fix: package.json & package-lock.json to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-INFLIGHT-6095116
- https://snyk.io/vuln/SNYK-JS-MINIMIST-2429795
- https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
- https://snyk.io/vuln/SNYK-JS-REQUEST-3361831
- https://snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873

package.json

@@ -190,15 +190,15 @@
     "coffee-fmt": "^0.12.0",
     "coffee-formatter": "^0.1.2",
     "coffeescript": "^1.12.6",
-    "csscomb": "^4.2.0",
+    "csscomb": "^4.3.0",
     "diff": "^3.4.0",
     "editorconfig": "^0.15.0",
-    "eslint": "^4.16.0",
+    "eslint": "^6.0.0",
     "event-kit": "^2.4.0",
     "expand-home-dir": "0.0.3",
     "extend": "^3.0.2",
     "gherkin": "^2.12.2",
-    "handlebars": "^4.1.2",
+    "handlebars": "^4.7.4",
     "js-beautify": "^1.8.1",
     "jscs": "^3.0.7",
     "lodash": "^4.17.13",
@@ -221,7 +221,7 @@
     "typescript": "^2.6.2",
     "typescript-formatter": "^7.0.0",
     "underscore-plus": "^1.6.6",
-    "universal-analytics": "^0.4.16",
+    "universal-analytics": "^0.4.21",
     "uuid": "^3.1.0",
     "which": "^1.3.0",
     "winston": "^2.4.0",