Upgrade dependencies to apply security fixes

[omrilotan]

TL;DR

dep	before	after
depcheck	^0.6.11	^0.9.1
lodash	^4.7.0	^4.17.15

Encompasses and updates on #361 and #371

Step 1 - NPM

npm i

found 184 vulnerabilities (1 low, 3 moderate, 180 high)
  run `npm audit fix` to fix them, or `npm audit` for details

npm audit fix

fixed 183 of 184 vulnerabilities in 4366 scanned packages
  1 vulnerability required manual review and could not be updated

npm audit

output

                       === npm audit security report ===

┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Regular Expression Denial of Service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ braces                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=2.3.1                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ babel-cli [dev]                                              │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ babel-cli > chokidar > anymatch > micromatch > braces        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/786                             │
└───────────────┴──────────────────────────────────────────────────────────────┘

Finally we remain with "braces" as a nested devDependency with a Regex DDoS vulnerability - which I think is negligible.

npm ls braces

[email protected] ~/npm-check
└─┬ [email protected]
  └─┬ [email protected]
    ├─┬ [email protected]
    │ └─┬ [email protected]
    │   └── [email protected]    <---
    └─┬ [email protected]
      └─┬ [email protected]
        └── [email protected]

Step 2 - Snyk

npx snyk test

  Upgrade [email protected] to [email protected] to fix
  ✗ Denial of Service (DoS) [Medium Severity][https://snyk.io/vuln/npm:mem:20180117] in [email protected]
    introduced by [email protected] > [email protected] > [email protected] > [email protected]

I checked depcheck releases. There are no breaking changes

npm i depcheck@latest && npx snyk test

✓ Tested 247 dependencies for known issues, no vulnerable paths found.

[icebob]

When will be merged & released?

[mkarpusiewicz]

Can we have this merged and released please?

[mkarpusiewicz]

@dylang Would you be able to merge this? If you need any help with the project I'm happy to help ;)

[LinusU]

Thanks, sorry for the delay

[LinusU]

Released as [email protected]

[omrilotan]

🎉