Update lodash (or mocha) to address vulnerability reported by npm audit

[walro]

                       === npm audit security report ===                        
                                                                                
┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ lodash                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ No patch available                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ mocha [dev]                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ mocha > yargs-unparser > lodash                              │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1523                            │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 1 low severity vulnerability in 124 scanned packages
  1 vulnerability requires manual review. See the full report for details.

Currently, there's no version of lodash released with a fix for this. See, for instance, https://github.com/lodash/lodash/issues/4836

[walro]

Actually, we can get by this by upgrading mocha as yargs-unparser has dropped the lodash dependency as of 1.6.1. See yargs/yargs-unparser@036fd30 and mochajs/mocha#4354

However, there have been no new release of mocha either :)