Due to a recent release of 2.5.10 which broke node 10/12 support
this commit locks down dependency before 2.5.11 is released
as some registry will still pick up unpublished version (2.5.10)
2.4.11 is released with apache-md5, apache-crypt locked down
See http-auth/http-auth/commit/0097ed6195986942a65e14b38b3f30281c9f6435
backport of #374
Due to a recent release of 2.5.10 which broke node 10/12 support this commit locks down dependency before 2.5.11 is released as some registry will still pick up unpublished version (2.5.10) 2.4.11 is released with apache-md5, apache-crypt locked down
See http-auth/http-auth/commit/0097ed6195986942a65e14b38b3f30281c9f6435