Specify underscore & underscore.string dependencies

The versions are based on the latest compatible version that underscore.string supports.