We've had a lot of problems with the fact that the DefinitelyTyped packages for Express consists of multiple separate packages (notably @types/express and @types/express-serve-static-core) and that new versions of @types/express don't work unless you update @types/express-serve-static-core too but that the dependencies between them are not declared tightly enough.
https://github.com/apollographql/apollo-server/issues/5280
Use:
npm dedup