pinning all npm dependencies to something sane.