Update node-pre-gyp

[finnp]

No description provided.

[bnoordhuis]

Why is that needed?

[finnp]

There has been a security vulnerability with deep-extend, which is a nested dependency of node-pre-gyp. Not a big issue, but it shows up as a security warning. https://nodesecurity.io/advisories/612

[remy]

I'm keen to see this merged too - this change fixes a nested vuln (via the bundled deps), which is causing issues filed against upstream packages (in my case, I've already had two nodemon issues raised because of npm's new audit tool).

[ehmicky]

This commit should probably keep the caret, i.e. ^0.10.0 not 0.10.0

[fearphage]

Why is that needed?

Is there some benefit to having outdated dependencies?

[staabm]

Missing ^

[bnoordhuis]

There has been a security vulnerability with deep-extend, which is a nested dependency of node-pre-gyp.

That should have been fixed by the upgrade to node-pre-gyp@0.9.0, see discussion in #201. I don't see any upgrades to deep-extend between 0.9.0 and 0.10.0 so I doubt this fixes anything.

[finnp]

Versions of deep-extend before 0.5.1 are vulnerable to prototype pollution.
https://nodesecurity.io/advisories/612:

And the tree looks like this:

└─┬ fsevents@1.2.3
  └─┬ node-pre-gyp@0.9.1
    └─┬ rc@1.2.6
      └── deep-extend@0.4.2

However I just noticed that node-pre-gyp didn't update rc yet. So this won't help, depends on this to be merged first: mapbox/node-pre-gyp#379

Seems like I overlooked that.