Workaround lodash security vulnerability in instagram-private-api

`instagram-private-api` uses a deprecated version of `request-promise` which uses a vulnerable version of `lodash`. We simply force the use of a more recent version of `lodash` as `request-promise` doesn't use lodash 3.x specific code.
yannrouillard · Nov 29, 2018 · caef364 · caef364
1 parent 2c321cd
commit caef364
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 309 deletions.
diff --git a/package.json b/package.json
@@ -21,7 +21,8 @@
     "yargs": "^12.0.2"
   },
   "resolutions": {
-    "instagram-private-api/tough-cookie-filestore/tough-cookie": "^2.3.3"
+    "instagram-private-api/tough-cookie-filestore/tough-cookie": "^2.3.3",
+    "instagram-private-api/request-promise": "^4.2.2"
   },
   "devDependencies": {
     "eslint": "^5.7.0",