Set up dependency management

[codehearts]

Using something that reports vulnerabilities would be great. Synk looks like it could do that