{
  "name": "harvest",
  "version": "0.1.5",
  "description": "Harvest API client library",
  "main": "index.js",
  "scripts": {
    "test": "mocha --no-timeouts"
  },
  "repository": "https://github.com/log0ymxm/node-harvest",
  "author": "Paul English",
  "license": "MIT",
  "dependencies": {
    "append-query": "^1.1.0",
    "async": "^1.5.0",
    "day-of-year": "^0.1.0",
    "request": "~2.55.0",
    "restler": "~3.2.2"
  },
  "devDependencies": {
    "config": "~1.13.0",
    "coveralls": "^2.11.2",
    "istanbul": "^0.3.14",
    "mocha": "~2.2.5",
    "mocha-lcov-reporter": "0.0.2"
  }
}

{
  "name": "harvest",
  "version": "0.1.5",
  "description": "Harvest API client library",
  "main": "index.js",
  "scripts": {
    "test": "mocha --no-timeouts"
  },
  "repository": "https://github.com/log0ymxm/node-harvest",
  "author": "Paul English",
  "license": "MIT",
  "dependencies": {
    "append-query": "^1.1.0",
    "async": "^1.5.0",
    "day-of-year": "^0.1.0",
    "request": "~2.74.0",
    "restler": "~3.2.2"
  },
  "devDependencies": {
    "config": "~1.13.0",
    "coveralls": "^2.11.2",
    "istanbul": "^0.3.14",
    "mocha": "~2.2.5",
    "mocha-lcov-reporter": "0.0.2"
  }
}

Fix for 2 vulnerable dependency paths
Fix for 2 vulnerable dependency paths

node-harvest currently has a 4 vulnerable dependency paths, introducing 4 different types of known vulnerabilities.

This PR fixes vulnerable dependencies, [remote memory exposure ](https://snyk.io/vuln/npm:request:20160119) vulnerability in the `request` dependency and [ReDos vulnerability](https://snyk.io/vuln/npm:hawk:20160119) in the `hawk` dependency.

You can see [Snyk test report](https://snyk.io/test/github/log0ymxm/node-harvest) of this project for details. 

This PR changes `Package.json` to upgrade `request` to the newer 2.74.0 version, and will fix the vulnerability listed above.

You can get alerts and fix PRs for future vulnerabilities for free by [watching this repo with Snyk](https://snyk.io/add).

Note this PR fixes all the vulnerabilities introduced trough `request` dependency, in order to be vulnerability free you will need to upgrade `restler` dependency as well.

Stay Secure,
The Snyk Team