diff --git a/20180728/graphql-server/package.json b/20180728/graphql-server/package.json
index 16b5fc7..afd33cf 100644
--- a/20180728/graphql-server/package.json
+++ b/20180728/graphql-server/package.json
@@ -17,7 +17,7 @@
     "graphql": "^0.13.2",
     "graphql-server-express": "^1.4.0",
     "graphql-tools": "^3.0.5",
-    "lodash": "^4.17.10"
+    "lodash": "^4.17.21"
   },
   "devDependencies": {
     "babel-cli": "^6.26.0",
diff --git a/20180728/graphql-server/yarn.lock b/20180728/graphql-server/yarn.lock
index a42f441..c09f86e 100644
--- a/20180728/graphql-server/yarn.lock
+++ b/20180728/graphql-server/yarn.lock
@@ -1680,7 +1680,7 @@ event-emitter@~0.3.5:
 
 event-stream@~3.3.0:
   version "3.3.4"
-  resolved "http://registry.npmjs.org/event-stream/-/event-stream-3.3.4.tgz#4ab4c9a0f5a54db9338b4c34d86bfce8f4b35571"
+  resolved "https://registry.npmjs.org/event-stream/-/event-stream-3.3.4.tgz#4ab4c9a0f5a54db9338b4c34d86bfce8f4b35571"
   dependencies:
     duplexer "~0.1.1"
     from "~0"
@@ -2519,9 +2519,9 @@ lodash.debounce@^4.0.8:
   version "4.0.8"
   resolved "https://registry.yarnpkg.com/lodash.debounce/-/lodash.debounce-4.0.8.tgz#82d79bff30a67c4005ffd5e2515300ad9ca4d7af"
 
-lodash@^4.17.10, lodash@^4.17.4:
-  version "4.17.10"
-  resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.17.10.tgz#1b7793cf7259ea38fb3661d4d38b3260af8ae4e7"
+lodash@^4.17.10, lodash@^4.17.21, lodash@^4.17.4:
+  version "4.17.21"
+  resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.17.21.tgz#679591c564c3bffaae8454cf0b3df370c3d6911c"
 
 longest@^1.0.1:
   version "1.0.1"