deps: ~ pin node.js, bump express