update deps, switch to lodash