Upgrading to 4.3.2 got npm security warning

Description:

I upgraded to 4.3.2 tonight and during the process, npm reported a vulnerability with a package.

                       === npm audit security report ===

# Run  npm install underscore@1.13.2  to resolve 1 vulnerability
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Arbitrary Code Execution in underscore                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ underscore                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ underscore                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ underscore                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://github.com/advisories/GHSA-cf4h-3jhx-xvhq            │
└───────────────┴──────────────────────────────────────────────────────────────┘

I ran the "fix" command and that downgraded the package.

Is this a concern?

Steps to reproduce:

1. Presumably, this happens when upgrading

Expected behavior:

Packages can be updated without security warnings.

Actual behavior:

See description.

Server Setup Information:

• Version of Rocket.Chat Server: 4.3.2
• Operating System: Linux
• Deployment Method: manual
• Number of Running Instances: 1
• DB Replicaset Oplog:
• NodeJS Version: v12.22.1
• MongoDB Version: 4.2.12

Start with the npm audit report for Rocket.Chat 4.3.2 and inspect the project’s dependency manifests to locate the direct underscore dependency. Confirm whether the supported dependency version removes the warning without the reported downgrade, then rerun the relevant npm audit check to verify that the vulnerability is resolved.