diff --git a/test-src/package-lock.json b/test-src/package-lock.json
index 899b428..32ee9eb 100644
--- a/test-src/package-lock.json
+++ b/test-src/package-lock.json
@@ -6551,7 +6551,7 @@
           "dependencies": {
             "are-we-there-yet": {
               "version": "1.1.2",
-              "resolved": "http://registry.npmjs.org/are-we-there-yet/-/are-we-there-yet-1.1.2.tgz",
+              "resolved": "https://registry.npmjs.org/are-we-there-yet/-/are-we-there-yet-1.1.2.tgz",
               "integrity": "sha1-gORw6VoIR5T+GJkmLFZnxuiN4bM=",
               "dev": true,
               "requires": {
@@ -6647,7 +6647,7 @@
                       "dependencies": {
                         "number-is-nan": {
                           "version": "1.0.0",
-                          "resolved": "http://registry.npmjs.org/number-is-nan/-/number-is-nan-1.0.0.tgz",
+                          "resolved": "https://registry.npmjs.org/number-is-nan/-/number-is-nan-1.0.0.tgz",
                           "integrity": "sha1-wCD1KcUoKt/dIz2R1LGBw9aG3Es=",
                           "dev": true
                         }
@@ -11558,9 +11558,9 @@
       }
     },
     "underscore": {
-      "version": "1.9.1",
-      "resolved": "https://registry.npmjs.org/underscore/-/underscore-1.9.1.tgz",
-      "integrity": "sha512-5/4etnCkd9c8gwgowi5/om/mYO5ajCaOgdzj/oW+0eQV9WxKBDZw5+ycmKmeaTXjInS/W0BzpGLo2xR2aBwZdg=="
+      "version": "1.12.1",
+      "resolved": "https://registry.npmjs.org/underscore/-/underscore-1.12.1.tgz",
+      "integrity": "sha512-hEQt0+ZLDVUMhebKxL4x1BTtDY7bavVofhZ9KZ4aI26X9SRaE+Y3m83XUL1UP2jn8ynjndwCCpEHdUG+9pP1Tw=="
     },
     "underscore.string": {
       "version": "3.3.5",
diff --git a/test-src/package.json b/test-src/package.json
index 0f8e719..0d9db26 100644
--- a/test-src/package.json
+++ b/test-src/package.json
@@ -20,7 +20,7 @@
     "node-esapi": "0.0.1",
     "serve-favicon": "^2.3.0",
     "swig": "^1.4.2",
-    "underscore": "^1.8.3"
+    "underscore": "^1.12.1"
   },
   "comments": {
     "//": "a9 insecure components"