update and lock dependencies

[particlebanana]

Update dependencies we don't control but lock them down for better control over what changes we accept.

Also order them in alphabetical order!

[devinivy]

I would suggest providing a shrinkwrap rather than locking the versions down. That's just me!
E.g.: https://github.com/hapijs/hapi/blob/master/npm-shrinkwrap.json

[particlebanana]

Yeah that's probably a good idea.

[RWOverdijk]

@devinivy 👍