[fix #200] lock down npm dependencies