limiting upper npm version