diff --git a/package.json b/package.json
index 5be0a41..d5132ee 100644
--- a/package.json
+++ b/package.json
@@ -227,7 +227,7 @@
     "touch": "^3.1.0",
     "type-is": "^1.6.18",
     "undefsafe": "^2.0.3",
-    "underscore": "^1.9.2",
+    "underscore": "^1.12.1",
     "unique-string": "^1.0.0",
     "universalify": "^1.0.0",
     "unpipe": "^1.0.0",
diff --git a/yarn.lock b/yarn.lock
index 9659b82..c290bd6 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1794,10 +1794,10 @@ undefsafe@^2.0.2, undefsafe@^2.0.3:
   dependencies:
     debug "^2.2.0"
 
-underscore@^1.7.0, underscore@^1.9.2:
-  version "1.9.2"
-  resolved "https://registry.yarnpkg.com/underscore/-/underscore-1.9.2.tgz#0c8d6f536d6f378a5af264a72f7bec50feb7cf2f"
-  integrity sha512-D39qtimx0c1fI3ya1Lnhk3E9nONswSKhnffBI0gME9C99fYOkNi04xs8K6pePLhvl1frbDemkaBQ5ikWllR2HQ==
+underscore@^1.12.1, underscore@^1.7.0:
+  version "1.12.1"
+  resolved "https://registry.yarnpkg.com/underscore/-/underscore-1.12.1.tgz#7bb8cc9b3d397e201cf8553336d262544ead829e"
+  integrity sha512-hEQt0+ZLDVUMhebKxL4x1BTtDY7bavVofhZ9KZ4aI26X9SRaE+Y3m83XUL1UP2jn8ynjndwCCpEHdUG+9pP1Tw==
 
 unique-string@^1.0.0:
   version "1.0.0"