package: Update debug

debug@2 uses `stderr` again, so may as well use the latest version.