Updated the dependencies (and fixed the decompress vulnerability)

[not-matthias]

What kind of change does this PR introduce? (check at least one)

• Bugfix
• Feature
• New Binding Issue #___
• Code style update
• Refactor
• Build-related changes
• Other, please describe: Dependency update

Does this PR introduce a breaking change? (check one)

• Yes. Issue #___
• No

The PR fulfills these requirements:

• It's submitted to the dev branch and not the master branch
• When resolving a specific issue, it's referenced in the PR's title (e.g. fix: #xxx[,#xxx], where "xxx" is the issue number)

If adding a new feature, the PR's description includes:

• A convincing reason for adding this feature (to avoid wasting your time, it's best to open a suggestion issue first and wait for approval before working on it)

Other information:

This fixes the vulnerability in https://github.com/kevva/decompress. (see here for the pull request).

[nothingismagick]

It's just a yarn.lock - didn't the package.json need updating too

[not-matthias]

Decompress is used by the imagemin-* dependencies and not directly in the project.