audit fixes, replace update-notifier with update-notifier-cjs (#5420)

* npm audit fixes

* update update-notifier

* switch to cjs

* better type -cjs

Author: bkendall