diff --git a/package.json b/package.json
index 64ded29..80f102d 100644
--- a/package.json
+++ b/package.json
@@ -30,7 +30,7 @@
     "morgan": "1.10.0",
     "pug": "^2.0.4",
     "serve-favicon": "~2.5.0",
-    "underscore": "^1.8.3",
+    "underscore": "^1.12.1",
     "universal-analytics": "^0.4.20"
   },
   "devDependencies": {
diff --git a/yarn.lock b/yarn.lock
index bab251e..b4924a4 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2789,10 +2789,10 @@ underscore.string@~3.3.4:
     sprintf-js "^1.0.3"
     util-deprecate "^1.0.2"
 
-underscore@^1.8.3:
-  version "1.10.2"
-  resolved "https://registry.yarnpkg.com/underscore/-/underscore-1.10.2.tgz#73d6aa3668f3188e4adb0f1943bd12cfd7efaaaf"
-  integrity sha512-N4P+Q/BuyuEKFJ43B9gYuOj4TQUHXX+j2FqguVOpjkssLUUrnJofCcBccJSCoeturDoZU6GorDTHSvUDlSQbTg==
+underscore@^1.12.1:
+  version "1.12.1"
+  resolved "https://registry.yarnpkg.com/underscore/-/underscore-1.12.1.tgz#7bb8cc9b3d397e201cf8553336d262544ead829e"
+  integrity sha512-hEQt0+ZLDVUMhebKxL4x1BTtDY7bavVofhZ9KZ4aI26X9SRaE+Y3m83XUL1UP2jn8ynjndwCCpEHdUG+9pP1Tw==
 
 union-value@^1.0.0:
   version "1.0.1"