Update lodash.merge and istanbul/mocha

[cwilby]

Running npm audit brings up some security issues with lodash.merge and istanbul/mocha. This PR updates those dependencies to remove security issues.

I was also able to run the tests successfully.

[coveralls]

Coverage remained the same at 100.0% when pulling c21163b on cwilby:master into 318a09d on codekirei:master.

[macor161]

@cwilby Do you know a good alternative to multispinner? This package doesn't seem to be maintained anymore.

[cwilby]

@macor161 Have a look at cli-spinner, looks somewhat more active.

https://github.com/helloIAmPau/node-spinner