Downgrade event-stream to 3.3.4

[Duhemm]

The NPM package flatmap-stream is considered malicious. A malicious
actor added this package as a dependency to the NPM event-stream package
in versions 3.3.6 and later. Users of event-stream are encouraged to
downgrade to the last non-malicious version, 3.3.4.

See dominictarr/event-stream#116

[smarter]

Can you remove all the changes that replace https by http ? My npm doesn't do that

[Duhemm]

Can you remove all the changes that replace https by http ? My npm doesn't do that

That's super strange, it looks like this a known issue in npm: https://npm.community/t/npm-install-downgrading-resolved-packages-from-https-to-http-registry-in-package-lock-json/1818

I've replaced all http:// by https://, can you check that everything is still working okay for you?

[smarter]

All our transitive dependencies that depend on event-streams have released new versions with 3.3.4 hardcoded (also the malicious 3.3.6 was deleted from the npm registry). So instead of hardcoding it ourselves, we should be able to just do "npm update".

[Duhemm]

@smarter npm upgrade hopefully did the trick. flatmap-stream disappeared from our dependencies.

... Though I really don't know why we have so many more dependencies. Did I do something wrong with npm?

[smarter]

... Though I really don't know why we have so many more dependencies. Did I do something wrong with npm?

They appear to be transitive dependencies of the new vscode, so this is normal.