To bump `pug` to latest >3.x.x

[oscard0m]

pug it's already in v3 since a few months ago. Some vulnerability issues are coming with the v2-beta version: https://github.com/oscard0m/express-boilerplate/pull/1

Is there any blocker to update this?

generator/bin/express-cli.js

Line 307 in d1f3fcc

pkg.dependencies.pug = '2.0.0-beta11'