Address security alert

[FokkeZB]

See https://github.com/zapier/zapier-platform-schema/network/alerts

As part of my T3 I thought I'd address some of these in my mailbox.

[xavdid]

approving as not to block you, but I strongly suggest requiring an exact version before merging.

[xavdid]

The lockfile ensures developers all work with the same version, but the lockfile isn't published to the end-user. Info here: https://docs.npmjs.com/files/package-lock.json

[FokkeZB]

O wow, I always thought it guaranteed dependencies for end-user installs as well! I see that's what shrinkwrap does.

I see the same is true for yarn.lock and they actually explain why very well at:
https://yarnpkg.com/blog/2016/11/24/lockfiles-for-all/

First, it’s not going to be every user that is affected by this. It’s well agreed upon that applications should be using lockfiles, and if they are then they won’t be affected by sudden breaking changes.

TOL!