How to get rid of the ‘hoek’ vulnerabilities

I recently pushed an Angular CLI 5 application to GitHub and it indicated the following:

We found a potential security vulnerability in one of your dependencies.
A dependency defined in net-incident/package-lock.json has known security vulnerabilities and should be updated.
Dependencies defined in net-incident/package-lock.json 816
hapijs / hoek Known security vulnerability in 2.16.3

I have gone through the output from ‘npm audit’ and executed the various updates, including the following (which was not suggested):

npm install --save-dev request@2.86.0

The ‘request’ package contains ‘hawk’ which contains ‘hoek’. When I look at the ‘request’ package in node_modules the version has changed. But the following two updates from ‘npm audit’ do not seem to do anything:

npm update fsevents --depth 4 npm update stringstream --depth 5

And I am left with the following:

[!] 33 vulnerabilities found [12201 packages audited]
    Severity: 5 Low | 24 Moderate | 4 High
    Run `npm audit` for more detail

And many of the vulnerabilities are like the following:

Moderate        Prototype pollution
Package         hoek
Patched in      > 4.2.0 < 5.0.0 || >= 5.0.3
Dependency of   karma
Path            karma > log4js > loggly > request > hawk > boom > hoek
More info       https://nodesecurity.io/advisories/566

In the end, the application would not compile, so I replaced the the package and lock files, and now I am back to the beginning. I really want to fix the security issues. How do I get rid of the pesky ‘hoek’ vulnerabilities?

from How to get rid of the ‘hoek’ vulnerabilities