Version bump, security updates to sub dep npmlog

[jannomeister]

can the maintainers approve this PR? because snyk detected a CVE in the latest version of bcrypt

[alias-mac]

@jannomeister the dependency is using a ^, thus you should be able to bump the version to latest in your own parent dependency. What am I missing?