lock down package.json