track versions with npm shrinkwrap