update packages, add istanbul
fix var leak