diff --git a/packages/core/package.json b/packages/core/package.json
index f7c10f83..7fc58f58 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -12,7 +12,7 @@
     "dependencies": {
       "@devinit/prelude": "1.1.1",
       "d3": "5.0.0",
-      "lodash": "4.17.5",
+      "lodash": "4.17.21",
       "plottable": "3.8.2",
       "react": "16.3.1",
       "react-dom": "16.3.1"
diff --git a/packages/core/yarn.lock b/packages/core/yarn.lock
index 22e53baa..53b7869d 100644
--- a/packages/core/yarn.lock
+++ b/packages/core/yarn.lock
@@ -602,9 +602,10 @@ jsonfile@^4.0.0:
   optionalDependencies:
     graceful-fs "^4.1.6"
 
-lodash@4.17.5:
-  version "4.17.5"
-  resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.17.5.tgz#99a92d65c0272debe8c96b6057bc8fbfa3bed511"
+lodash@4.17.21:
+  version "4.17.21"
+  resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.17.21.tgz#679591c564c3bffaae8454cf0b3df370c3d6911c"
+  integrity sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==
 
 loose-envify@^1.0.0, loose-envify@^1.1.0, loose-envify@^1.3.1:
   version "1.3.1"