diff --git a/package-lock.json b/package-lock.json
index 3a26af223..b4eedffaa 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -24,7 +24,7 @@
         "node-esapi": "0.0.1",
         "serve-favicon": "^2.3.0",
         "swig": "^1.4.2",
-        "underscore": "^1.8.3"
+        "underscore": "^1.13.6"
       },
       "devDependencies": {
         "async": "^2.0.0-rc.4",
@@ -35,7 +35,7 @@
         "grunt-concurrent": "^2.3.0",
         "grunt-contrib-jshint": "^3.0.0",
         "grunt-contrib-watch": "^1.0.0",
-        "grunt-env": "latest",
+        "grunt-env": "^1.0.1",
         "grunt-if": "https://github.com/binarymist/grunt-if/tarball/master",
         "grunt-jsbeautifier": "^0.2.12",
         "grunt-mocha-test": "^0.12.7",
@@ -14443,9 +14443,9 @@
       }
     },
     "node_modules/underscore": {
-      "version": "1.9.1",
-      "resolved": "https://registry.npmjs.org/underscore/-/underscore-1.9.1.tgz",
-      "integrity": "sha1-BtzjSg5op7q8KbNluOdLiSUgOWE="
+      "version": "1.13.6",
+      "resolved": "https://registry.npmjs.org/underscore/-/underscore-1.13.6.tgz",
+      "integrity": "sha512-+A5Sja4HP1M08MaXya7p5LvjuM7K6q/2EaC0+iovj/wOcMsTzMvDFbasi/oSapiwOlt252IqsKqPjCl7huKS0A=="
     },
     "node_modules/underscore.string": {
       "version": "3.3.5",
@@ -26768,9 +26768,9 @@
       }
     },
     "underscore": {
-      "version": "1.9.1",
-      "resolved": "https://registry.npmjs.org/underscore/-/underscore-1.9.1.tgz",
-      "integrity": "sha1-BtzjSg5op7q8KbNluOdLiSUgOWE="
+      "version": "1.13.6",
+      "resolved": "https://registry.npmjs.org/underscore/-/underscore-1.13.6.tgz",
+      "integrity": "sha512-+A5Sja4HP1M08MaXya7p5LvjuM7K6q/2EaC0+iovj/wOcMsTzMvDFbasi/oSapiwOlt252IqsKqPjCl7huKS0A=="
     },
     "underscore.string": {
       "version": "3.3.5",
diff --git a/package.json b/package.json
index b2eb65a04..738a09ab0 100644
--- a/package.json
+++ b/package.json
@@ -20,7 +20,7 @@
     "node-esapi": "0.0.1",
     "serve-favicon": "^2.3.0",
     "swig": "^1.4.2",
-    "underscore": "^1.8.3"
+    "underscore": "^1.13.6"
   },
   "comments": {
     "//": "a9 insecure components"