diff --git a/packages/hothouse/package-lock.json b/packages/hothouse/package-lock.json
index 5276775..f1cf2d6 100644
--- a/packages/hothouse/package-lock.json
+++ b/packages/hothouse/package-lock.json
@@ -594,9 +594,9 @@
       "integrity": "sha512-tgp+dl5cGk28utYktBsrFqA7HKgrhgPsg6Z/EfhWI4gl1Hwq8B/GmY/0oXZ6nF8hDVesS/FpnYaD/kOWhYQvyg=="
     },
     "mustache": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/mustache/-/mustache-2.3.0.tgz",
-      "integrity": "sha1-QCj3d4sXcIpImTCm5SrDvKDaQdA="
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/mustache/-/mustache-3.0.0.tgz",
+      "integrity": "sha512-bhBDkK/PioIbtQzRIbGUGypvc3MC4c389QnJt8KDIEJ666OidRPoXAQAHPivikfS3JkMEaWoPvcDL7YrQxtSwg=="
     },
     "native-promise-only": {
       "version": "0.8.1",
diff --git a/packages/hothouse/package.json b/packages/hothouse/package.json
index cd09685..7e86c66 100644
--- a/packages/hothouse/package.json
+++ b/packages/hothouse/package.json
@@ -45,7 +45,7 @@
     "hosted-git-info": "^2.6.1",
     "lodash": "^4.17.10",
     "minimatch": "^3.0.4",
-    "mustache": "^2.3.0",
+    "mustache": "^3.0.0",
     "node-emoji": "^1.8.1",
     "normalize-package-data": "^2.4.0",
     "remark": "^9.0.0",