spent the whole morning debugging a mysterious issue only to discover it was because of a 3-year-old dependency that npm refused to update automatically. Can we get a "npm update --actually-update-everything" flag already?