Bumping version, using velocity rc4 and locking down npm