Update request to 2.88

[Gwerlas]

The package extend 3.0.1, which is a dependency of request 2.87 has a vulnerability :
https://hackerone.com/reports/381185

Is it possible to upgrade ro request 2.88 which has fix his own package.json to use the fixed extend 3.0.2 ?

[xzyfer]

PRs welcome. If CI is happy we're happy to merge it.

…

On Sat., 15 Sep. 2018, 1:26 am Yoann Colin, ***@***.***> wrote: The package extend 3.0.1, which is a dependency of request 2.87 has a vulnerability : https://hackerone.com/reports/381185 Is it possible to upgrade ro request 2.88 which has fix his own package.json to use the fixed extend 3.0.2 ? — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#2496>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAjZWFBsVdY4HjaxZHP6bwms8C295ohiks5ua8qvgaJpZM4Wpewd> .

[drakonen]

Is there a release with this fix?

[Gwerlas]

Not yet.

I don't know who can make a new release.

[drakonen]

@xzyfer Is there a release planned with this fix? I'd like to use a release instead of a git commit in my package.json.

[danconnell]

Sorry to do this, but: @xzyfer @andre @deanmao @bwilkins @keithamus @LaurentGoderre @nschonni @adamyeats @am11

Can someone please release this to npm?

[xzyfer]

v4.9.4 released

[gaz77a]

angular/angular#21202
As you can see in the link above, there is a similar issue where upgrading request module from 2.87.0 to 2.88.0 also introduces the punycode module v2.1.1 which dropped support for IE11 in v2.0.0.

├─┬ node-sass@3.13.1
│ └─┬ request@2.88.0
│   ├─┬ har-validator@5.1.3
│   │ └─┬ ajv@6.10.0
│   │   └─┬ uri-js@4.2.2
│   │     └── punycode@2.1.1 

Can you suggest how we can fix this for node-sass@3.13.1 without upgrading it to a major version.

[nschonni]

The version of request that node-sass uses should have no affect on your application if you require a particular version for your app. EX: set your request version in you package.json and NPM will separate out node-sass and your apps version

[gaz77a]

Thanks @nschonni, your suggestion worked perfectly! I'm certainly impressed by the quick turnaround of the contributors of this project :)