fix: package.json to reduce vulnerabilities

Latest report for donmclean/riko:
https://snyk.io/test/github/donmclean/riko

Some vulnerabilities weren't fixed or ignored, and so will still fail
the Snyk test report.