4.0.0

• 2e7beeb Update vfile-location
  (breaking, potentially, if you or your dependents use typescript)
• 620084f Add funding field to package.json
• 667bb64 Add notes on security