Upgrade dependencies

npm audit gives
```
found 46 vulnerabilities (21 low, 19 moderate, 5 high, 1 critical) in 6373 scanned packages
39 vulnerabilities require semver-major dependency updates.
7 vulnerabilities require manual review. See the full report for details.
```

The one critical vulnerability is
```
Critical Command Injection
Package growl
Dependency of mocha [dev]
Path mocha > growl
More info https://nodesecurity.io/advisories/146
```
This requires growl to be greater than version 1.10.2, which requires mocha to be at least 4.0.1. Currently mocha 3.1.2 is being used.

首先运行 npm audit 并检查报告的 mocha > growl 依赖路径，包括 advisory 详细信息。确定列出的漏洞中哪些可以通过更新依赖项解决，哪些需要手动审查；完成的标准是已解决或记录了严重问题以及更广泛的审计发现。

由索引模型根据 Issue 内容生成。