fix express version in deps