npm update breaks more things than it fixes, can we just have a stable dependency chain for once?