Freeze external dependancies in package.json