diff --git a/README.md b/README.md
index e0cd800..8c9e3b6 100644
--- a/README.md
+++ b/README.md
@@ -240,6 +240,8 @@ to prevent stripping out AIV comments eg:
 ```
 
 # Change log
+## [1.2.1] - 27/10/2018
+- security updates
 ## [1.2.0] - 27/10/2018
 - inject as comment will no more be a version behind with auto increase version
 - inject as comment can now switched to multiline comment type eg /** */
diff --git a/package-lock.json b/package-lock.json
index 0204600..97cebad 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,6 +1,6 @@
 {
   "name": "webpack-auto-inject-version",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {
diff --git a/package.json b/package.json
index 7f427ad..53419df 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "webpack-auto-inject-version",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "repository": "radswiat/webpack-auto-inject-version",
   "description": "Webpack plugin for auto inject version from package.json",
   "main": "dist/WebpackAutoInjectVersion.js",
@@ -34,7 +34,7 @@
     "eslint-plugin-jsx-control-statements": "^2.1.1",
     "eslint-plugin-react": "^4.2.3",
     "gutil": "^1.6.4",
-    "lodash": "^4.17.4",
+    "lodash": "^4.17.11",
     "optimist": "^0.6.1",
     "semver": "^5.3.0",
     "webpack": "^2.3.3",