No reason for async to be a prod dependency, we don't use async very often and it causes false security warnings like #8068
