Lock xml2js dependency version
bump version