Low-severity vulnerability in lodash dependency

**Node version**: 10.16.0
**Sails version** _(sails)_: 1.2.4
**ORM hook version** _(sails-hook-orm)_: 2.1.1
**Sockets hook version** _(sails-hook-sockets)_: 2.0.0
**Organics hook version** _(sails-hook-organics)_: 2.2.0
**Grunt hook version** _(sails-hook-grunt)_: 4.0.1
**Uploads hook version** _(sails-hook-uploads)_: n/a
**DB adapter & version** _(e.g. sails-mysql@5.55.5)_: sails-disk 1.1.2
**Skipper adapter & version** _(e.g. skipper-s3@5.55.5)_: 0.9.0-4

When @eashaw checked for security vulnerabilities yesterday, we saw that sails + a number of related modules we maintain are affected by [this lodash vulnerability](https://www.npmjs.com/advisories/1523):

...luckily, we shouldn't need to make any updates once a fix has been published: the vulnerability is coming in through [`async`](https://github.com/caolan/async/blob/v2.5.0/package.json#L21) and [`encrypted-attr`](https://github.com/simonratner/node-encrypted-attr/blob/master/package.json#L18), which both have loose dependencies on lodash, so the patch should be picked up automatically once it's released. Just wanted to post here so everyone knows it's on our radar and we're keeping an eye on it!

The issue identifies lodash as a transitive dependency through async and encrypted-attr, but names no Sails file or requested change. Review the dependency declarations in the linked async and encrypted-attr package.json files and the current advisory status; done is unclear because the report says no update is needed until a fix is published.

Written by the indexing model from the issue text.