Multiple NPM packages contain security vulnerabilities

[alonseg]

The currently used version contains these vulnerabilities according to WhiteSource
1.

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Required solution:
Up[grade Lodash to v4.17.12

tilestrata-mapnik/package.json

Line 26 in 81770a0

"lodash": "^3.10.1",

[alonseg]

All of the following packages (on these used versions, or one of their dependencies) contain security vulnerabilities and must be upgraded

lodash-3.10.1.tgz
mime-1.3.6.tgz
fstream-1.0.11.tgz
tar-2.2.1.tgz
extend-3.0.1.tgz
cryptiles-2.0.5.tgz
hoek-2.16.3.tgz