Security vulnerability in the hoek module, please update the jsonwebtoken module

[papandreou]

A security vulnerability advisory has been issued for the hoek module: https://nodesecurity.io/advisories/566

Hoek is an indirect dependency of nexmo via jsonwebtoken (^7.1.9) -> joi (^6.10.1).

Luckily, jsonwebtoken removed the joi dependency in 8.0.0, so it seems like it's just a matter of updating to jsonwebtoken 8.x. The list of breaking changes in version 8 doesn't look too worrying.

[ralphkocher]

Theres also the used request API effected:

[email protected] > [email protected]

[papandreou]

@mheap, looks like you addressed this in 04fbf96, thanks! Will there be a new (not pre)release soon?

[mheap]

@papandreou 2.2.1 has just been released via NPM. Thanks for reporting, and apologies for the delay