chore(deps): bump nine npm packages in one branch (#91)

- Combine dependabot #89 (production, 2) and #90 (development, 7)
  into one tree; both touch package.json and package-lock.json, so
  merging them separately forces a rebase-and-rerun round.
- The two branches merged without conflict, so the lockfile is the
  plain union of both PRs' lockfiles and was not regenerated.

Author: htcom-code