lock down npm package versions AGPUSH-832

https://issues.jboss.org/browse/AGPUSH-832