updated & locking down npm dependencies