Upgrade winston to clear vulnerability reported by snyk.io

[YasharF]

DISCLOSED: 01/19/2016, PUBLISHED: 03/22/2016

Remote Memory Exposure

Medium severity
Vulnerable module: request
Introduced through: winston@0.6.2
Detailed paths and remediation

Introduced through: node-foursquare@node-foursquare#080e97e512dfdf42ab42e9b2a83928405a7faebe › winston@0.6.2 › request@2.9.203

Remediation: Upgrade to winston@0.8.0.

Overview
A potential remote memory exposure vulnerability exists in request. If a request uses a multipart attachment and the body type option is number with value X, then X bytes of uninitialized memory will be sent in the body of the request.

Note that while the impact of this vulnerability is high (memory exposure), exploiting it is likely difficult, as the attacker needs to somehow control the body type of the request. One potential exploit scenario is when a request is composed based on JSON input, including the body type, allowing a malicious JSON to trigger the memory leak.

[YasharF]

Can you please make sure that the change is published to npm repo?

Thanks

[clintandrewhall]

I'll get this out right away. Sorry for the delay-- been heads down at work and not in github as often as I used to be.