2nd source of lodash 4.17.14 vulnerability

The problem is at:
cz-conventional-changelog -> @commitlint/load@>6.1.1 -> lodash@4.17.14
Theoretically the `>` operator you folks have put onto @commitlint/load should fetch the newest version of @commitlint/load (that would in turn use a newer lodash), but it's not happening for me. It will only install up to @commitlint/load@8.1.0 rather than @commitlint/load@9.1.2 which would fix my problem. And running `npm update @commitlint/load --depth 10` doesn't solve it either.

Could @commitlint/load be set to a newer version in your package.json dependencies?
Thanks!

Start with package.json dependencies and inspect the cz-conventional-changelog -> @commitlint/load -> lodash@4.17.14 chain. Run npm update @commitlint/load --depth 10 to reproduce the reported resolution, then verify that the dependency update removes the lodash vulnerability and does not break the adapter.

Written by the indexing model from the issue text.