lock dependencies down + upgrade socket io to latest