fix: package.json to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-LODASH-6139239

package.json

@@ -35,7 +35,7 @@
     "express-flash": "0.0.2",
     "express-session": "^1.15.6",
     "express-validator": "^4.3.0",
-    "lodash": "^4.17.4",
+    "lodash": "^4.17.17",
     "lusca": "^1.5.2",
     "mongoose": "^4.13.7",
     "morgan": "^1.9.0",
@@ -44,7 +44,7 @@
     "passport-local": "^1.0.0",
     "pug": "^2.0.0-rc.4",
     "request": "^2.83.0",
-    "request-promise": "^4.2.2",
+    "request-promise": "^4.2.6",
     "winston": "^2.4.0"
   },
   "devDependencies": {