update semver/npm/request/sax - closes #2030