update package.json with stricter version numbers