chore(package): lock down npm dependencies