upgrade packages
don't track node_modules, silly