fix: declare underscore.string as a dependency