title: How do I update an npm package to the latest commit?
body: <p>Vulnerabilities in the event-stream package as outlined <a href="https://github.com/dominictarr/event-stream/issues/116" rel="nofollow noreferrer">here</a> have meant that I receive the following error when trying to build my application.</p>
  
  <blockquote>
    <p>error An unexpected error occurred:
    "<a href="https://registry.yarnpkg.com/event-stream/-/event-stream-3.3.6.tgz" rel="nofollow noreferrer">https://registry.yarnpkg.com/event-stream/-/event-stream-3.3.6.tgz</a>:
    Request failed \"404 Not Found\"".</p>
  </blockquote>
  
  <p>After some digging, I realised that the <a href="https://github.com/mixmaxhq/mongo-cursor-pagination" rel="nofollow noreferrer">mongo-cursor-pagination</a> package I use had a dependency on <a href="https://www.npmjs.com/package/mongodb-extended-json" rel="nofollow noreferrer">mongodb-extended-json</a>, which in turn depends on the malicious event-stream package.</p>
  
  <p>After some more searching, it became apparent that the maintainers have updated the problematic dependency as shown by <a href="https://github.com/mixmaxhq/mongo-cursor-pagination/pull/56" rel="nofollow noreferrer">this commit</a>.</p>
  
  <p>However, the <a href="https://github.com/mixmaxhq/mongo-cursor-pagination/releases" rel="nofollow noreferrer">latest release</a> v7.1.0 is from 28 June 2018 and doesn't include these changes.</p>
  
  <p>Essentially, I would like my code to include the latest commit to mongo-cursor-pagination but I'm unsure how to go about achieving this.</p>