Bump lodash.merge and xo

Bumps [lodash.merge](https://github.com/lodash/lodash) to 4.6.2 and updates ancestor dependency [xo](https://github.com/xojs/xo). These dependencies need to be updated together.


Updates `lodash.merge` from 3.3.2 to 4.6.2
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](https://github.com/lodash/lodash/commits)

Updates `xo` from 0.9.0 to 1.2.3
- [Release notes](https://github.com/xojs/xo/releases)
- [Commits](xojs/xo@v0.9.0...v1.2.3)

---
updated-dependencies:
- dependency-name: lodash.merge
  dependency-version: 4.6.2
  dependency-type: indirect
- dependency-name: xo
  dependency-version: 1.2.3
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>

Author: dependabot[bot]