title: Update dependencies in NPM to resolve vulnerability
body: <p>My repo in github show the following alert :</p>
  <p><em>Dependabot cannot update ssri to a non-vulnerable version. The latest possible version that can be installed is 6.0.1 because of the following conflicting dependencies:</em></p>
  <blockquote>
  <p>terser-webpack-plugin@2.3.8 requires ssri@^7.0.0 via cacache@13.0.1</p>
  </blockquote>
  <blockquote>
  <p>webpack@4.46.0 requires ssri@^6.0.1 via a transitive dependency on
  cacache@12.0.4</p>
  </blockquote>
  <p><em>The earliest fixed version is 8.0.1.</em></p>
  <p>As far as I known, I should update the root package (which is terser-webpack-plugin) in <em><strong>package.json</strong></em> to a newer version, but how to determine the minimum version that can support the non-vulnerable version of the dependency (in this case ssri 8.0.1) since I don't want to update to a too high version and risk breaking things. I am thinking of manually checking through all the release version of terser-webpack-plugin, but it's very tedious and seem wrong to check like that. Any suggestions ?</p>