package: add `json3` dep
index: use `json3`
package: pin versions