Bugzilla

Although the actually dependency graph looks fine in `node_modules` (the only copy of lodash installed is `4.17.14`) and there's no actual vulnerable code being installed here, I don't know of a way to update references for sub dependencies  in `package-lock.json` other than upgrading the dependencies themselves. 

We could consider:
- Upgrading affected dependencies (after a quick look it doesn't look like this will completely solve the issue)
- Forking dependencies and force-upgrading them (this doesn't seem particularly sustainable/maintainable)

It looks like this is also an issue for some other `package-lock`s in the tree, I'm curious if :standard8 has found a solution?

Although the actually dependency graph looks fine in `node_modules` (the only copy of lodash installed is `4.17.14`) and there's no actual vulnerable code being installed here, I don't know of a way to update references for sub dependencies  in `package-lock.json` other than upgrading the dependencies themselves. 

We could consider:
- Upgrading affected dependencies (after a quick look it doesn't look like this will completely solve the issue, although this would be good to do anyway)
- Forking dependencies and force-upgrading them (this doesn't seem particularly sustainable/maintainable)

It looks like this is also an issue for some other `package-lock`s in the tree, I'm curious if :standard8 has found a solution?