explicit npm versions