suppress packages/npm in smart.lock