Agree with Scott's comment, why are there some wildcards, don't we want to lock down tested versions for package.json?