Fix npm security warnings

This doesn't resolve an actual vulnerability that affects the
server, as the vulnerable marked dependency is never used to
parse untrusted input - this just resolves the warning.

Author: pimterry