exchange cs (for csr) and lodash (for underscore)

- also updated other libraries
Can you add `lib` to the npub ignore in `package.json`? Right now we get duplicated license headers in these files.