pin bower and node-tmp versions to workaround broken build