airandfingers latest is 2.5.10, I believe npm update returns latest version allowed by the semver string you used in the package.json