This is a very conservative approach, bumping the Node requirement only as much as necessary to be able to use thorugh2 v4.
This will help hercule with deduplication as it already depends on through2 v3. I'll push a PR there that pulls it up to v4 when there's a new release of through2.
The last commit in the PR changes the way lodash is required. It's not strictly necessary but it helps deduplication in hercule (and in general) as it and other many packages depend on the full lodash and it's thus likely already in the dependency tree.
@realityking https://github.com/jamesramsay/through2-get/pull/116#issue-536871780: