Loosen node-varnish dep
Recommend setting "from" for other packages too