Upgrade tough-cookie to a version without regex DoS vulnerability

[rouanw]

tough-cookie version <=2.3.2 is currently vulnerable to a regex denial of service attack. See https://nodesecurity.io/advisories/525.

This issue has been fixed in tough-cookie v2.3.3. See salesforce/tough-cookie#92.

[coveralls]

Coverage remained the same at 100.0% when pulling 672cb28 on rouanw:upgrade_tough_cookie into 3c2c53c on request:master.

[willmorgan]

Thanks for the quick fix! ❤️

[rouanw]

@analog-nico The builds on Travis for node 0.10, 0.12 and iojs are failing due to syntax errors. This seems to be caused by some dependencies using ES6 syntax. Not sure why this failure has begun now.

[rouanw]

@willmorgan because the tough-cookie fix has been published to npm, you should be able to safely use request-promise because it should automatically pull in the fix due to the >= syntax used in the package.json. See https://docs.npmjs.com/misc/semver. I just like to be explicit 😄

I think it may take a little while for the NSP advisory to be updated.

[analog-nico]

Thanks a lot @rouanw ! I just published request-promise@4.2.2 that includes the fix.

FYI, the build didn’t work because request@latest requires node v4 and up. The build now uses request@2.76.0 for the old node environments which is the latest version that supports them.