It looks like the package maintainers had a v2.1.1 that was on github
but then released a different 2.1.1 to NPM.  When renovate(upgrade
automation) tries to make any changes, it updates the lockfile to point
to the NPM one which currently breaks tests.

Pinning to the correct version in the package.json so that we can get
other things upgraded.