Lock down latest dependency versions, also transitive

See https://npmjs.org/doc/shrinkwrap.html