doT had a security vulnerability and ejs has even fewer dependencies: https://www.npmjs.com/advisories/798
