Update lodash due to security

[Alec321]

Prior versions of lodash have been compromised so you should force users to grab 4.17.11
All tests seem to still run locally.

[coveralls]

Coverage remained the same at 100.0% when pulling c837026 on Alec321:patch-1 into 77e4f18 on request:master.

[CorWatts]

Instead of this, could we merge in #7 and update the lodash deps there?

[Alec321]

@CorWatts You could, however, it looks like #7 removes the dependency and depends on submodules of lodash. It shouldn't hurt merging this in then merging in the #7 .

[analog-nico]

Thanks a lot @Alec321 ! @CorWatts I will take care of your PR as well.

[analog-nico]

I just released request-promise@4.2.3, request-promise-native@1.0.6, and request-promise-any@1.0.6 which include this fix.

[Alec321]

Thank you!

[analog-nico]

Cheers @Alec321 ! :)