Make lodash a dependency

[quentindutot]

lodash should moved from devDependencies to dependencies (I'm willing to make the PR if needed)

I understand you want to keep this package up-to-date with latest lodash version but doing it like that is an anti-pattern
What about using Github dependabot for automatic PRs?