Dependency `lodash.set` has an unpatched CVE

[mhassan1]

The lodash.set package has an open CVE: https://security.snyk.io/vuln/SNYK-JS-LODASHSET-1320032. The maintainer of Lodash will not release a patched version, and he considers the per-method packages soft-deprecated.

We should be able to use set-value as a drop-in replacement.

[mhassan1]

Thanks, @pgrzesik. When do we think this will get an NPM release?

[pgrzesik]

Hello @mhassan1 - I'm waiting for 1 PR to be completed - I would expect it to be released sometime later this week.