ci: audit the dependencies

.github/workflows/ci.yml

@@ -37,6 +37,8 @@ jobs:
         curl -L https://get.pnpm.io/v6.js | node - add --global pnpm@next npm@7
     - name: pnpm install
       run: pnpm install
+    - name: Audit
+      run: pnpm audit
     - name: run tests (main)
       if: github.ref == 'refs/heads/main'
       run: pnpm run test-main

package.json

@@ -54,7 +54,8 @@
       "istanbul-reports": "npm:@zkochan/istanbul-reports",
       "http-errors": "^1.7.3",
       "table@^6.0.3": "6.0.4",
-      "js-yaml@^4.0.0": "npm:@zkochan/js-yaml@0.0.4"
+      "js-yaml@^4.0.0": "npm:@zkochan/js-yaml@0.0.4",
+      "lodash@<4.17.19": "^4.17.9"
     },
     "neverBuiltDependencies": [
       "core-js",

pnpm-lock.yaml

@@ -9,6 +9,7 @@ overrides:
   http-errors: ^1.7.3
   table@^6.0.3: 6.0.4
   js-yaml@^4.0.0: npm:@zkochan/js-yaml@0.0.4
+  lodash@<4.17.19: ^4.17.9
 
 importers:
 
@@ -8634,7 +8635,7 @@ packages:
       cli-cursor: 1.0.2
       cli-width: 1.1.1
       figures: 1.7.0
-      lodash: 3.10.1
+      lodash: 4.17.21
       readline2: 1.0.1
       run-async: 0.1.0
       rx-lite: 3.1.2
@@ -9998,10 +9999,6 @@ packages:
     resolution: {integrity: sha1-lDbjTtJgk+1/+uGTYUQ1CRXZrdg=}
     dev: true
 
-  /lodash/3.10.1:
-    resolution: {integrity: sha1-W/Rejkm6QYnhfUgnid/RW9FAt7Y=}
-    dev: true
-
   /lodash/4.17.21:
     resolution: {integrity: sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==}