Build: replace yarn.lock with package-lock.json

Also update deps to fix vulnerabilities warnings.

Closes #1409.

Author: trentmwillis

.travis.yml

@@ -14,10 +14,7 @@ matrix:
       node_js: "10"
       # On Windows, run test:main only instead of test.
       # https://github.com/qunitjs/qunit/issues/1359
-      # On Windows, disable yarn-gpg due to it causing the
-      # build to never finish (background process)
-      # https://travis-ci.community/t/timeout-after-build-finished-and-succeeded/1336
-      env: NPM_SCRIPT=test:main YARN_GPG=no
+      env: NPM_SCRIPT=test:main
     - os: osx
       # On Mac, test only the last LTS.
       node_js: "10"
@@ -27,7 +24,6 @@ matrix:
 script:
   - npm run $NPM_SCRIPT
 cache:
-  yarn: true
   directories:
     - $HOME/.npm
     - $HOME/.cache

CONTRIBUTING.md

@@ -23,12 +23,11 @@ Workflows for documentation or code changes are outlined below.
 
 ### Code
 
-For code changes, you'll need to have [`node.js`](https://nodejs.org/en/) and
-[`yarn`](https://yarnpkg.com/en/) installed on your machine.
+For code changes, you'll need to have [`node.js`](https://nodejs.org/en/) installed on your machine.
 
-Install dependencies in the repository via `yarn install`. Make your code
-changes and run `yarn test` to lint and test the changes. To run tests as you
-make changes to the code base, you can use `yarn dev` which will rebuild QUnit
+Install dependencies in the repository via `npm install`. Make your code
+changes and run `npm test` to lint and test the changes. To run tests as you
+make changes to the code base, you can use `npm run dev` which will rebuild QUnit
 and run tests any time you make a change to the source code.
 
 Almost all code changes should be accompanied by new unit tests to verify the