Sorry for the delay in responding, somehow this dropped off my radar.

Did you ever find out why you were getting a 403 from the underscore tarball? I just tried here and it works fine. I can't imagine why getting the 1.8.x tarball would be blocked by your firewall, but a 1.9.x one wouldn't.

I checked to see if there was a vulnerability against underscore from snyk.io - didn't see anything. Sometimes customers run software that blocks vulnerable versions from being downloaded.

There's no real harm in upgrading either, so will merge shortly.