fix dep version so old npm doesnt get confused