[Security] Bump request from 2.67.0 to 2.88.2

[dependabot-preview[bot]]

Bumps request from 2.67.0 to 2.88.2. This update includes security fixes.

Vulnerabilities fixed

Sourced from The GitHub Security Advisory Database.

Moderate severity vulnerability that affects request Affected versions of request will disclose local system memory to remote systems in certain circumstances. When a multipart request is made, and the type of body is number, then a buffer of that size will be allocated and sent to the remote server as the body.

Affected versions: >= 2.49.0 < 2.68.0

Sourced from The Node Security Working Group.

Remote Memory Exposure Request is an http client.

If a request is made using multipart, and the body type is a number, then the specified number of non-zero memory is passed in the body.

Example to reproduce:

var request = require('request');
var http = require('http');
var serveFunction = function (req, res){
req.on('data', function (data) {
console.log(data)
});
res.end();
};
var server = http.createServer(serveFunction);
server.listen(8000);
request({
method: "POST",
</tr></table>

... (truncated)

Affected versions: >=2.2.6 2.51.0 <=2.67.0

Changelog

Sourced from request's changelog.

Change Log

v2.88.0 (2018/08/10)

• #2996 fix(uuid): import versioned uuid (@kwonoj)
• #2994 Update to oauth-sign 0.9.0 (@dlecocq)
• #2993 Fix header tests (@simov)
• #2904 #515, #2894 Strip port suffix from Host header if the protocol is known. (#2904) (@paambaati)
• #2791 Improve AWS SigV4 support. (#2791) (@vikhyat)
• #2977 Update test certificates (@simov)

v2.87.0 (2018/05/21)

• #2943 Replace hawk dependency with a local implemenation (#2943) (@hueniverse)

v2.86.0 (2018/05/15)

• #2885 Remove redundant code (for Node.js 0.9.4 and below) and dependency (@ChALkeR)
• #2942 Make Test GREEN Again! (@simov)
• #2923 Alterations for failing CI tests (@gareth-robinson)

v2.85.0 (2018/03/12)

• #2880 Revert "Update hawk to 7.0.7 (#2880)" (@simov)

v2.84.0 (2018/03/12)

• #2793 Fixed calculation of oauth_body_hash, issue #2792 (@dvishniakov)
• #2880 Update hawk to 7.0.7 (#2880) (@kornel-kedzierski)

v2.83.0 (2017/09/27)

• #2776 Updating tough-cookie due to security fix. (#2776) (@karlnorling)

v2.82.0 (2017/09/19)

• #2703 Add Node.js v8 to Travis CI (@ryysud)
• #2751 Update of hawk and qs to latest version (#2751) (@Olivier-Moreau)
• #2658 Fixed some text in README.md (#2658) (@Marketionist)
• #2635 chore(package): update aws-sign2 to version 0.7.0 (#2635) (@greenkeeperio-bot)
• #2641 Update README to simplify & update convenience methods (#2641) (@FredKSchott)
• #2541 Add convenience method for HTTP OPTIONS (#2541) (@jamesseanwright)
• #2605 Add promise support section to README (#2605) (@FredKSchott)
• #2579 refactor(lint): replace eslint with standard (#2579) (@ahmadnassri)
• #2598 Update codecov to version 2.0.2 🚀 (@greenkeeperio-bot)
• #2590 Adds test-timing keepAlive test (@nicjansma)
• #2589 fix tabulation on request example README.MD (@odykyi)
• #2594 chore(dependencies): har-validator to 5.x [removes babel dep] (@ahmadnassri)

v2.81.0 (2017/03/09)

• #2584 Security issue: Upgrade qs to version 6.4.0 (@sergejmueller)
• #2578 safe-buffer doesn't zero-fill by default, its just a polyfill. (#2578) (@mikeal)
• #2566 Timings: Tracks 'lookup', adds 'wait' time, fixes connection re-use (#2566) (@nicjansma)
• #2574 Migrating to safe-buffer for improved security. (@mikeal)
• #2573 fixes #2572 (@ahmadnassri)

v2.80.0 (2017/03/04)

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

If all status checks pass Dependabot will automatically merge this pull request.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language - `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com): - Update frequency (including time of day and day of week) - Pull request limits (per update run and/or open at any time) - Automerge options (never/patch/minor, and dev/runtime dependencies) - Out-of-range updates (receive only lockfile updates, if desired) - Security updates (receive only security updates, if desired)