explicit versioning in package.json