{
  "name": "eclairjs",
  "version": "0.8.0",
  "description": "Node.js API for Apache Spark with Remote Client",
  "author": "EclairJS <info@eclairjs.org>",
  "main": "./lib/index.js",
  "repository": {
    "type": "git",
    "url": "git://github.com/EclairJS/eclairjs-node.git"
  },
  "dependencies": {
    "jupyter-js-services": "^0.16.3",
    "request": "2.67.x",
    "xmlhttprequest": "^1.8.0",
    "ws": "^1.1.1"
  },
  "devDependencies": {
    "chai": "3.4.x",
    "jsdoc": "git+https://github.com/jsdoc3/jsdoc.git",
    "mocha": "2.3.x"
  },
  "files": [
    "LICENSE",
    "README.md",
    "lib/"
  ],
  "scripts": {
    "test": "mocha --harmony test/*.js",
    "integration-test": "mocha --harmony test/it/it.js"
  },
  "license": "Apache-2.0",
  "engine": "node >= 0.12"
}
{
  "name": "eclairjs",
  "version": "0.8.0",
  "description": "Node.js API for Apache Spark with Remote Client",
  "author": "EclairJS <info@eclairjs.org>",
  "main": "./lib/index.js",
  "repository": {
    "type": "git",
    "url": "git://github.com/EclairJS/eclairjs-node.git"
  },
  "dependencies": {
    "jupyter-js-services": "^0.16.3",
    "request": "2.74.0",
    "xmlhttprequest": "^1.8.0",
    "ws": "^1.1.1"
  },
  "devDependencies": {
    "chai": "3.4.x",
    "jsdoc": "git+https://github.com/jsdoc3/jsdoc.git",
    "mocha": "2.3.x"
  },
  "files": [
    "LICENSE",
    "README.md",
    "lib/"
  ],
  "scripts": {
    "test": "mocha --harmony test/*.js",
    "integration-test": "mocha --harmony test/it/it.js"
  },
  "license": "Apache-2.0",
  "engine": "node >= 0.12"
}

Fix for 2 vulnerable dependency paths
Fix for 2 vulnerable dependency paths

eclairjs-node currently has a vulnerable dependency, introducing 2 different types of known vulnerabilities.

[ReDOS vulnerability](https://snyk.io/vuln/npm:tough-cookie:20160722) in the `tough-cookie` dependency and  [remote memory exposure ](https://snyk.io/vuln/npm:request:20160119) vulnerability in the `request` dependency.
You can see [Snyk test report](https://snyk.io/test/github/EclairJS/eclairjs-node) of this project for details.

This PR changes `Package.json` to upgrade `request` to the newer 2.74.0 version, which uses the fixed `tough-cookie`  version 2.3.1, and does not pull in any other vulnerable dependencies.
You can get alerts and fix PRs for future vulnerabilities for free by [watching this repo with Snyk](https://snyk.io/add).


Full disclosure: I'm a part of the Snyk team, just looking to spread some security goodness and awareness ;)