deps: bump all

app: use body-parser’s json and urlencoded separately
api: no longer use `res.json(status, obj)`
v2.7.1