package.json: remove lodash as a dependency