hoek dependency potential security vulnerability

Github sent me the message: We found a potential security vulnerability in one of your dependencies. A dependency defined in ./package-lock.json has known security vulnerabilities and should be updated.

When I click on the details it say:

When I looked at what package is dependent on hoek I found this.

# npm ls hoek
/code
└─┬ gulp-sass@4.0.1
  └─┬ node-sass@4.9.0
    └─┬ request@2.79.0
      └─┬ hawk@3.1.3
        ├─┬ boom@2.10.1
        │ └── hoek@2.16.3  deduped
        ├── hoek@2.16.3
        └─┬ sntp@1.0.9
          └── hoek@2.16.3  deduped

[RileyManda]

The solution to this issue is to change the version manually in your package-lock.json. Change your version manually from 2.16.3 to 4.2.1 "hoek": { "version": "4.2.1", "resolved": "https://registry.npmjs.org/hoek/-/hoek-4.2.1.tgz", "integrity": "sha1-ILt0A9POo5jpHcRxCo/xuCdKJe0=", "dev": true Then update your project on GitHub(commit/push) Just make sure every hoek version in your package-lock.json version is changed to 4.2.1

[xzyfer]

This is unavoidable for at the moment. We need node-gyp to bump their request dependency.

Redirect your enthusiasm @ https://github.com/nodejs/node-gyp/pull/1492