version locking in package.json