We depend on glob >4.3, correct package.json

See also issue #1542 

TBR=@arv