Dependency security fix

CVE-2018-16469 alerted us to a vuln in merge pre-1.2.1, which was required transitively in dev through the Jest packages. We upgraded using good ol' npm audit fix so contributors have nothing to fear!