lock all package.json versions