AFAIK, 3.3.4, which is pinned specifically in our package.json is unaffected. I don't think this requires an update to 4.0.1.
Also, PR #168 aims to replace event-stream entirely, which may be a more preferable path to a) remove a quasi grab-bag package, and b) disassociate this package from the stigma that now surrounds event-stream.
Thank you for the PR, @thib-rdr.
AFAIK, 3.3.4, which is pinned specifically in our package.json is unaffected. I don't think this requires an update to 4.0.1.
Also, PR #168 aims to replace event-stream entirely, which may be a more preferable path to a) remove a quasi grab-bag package, and b) disassociate this package from the stigma that now surrounds event-stream.