lock in npm version... for Heroku