build(deps): [security] bump extend from 3.0.1 to 3.0.2 (#222)

[//]: # (dependabot-start)
⚠️  **Dependabot is rebasing this PR** ⚠️ 

If you make any changes to it yourself then they will take precedence over the rebase.

---

[//]: # (dependabot-end)

Bumps [extend](https://github.com/justmoon/node-extend) from 3.0.1 to 3.0.2. **This update includes security fixes.**
<details>
<summary>Vulnerabilities fixed</summary>

*Sourced from The GitHub Security Advisory Database.*

> **Low severity vulnerability that affects extend**
> A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.
> 
> Affected versions: >= 3.0.0 < 3.0.2

</details>
<details>
<summary>Changelog</summary>

*Sourced from [extend's changelog](https://github.com/justmoon/node-extend/blob/master/CHANGELOG.md).*

> 3.0.2 / 2018-07-19
> ==================
>   * [Fix] Prevent merging `__proto__` property ([#48](https://github-redirect.dependabot.com/justmoon/node-extend/issues/48))
>   * [Dev Deps] update `eslint`, `@ljharb/eslint-config`, `tape`
>   * [Tests] up to `node` `v10.7`, `v9.11`, `v8.11`, `v7.10`, `v6.14`, `v4.9`; use `nvm install-latest-npm`
</details>
<details>
<summary>Commits</summary>

- [`8d106d2`](justmoon/node-extend@8d106d2) v3.0.2
- [`e97091f`](justmoon/node-extend@e97091f) [Dev Deps] update `tape`
- [`e841aac`](justmoon/node-extend@e841aac) [Tests] up to `node` `v10.7`
- [`0e68e71`](justmoon/node-extend@0e68e71) [Fix] Prevent merging __proto__ property
- [`a689700`](justmoon/node-extend@a689700) Only apps should have lockfiles
- [`f13c1c4`](justmoon/node-extend@f13c1c4) [Dev Deps] update `eslint`, `@ljharb/eslint-config`, `tape`
- [`f3570fe`](justmoon/node-extend@f3570fe) [Tests] up to `node` `v10.0`, `v9.11`, `v8.11`, `v7.10`, `v6.14`, `v4.9`; use...
- See full diff in [compare view](justmoon/node-extend@v3.0.1...v3.0.2)
</details>
<br />

[![Dependabot compatibility score](https://api.dependabot.com/badges/compatibility_score?dependency-name=extend&package-manager=npm_and_yarn&previous-version=3.0.1&new-version=3.0.2)](https://dependabot.com/compatibility-score.html?dependency-name=extend&package-manager=npm_and_yarn&previous-version=3.0.1&new-version=3.0.2)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
- `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com):
- Update frequency (including time of day and day of week)
- Automerge options (never/patch/minor, and dev/runtime dependencies)
- Pull request limits (per update run and/or open at any time)
- Out-of-range updates (receive only lockfile updates, if desired)
- Security updates (receive only security updates, if desired)

Finally, you can contact us by mentioning @dependabot.

</details>

Author: dependabot[bot]

yarn.lock

@@ -4631,9 +4631,9 @@ extend-shallow@^3.0.0, extend-shallow@^3.0.2:
     is-extendable "^1.0.1"
 
 extend@~3.0.1:
-  version "3.0.1"
-  resolved "https://registry.npmjs.org/extend/-/extend-3.0.1.tgz#a755ea7bc1adfcc5a31ce7e762dbaadc5e636444"
-  integrity sha1-p1Xqe8Gt/MWjHOfnYtuq3F5jZEQ=
+  version "3.0.2"
+  resolved "https://registry.yarnpkg.com/extend/-/extend-3.0.2.tgz#f8b1136b4071fbd8eb140aff858b1019ec2915fa"
+  integrity sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==
 
 external-editor@^2.0.4:
   version "2.2.0"