Bump merge to 2.1.1

Fixes:
* https://security.snyk.io/vuln/SNYK-JS-MERGE-1040469
* https://security.snyk.io/vuln/SNYK-JS-MERGE-1042987

`vue-bootstrap-toggle` only uses a single function of `merge`. That function still exists in v2 of `merge`, so this version bump is not a breaking change.
See https://github.com/rhyek/vue-bootstrap-toggle/blob/16cf66e4346119ea5b72ec2abeafe524b55bbaee/src/index.vue#L51

Further, the vulnerabilities (both prototype pollutions) are not exploitable, as neither of the arguments passed to `merge.recursive` are user-controllable.

Still performing the update to make scanners happy.

Signed-off-by: nscuro <[email protected]>

Author: nscuro

package-lock.json

@@ -67,6 +67,11 @@
     "uuid": "7.0.3",
     "vue-template-compiler": "2.6.14"
   },
+  "overrides": {
+    "vue-bootstrap-toggle": {
+      "merge": "2.1.1"
+    }
+  },
   "browserslist": [
     "> 1%",
     "last 2 versions",