`node-sql` is currently using a vulnerable version of lodash according to Snyk: https://snyk.io/vuln/npm:lodash:20180130 Lodash needs to be updated to version 4.17.5 or later.