Lock versions of packages, fix client.json configuration