Package is outdated; depends on vulnerable lodash.merge

[fluffynuts]

Please update deps -- this package brings in security alerts for consumers down the line.