lock down npm and bower version.