Possibly remove/lock event-stream

[grofit]

I am not entirely sure what is going to be the actual solution to this issue, but event-stream recently was compromised and certain versions depended on flatmap-stream which contained malware, so npm has removed that package, but now a lot of projects depending on event-stream are falling over, so it may be worth seeing if you need the dependency.

Read more here
dominictarr/event-stream#116

[KenEucker]

The dependency of gulp-util, which used flatmap-stream, was removed in #94. This issue is resolved.