upgrade vulnerable package

[pickworth]

No description provided.

[pickworth]

fixes #111

[coveralls]

Coverage remained the same at 93.611% when pulling 57eaca8 on nmors:bugfux-vuln into 1272f87 on mulesoft:master.

[pickworth]

I also updated to package version for negotiator in node-request-error-handler
0.6.0 -> 0.6.1 ( see: mulesoft-labs/node-request-error-handler#3 , reason: https://nodesecurity.io/advisories/106 )

mulesoft-labs/node-request-error-handler#3 will need merged and updated in NPM BEFORE this is merged, as request-error-handler will be bumped to 1.0.3 (travis test should then pass)

[sichvoge]

@nmors travis is failing, can you have a look please.

[pickworth]

@sichvoge as I mentioned (when I updated my previous comment), travis will fail until mulesoft-labs/node-request-error-handler#3 is merged first, as the downstream bumped version will not resolve

[sichvoge]

I have let the team know about that, and we will resolve the issue as soon as possible.

[tbruno]

We are making use of Caret ranges (https://docs.npmjs.com/misc/semver#caret-ranges-123-025-004)

Allows changes that do not modify the left-most non-zero digit in the [major, minor, patch] tuple. In other words, this allows patch and minor updates for versions 1.0.0 and above, patch updates for versions 0.X >=0.1.0, and no updates for versions 0.0.X.

So by having "request-error-handler": "^1.0.0" in Osprey's package.json and "negotiator": "^0.6.0" in request-error-handler's package.json, we are indeed telling NPM to install the latest minor and patch in 1.x.x for "request-error-handler" and the latest patch in 0.6.x for "negotiator".

[danielwpz]

Please merge this and #157
For security issues, we shall NEVER allow a potentially vulnerable dependency to be used. We need to be specific that any version that's affected shall be avoided.

[jstoiko]

@danielwpz: this PR is outdated and doesn't make a difference as @tbruno pointed-out above. Closing.

[danielwpz]

@tbruno @jstoiko caret can be potentially vulnerable to us:
considering the following package.json

  "dependencies": {
    "osprey": "^0.4.1",
    "raml-1-parser": "1.1.39"
  }

In that case osprey won't be using the latest raml-1-parser.