pin webassets to our patched version