Just did a quick search for "_." and realized lodash is a dependency almost exclusively because of assign. We could easily remove lodash (and all the security concerns with it) by using the Spread operator or Object.assign.

_.includes and _.has are also used a couple of times and could easily be replaced with Array.includes and hasOwnProperty.