Explicit versions prevent fixing npm vulnerabilities

[m3fawner]

Lodash 4.17.20 has a reported vulnerability addressed in version 4.17.21, however, as a result of explicitly requiring 4.17.20 in Dyson, we can't effectively address the vulnerability.

Would you be against having all of the packages have the appropriate semantic modifiers?

[webpro]

Good idea, I've just published v4 (major bump because of Node.js v10).

[m3fawner]

Thank you!