bump underscore dependency to 1.6.0 due to #3331