diff --git a/package.json b/package.json
index 5030175d5..9ba7008b4 100644
--- a/package.json
+++ b/package.json
@@ -6,7 +6,7 @@
   "main": "dist/release/doppio.js",
   "typings": "dist/typings/src/doppiojvm",
   "dependencies": {
-    "async": "^2.0.0",
+    "async": "^2.6.4",
     "browserfs": "1.3.0",
     "glob": "^7.1.1",
     "gunzip-maybe": "^1.3.1",
diff --git a/yarn.lock b/yarn.lock
index 184c7d80a..f1124923a 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -290,17 +290,11 @@ async@^0.9.0:
   version "0.9.2"
   resolved "https://registry.yarnpkg.com/async/-/async-0.9.2.tgz#aea74d5e61c1f899613bf64bda66d4c78f2fd17d"
 
-async@^2.0.0:
-  version "2.2.0"
-  resolved "https://registry.yarnpkg.com/async/-/async-2.2.0.tgz#c324eba010a237e4fbd55a12dee86367d5c0ef32"
-  dependencies:
-    lodash "^4.14.0"
-
-async@^2.1.4, async@^2.6.0:
-  version "2.6.0"
-  resolved "https://registry.yarnpkg.com/async/-/async-2.6.0.tgz#61a29abb6fcc026fea77e56d1c6ec53a795951f4"
+async@^2.0.0, async@^2.1.4, async@^2.6.0, async@^2.6.4:
+  version "2.6.4"
+  resolved "https://registry.yarnpkg.com/async/-/async-2.6.4.tgz#706b7ff6084664cd7eae713f6f965433b5504221"
   dependencies:
-    lodash "^4.14.0"
+    lodash "^4.17.14"
 
 async@~0.2.6:
   version "0.2.10"
@@ -1972,9 +1966,9 @@ lodash@^3.10.1, lodash@^3.3.1, lodash@^3.8.0, lodash@~3.10.1:
   version "3.10.1"
   resolved "https://registry.yarnpkg.com/lodash/-/lodash-3.10.1.tgz#5bf45e8e49ba4189e17d482789dfd15bd140b7b6"
 
-lodash@^4.0.0, lodash@^4.13.0, lodash@^4.14.0, lodash@^4.17.2, lodash@^4.5.0, lodash@^4.6.1, lodash@^4.7.0, lodash@^4.8.0:
-  version "4.17.4"
-  resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.17.4.tgz#78203a4d1c328ae1d86dca6460e369b57f4055ae"
+lodash@^4.0.0, lodash@^4.13.0, lodash@^4.17.14, lodash@^4.17.2, lodash@^4.5.0, lodash@^4.6.1, lodash@^4.7.0, lodash@^4.8.0:
+  version "4.17.21"
+  resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.17.21.tgz#679591c564c3bffaae8454cf0b3df370c3d6911c"
 
 lodash@~4.3.0:
   version "4.3.0"