How to get rid of the ‘hoek’ vulnerabilities : <p>I recently pushed an Angular CLI 5 application to GitHub and it indicated the following:</p>

<pre><code>We found a potential security vulnerability in one of your dependencies.
A dependency defined in net-incident/package-lock.json has known security vulnerabilities and should be updated.
Dependencies defined in net-incident/package-lock.json 816
hapijs / hoek Known security vulnerability in 2.16.3
</code></pre>

<p>I have gone through the output from ‘npm audit’ and executed the various updates, including the following (which was not suggested):</p>

<blockquote>
  <p>npm install --save-dev request@2.86.0</p>
</blockquote>

<p>The ‘request’ package contains ‘hawk’ which contains ‘hoek’.  When I look at the ‘request’ package in node_modules the version has changed.  But the following two updates from ‘npm audit’ do not seem to do anything:</p>

<blockquote>
  <p>npm update fsevents --depth 4 npm update stringstream --depth 5</p>
</blockquote>

<p>And I am left with the following:</p>

<pre><code>[!] 33 vulnerabilities found [12201 packages audited]
    Severity: 5 Low | 24 Moderate | 4 High
    Run `npm audit` for more detail
</code></pre>

<p>And many of the vulnerabilities are like the following:</p>

<pre><code>Moderate        Prototype pollution
Package         hoek
Patched in      &gt; 4.2.0 &lt; 5.0.0 || &gt;= 5.0.3
Dependency of   karma
Path            karma &gt; log4js &gt; loggly &gt; request &gt; hawk &gt; boom &gt; hoek
More info       https://nodesecurity.io/advisories/566
</code></pre>

<p>In the end, the application would not compile, so I replaced the the package and lock files, and now I am back to the beginning.  I really want to fix the security issues.  How do I get rid of the pesky ‘hoek’ vulnerabilities?</p>
