Added safe-buffer and updated dependencies

[mcollina]

Fixes #50

[ChALkeR]

Tracking: nodejs/node#19079

[rvagg]

we could remove this I reckon

[rvagg]

yep, lgtm, I think you have enough perms to push through a release @mcollina

[mcollina]

Yes I'll do that.

@ChALkeR can you check if I should backport this to the 0.9.x release line as well?

[ChALkeR]

@mcollina

1.x (together, hope you are backporting to 1.1 and 1.0, those are significant)

Query: "bl@1.
10197105        bl
5680853 tar-stream
3766709 log4js
3545797 karma
2316839 archiver
2234067 tar-fs
1787219 decompress
1753634 decompress-tar
1753011 decompress-targz
1752892 decompress-tarbz2
…

18716 modules total.

0.9

Query: "[email protected]
59537   follow
54484   grunt-google-cdn
37878   gl-scatter2d
37624   gl-error2d
37617   gl-line2d
34128   tsd
33462   codecov.io
31725   gl-scatter2d-sdf
29722   zip-folder
26696   istanbul-middleware
…

4433 modules total.

0.8

Query: "[email protected]
127110  level-sublevel
71615   rollup-plugin-node-builtins
59212   browserify-fs
13685   mosca
10907   dynalite
6666    weaver-sdk
6510    react-native-level-fs
4592    kinesalite
3270    deep-package-manager
3251    node-red-contrib-mqtt-broker
…

760 modules total.

0.7

Query: "[email protected]
23425   vinyl-transform
13103   lasso
10969   raptor-cache
9923    dissolve
7248    response
4292    electrode-archetype-react-app-dev
3102    smild
2735    electrode-electrify
2470    questor
1816    duniter
…

202 modules total.

0.6

Query: "[email protected]
660     hms
…

39 modules total.

You certainly don't need backporting to 0.6, everything else is up to you =).

[ChALkeR]

@mcollina While I'm here, I also suggest considering using my polyfill instead — it would be a three byte change to this PR.

[mcollina]

safe-buffer is already going to be in the tree because of readable-stream and a lot of the other streams module that have been updated so far using it. I'd prefer not updating those at this time.

@rvagg any opinion on the subject?

[ChALkeR]

@mcollina if this was my module, I would have backported to 0.8, I guess.

If that doesn't contain security issues that are fixed in later versions by braking backwards compat — in that case, making it seem like old insecure versions are supported and giving people less reasons to migrate from those would be harmful.