locked down lodash and less-middleware verisons