package.json: framework, os, server packages now use whatever npm finds