[security] Dependency has a security issue

[paul-marechal]

https://nvd.nist.gov/vuln/detail/CVE-2018-3728

This issue concerns the hoek nodejs package, that we are using indirectly via subdependencies.

It seems like in our case, less@2.7.3 is at the root of the problem, from @theia/application-manager.

Should we bump this package version and try to get a more up-to-date hoek version this way ?

Are there other places where we would depend on hoek < 4.x.x ?

[paul-marechal]

@svenefftinge @akosyakov @akosyakov @marcdumais-work

[paul-marechal]

yarnpkg/yarn#5808 this would help diagnosing Theia's yarn.lock.

[kittaakos]

@marechal-p, can we close this?

[marcdumais-work]

I think so, yes.