merge@1.2.1 is vulnerable to prototype pollution via _recursiveMerge

According to npm audit, one of Twing's dependencies, merge@1.2.1, is vulnerable to prototype pollution via _recursiveMerge:

# Run  npm install merge@2.1.1  to resolve 1 vulnerability
SEMVER WARNING: Recommended action is a potentially breaking change
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ merge                                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ merge                                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ merge                                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1666                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

I had a go at updating merge on a local copy of Twing and after updating package.json, I've managed to successfully build Twing and all tests pass without any further modifications.

I'm happy to provide a pull request, although unless I've missed something all it'll involve is updating package.json.