lock npm to specific version