This was done via `npm audit fix`. I think this fixes #903 along with
some more serious vulnerabilities that nobody seems to have noticed.