to npm itself, which is why we decided to let the audit be a little noisy for now.

You wanna try and convince the node-gyp folks to fix that bit? :)

zkat · 2018-07-19T00:56:51Z

I'm gonna actually close this, and there's also a more thorough answer on the discussion board: https://npm.community/t/npm-i-npm-6-2-0-latest-shows-security-noise/709/3

tl;dr you're safe. Like, for sure.

rankida · 2018-07-19T07:00:08Z

Thanks for taking the time to reply.

Cheers!

rankida · 2018-07-18T09:39:52Z

Hi,

Older versions of hoek have a security vulnerability https://snyk.io/vuln/npm:hoek:20180212 and this is pulled in by old versions of request.

This PR simply bumps request to to 2.87.0 (from 2.81.0) to avoid this issue.

Please let me know if I have done anything wrong with this PR.

Thanks!

zkat · 2018-07-18T20:31:39Z

We are intentionally not upgrading request to 2.87.0 until node-gyp gets around to unpinning that package. We can't really do much about it being in our tree, and having the toplevel request be a different version than what node-gyp uses is significantly increasing the package size for our distributed tarball.

As far as we're concerned, the issues with hoek do not pose a risk to npm itself, which is why we decided to let the audit be a little noisy for now.

You wanna try and convince the node-gyp folks to fix that bit? :)

zkat · 2018-07-19T00:56:51Z

I'm gonna actually close this, and there's also a more thorough answer on the discussion board: https://npm.community/t/npm-i-npm-6-2-0-latest-shows-security-noise/709/3

tl;dr you're safe. Like, for sure.

rankida · 2018-07-19T07:00:08Z

Thanks for taking the time to reply.

Cheers!

Updated request to avoid security vulnerability in dep
2d76e54

rankida requested a review from a team as a code owner July 18, 2018 09:39

zkat closed this Jul 19, 2018

This was referenced Jul 19, 2018
npm audit complains about a security vulnerability in hoek nodejs/node-gyp#1502
Closed
bump request to 2.87.0 nodejs/node-gyp#1492
Closed

FumiyaShibusawa mentioned this pull request Jul 23, 2018
update: updated node modules version instead FumiyaShibusawa/css-animations#5
Merged

maclover7 mentioned this pull request Aug 9, 2018
node-gyp@3.8.0 #44
Closed

koralle pushed a commit to koralle/npm-cli that referenced this pull request Feb 11, 2026
feat: removehello(npm#20)
8597029

Jah-yee pushed a commit to Jah-yee/cli that referenced this pull request Apr 16, 2026
chore: release versions (npm#20)
7ba65cf

github-actionsBot referenced this pull request in Kevinlee7250/cli Jun 4, 2026
📊 대시보드 데이터 업데이트 (#20)
4426b4e

github-actionsBot referenced this pull request in Kevinlee7250/cli Jun 30, 2026
🤖 봇 응답 (#20)
a19d3b0

github-actionsBot referenced this pull request in Kevinlee7250/cli Jul 3, 2026
🔧 자동 수리 완료 (#20)
0e50462

github-actionsBot referenced this pull request in Kevinlee7250/cli Jul 24, 2026
🔥 트렌드 선점 후보 갱신 (#20)
5659f4f

github-actionsBot referenced this pull request in Kevinlee7250/cli Aug 1, 2026
🔍 구글 색인 상태 리포트 (#20)
59d9e0d

github-actionsBot referenced this pull request in Kevinlee7250/cli Aug 7, 2026
📅 시리즈 발행 예약 처리 (#20)
9407aa1

github-actionsBot referenced this pull request in Kevinlee7250/cli Aug 12, 2026
🔎 AdSense 감사 리포트 (#20)
3e2d703