archaic versions in package.json take down production apps

[movy]

Installing pm2/io just rendered my app unrestartable, because some of the packages pulled by pm2/io are gravely outdated, and installation of pm2/io requires nuking package-lock.json and node_modules, otherwise dependencies tree switches to those old versions, causing some very hard-to-track down errors. In my case it was some ancient async version ("async": "~2.6.1", vs current "async": "^3.2.6",), but judging from issues in this repo, there're many more).

It would be nice if maintainers updated dependencies or posted issues some kinda warning in the docs.