make package match dev machine
move npm back to latest version on heroku, which is a bit behind