package.json: pin used versions