use 1.4.9 since npm shasum is busted for 1.4.8