2nd source of lodash 4.17.14 vulnerability

[fchenTelus]

The problem is at:
cz-conventional-changelog -> @commitlint/load@>6.1.1 -> lodash@4.17.14
Theoretically the > operator you folks have put onto @commitlint/load should fetch the newest version of @commitlint/load (that would in turn use a newer lodash), but it's not happening for me. It will only install up to @commitlint/load@8.1.0 rather than @commitlint/load@9.1.2 which would fix my problem. And running npm update @commitlint/load --depth 10 doesn't solve it either.

Could @commitlint/load be set to a newer version in your package.json dependencies?
Thanks!